Week 23, 2022
6–12 June 2022
Newly exploited 38
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Critical 9.9
CVE-2021-38163 KEV Jun 9, 2022 SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can uploa…EPSS 37%
-
Critical 9.8
CVE-2016-2386 KEV Jun 9, 2022 SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vect…EPSS 72%
-
Medium 5.3
CVE-2016-2388 KEV Jun 9, 2022 The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka …EPSS 52%
-
Critical 9.8
CVE-2019-7193 KEV Jun 8, 2022 · ransomware This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating …EPSS 14%
-
Critical 9.8
CVE-2019-7194 KEV Jun 8, 2022 · ransomware This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend upd…EPSS 83%
-
Critical 9.8
CVE-2017-6862 KEV Jun 8, 2022 NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code…EPSS 46%
-
Critical 9.8
CVE-2019-7195 KEV Jun 8, 2022 · ransomware This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend upd…EPSS 89%
-
Critical 9.8
CVE-2019-7192 KEV Jun 8, 2022 · ransomware This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend upda…EPSS 88%
-
High 8.8
CVE-2017-5030 KEV Jun 8, 2022 Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote a…EPSS 41%
-
High 8.8
CVE-2016-5198 KEV Jun 8, 2022 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumpt…EPSS 34%
-
High 8.8
CVE-2006-2492 KEV Jun 8, 2022 Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted att…EPSS 48%
-
High 8.8
CVE-2011-2462 KEV Jun 8, 2022 Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UN…EPSS 89%
-
High 8.8
CVE-2018-17480 KEV Jun 8, 2022 Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a rem…EPSS 36%
-
High 8.8
CVE-2018-6065 KEV Jun 8, 2022 Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a r…EPSS 60%
-
High 8.8
CVE-2012-5054 KEV Jun 8, 2022 Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code …EPSS 21%
-
High 8.8
CVE-2016-1646 KEV Jun 8, 2022 The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data t…EPSS 48%
-
High 8.8
CVE-2018-4990 KEV Jun 8, 2022 Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Succ…EPSS 36%
-
High 8.8
CVE-2009-3953 KEV Jun 8, 2022 The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to exec…EPSS 83%
-
High 8.8
CVE-2012-1889 KEV Jun 8, 2022 Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a …EPSS 84%
-
High 8.8
CVE-2008-0655 KEV Jun 8, 2022 Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.EPSS 38%
-
High 8.8
CVE-2017-5070 KEV Jun 8, 2022 Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arb…EPSS 32%
-
High 8.8
CVE-2018-17463 KEV Jun 8, 2022 Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafte…EPSS 85%
-
High 8.8
CVE-2019-15271 KEV Jun 8, 2022 Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution VulnerabilityEPSS 5.5%
-
High 8.1
CVE-2012-4969 KEV Jun 8, 2022 Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitr…EPSS 80%
-
High 7.8
CVE-2009-0557 KEV Jun 8, 2022 Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open X…EPSS 53%
-
High 7.8
CVE-2011-0609 KEV Jun 8, 2022 Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR…EPSS 64%
-
High 7.8
CVE-2009-1862 KEV Jun 8, 2022 Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remot…EPSS 21%
-
High 7.8
CVE-2009-0563 KEV Jun 8, 2022 Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Con…EPSS 60%
-
High 7.8
CVE-2007-5659 KEV Jun 8, 2022 Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to …EPSS 87%
-
High 7.8
CVE-2010-2572 KEV Jun 8, 2022 Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "Powe…EPSS 59%
-
High 7.8
CVE-2009-4324 KEV Jun 8, 2022 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and …EPSS 82%
-
High 7.8
CVE-2012-0151 KEV Jun 8, 2022 The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, …EPSS 88%
-
High 7.8
CVE-2013-1331 KEV Jun 8, 2022 Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office docume…EPSS 80%
-
High 7.8
CVE-2012-0754 KEV Jun 8, 2022 Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and befor…EPSS 91%
-
High 7.8
CVE-2010-1297 KEV Jun 8, 2022 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2…EPSS 83%
-
High 7.3
CVE-2010-2883 KEV Jun 8, 2022 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers t…EPSS 81%
-
Medium 6.5
CVE-2019-5825 KEV Jun 8, 2022 Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa…EPSS 56%
-
Medium 6.1
CVE-2012-0767 KEV Jun 8, 2022 Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before …EPSS 6.2%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 17%
- Critical 9.1 EPSS 16%
-
Critical 9.9
CVE-2022-1680 An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14…EPSS 16%
- Critical 9.1 EPSS 6.5%
- Critical 10.0 EPSS 4.2%
- Critical 9.3 EPSS 3.1%
-
Critical 9.8
CVE-2022-30877 The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.EPSS 2.6%
-
Critical 9.6
CVE-2022-31479 Remote Code Execution via command injection of the hostnameEPSS 2.4%
LenelS2 · HID Mercury · LNL-X2220 · LP1501
- Critical 9.8 EPSS 2.4%
- Critical 10.0 EPSS 2.3%
- Critical 9.8 EPSS 2.1%
-
Critical 9.1
CVE-2022-24840 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3fileEPSS 2.1%
- Critical 9.8 EPSS 1.9%
-
Critical 9.9
CVE-2022-25152 ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvalsEPSS 1.9%
- Critical 9.1 EPSS 1.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Unscored EPSS 90%
-
Unscored
CVE-2022-29013 A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST…EPSS 77%
-
Unscored
CVE-2022-30780 Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_mo…EPSS 57%
-
Unscored
CVE-2022-31470 An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows att…EPSS 53%
- High 8.1 EPSS 37%
-
Unscored
CVE-2022-30075 In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validat…EPSS 35%
- Unscored EPSS 33%
-
Unscored
CVE-2022-30860 FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.EPSS 25%
Advisories
- SUSE / openSUSE Security Updates 25
- Ubuntu Security Notices (USN) 201 critical
- Debian Security (DSA / DLA) 132 critical
- Oracle Linux Security Advisories (ELSA) 10
- BSI CERT-Bund (WID) 9
- Rocky Linux Security Advisories 2
- AlmaLinux Security Advisories 1
- SICK PSIRT 11 critical
- CISA ICS & IT advisories 1
- SCA-2022-0011 Vulnerabilities in SICK Package Analytics 3 CVEs
- USN-5461-1 freerdp2 vulnerabilities 2 CVEs
- DLA-3048-1 python-bottle - security update 1 CVEs
- DSA-5159-1 python-bottle - security update 1 CVEs