Week 26, 2022
27 June – 3 July 2022
Newly exploited 9
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
High 8.1
CVE-2022-26925 KEV Jul 1, 2022 Windows LSA Spoofing VulnerabilityEPSS 10%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Critical 9.8
CVE-2022-29499 KEV Jun 27, 2022 · ransomware The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Applia…EPSS 55%
-
High 7.8
CVE-2020-3837 KEV Jun 27, 2022 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1…EPSS 15%
-
High 7.8
CVE-2021-30983 KEV Jun 27, 2022 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arb…EPSS 2.9%
-
High 7.8
CVE-2018-4344 KEV Jun 27, 2022 A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.EPSS 2.4%
-
High 7.8
CVE-2021-4034 KEV Jun 27, 2022 · ransomware A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users t…EPSS 95%
-
High 7.8
CVE-2019-8605 KEV Jun 27, 2022 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malici…EPSS 18%
-
High 7.8
CVE-2020-9907 KEV Jun 27, 2022 A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be ab…EPSS 3.2%
-
Medium 6.5
CVE-2021-30533 KEV Jun 27, 2022 Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafte…EPSS 17%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.9
CVE-2022-2185 A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where…EPSS 77%
- Critical 9.8 EPSS 51%
- Critical 9.8 EPSS 48%
- Critical 9.8 EPSS 26%
- Critical 9.8 EPSS 24%
- Critical 9.1 EPSS 11%
- Critical 9.8 EPSS 9.9%
-
Critical 9.1
CVE-2022-33329 Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets …EPSS 4.3%
-
Critical 9.1
CVE-2022-33328 Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets …EPSS 4.3%
-
Critical 9.1
CVE-2022-33327 Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets …EPSS 4.3%
-
Critical 9.1
CVE-2022-33326 Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets …EPSS 4.3%
-
Critical 9.1
CVE-2022-33325 Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets …EPSS 4.3%
-
Critical 9.1
CVE-2022-33314 Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques…EPSS 4.3%
-
Critical 9.1
CVE-2022-33313 Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques…EPSS 4.3%
-
Critical 9.1
CVE-2022-33312 Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques…EPSS 4.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.0 EPSS 82%
- High 8.0 EPSS 74%
-
Medium 6.5
CVE-2022-26135 A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to p…EPSS 72%
Atlassian · Jira Service Management Data Center · Jira Service Management Server · Jira Software Data Center
-
High 8.1
CVE-2022-2230 A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.…EPSS 58%
-
High 7.5
CVE-2022-28171 The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac…EPSS 52%
Hikvision · DS-A71024/48R-CVS,DS-A72024/48R-CVS · DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D
-
High 8.7
CVE-2022-28127 A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead t…EPSS 38%
-
Unscored
CVE-2022-31885 Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.EPSS 33%
- High 8.1 EPSS 23%
Advisories
- Oracle Linux Security Advisories (ELSA) 512 critical
- SUSE / openSUSE Security Updates 212 critical
- Rocky Linux Security Advisories 19
- AlmaLinux Security Advisories 16
- BSI CERT-Bund (WID) 15
- Debian Security (DSA / DLA) 122 critical
- Ubuntu Security Notices (USN) 111 critical
- CISA ICS & IT advisories 103 critical
- DLA-3064-1 firefox-esr - security update 8 CVEs
- DSA-5172-1 firefox-esr - security update 8 CVEs
- ICSA-22-179-03 Advantech iView 7 CVEs
- ICSA-22-179-06 Motorola Solutions ACE1000 5 CVEs
- USN-5495-1 curl vulnerabilities 4 CVEs
- ELSA-2022-4772 Critical: thunderbird security update (Oracle Linux 9) 2 CVEs
- ELSA-2022-4765 Critical: firefox security update (Oracle Linux 9) 2 CVEs
- SUSE-SU-2022:2197-1 Security update for openssl-1_0_0 2 CVEs
- SUSE-SU-2022:2192-1 Security update for rubygem-rack 2 CVEs
- ICSA-22-181-01 Exemys RME1 1 CVEs