Week 27, 2022

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2022-31137 Unauthenticated Remote Code Execution in Roxy-WI

  hap-wi · roxy-wi

  EPSS 91%
• Critical 9.8
  CVE-2022-34265 Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
  EPSS 74%
• Critical 10.0
  CVE-2022-31126 Unauthenticated Remote Code Execution in Roxy-wi

  hap-wi · roxy-wi

  EPSS 53%
• Critical 9.8
  CVE-2022-35411 rpc.py vulnerable to Deserialization of Untrusted Data
  EPSS 47%
• Critical 9.8
  CVE-2022-33980 Apache Commons Configuration insecure interpolation defaults

  Apache Software Foundation · Apache Commons Configuration

  EPSS 45%
• Critical 9.8
  CVE-2022-33171 SQL injection in typeORM
  EPSS 21%
• Critical 10.0
  CVE-2022-31125 Authentication Bypass in Roxy-wi

  hap-wi · roxy-wi

  EPSS 20%
• Critical 9.8
  CVE-2022-32207 When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporar…
  EPSS 12%
• Critical 9.8
  CVE-2022-32533 Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues

  Apache Software Foundation · Apache Portals

  EPSS 4.2%
• Critical 9.0
  CVE-2022-20812 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities

  Cisco · Cisco TelePresence Video Communication Server (VCS) Expressway

  EPSS 2%
• Critical 9.1
  CVE-2022-2339 Server-Side Request Forgery (SSRF) in nocodb/nocodb

  nocodb · nocodb/nocodb

  EPSS 1.9%
• Critical 9.8
  CVE-2022-31836 Path Traversal in Beego
  EPSS 1.7%
• Critical 9.8
  CVE-2022-1245 Keycloak vulnerable to privilege escalation on Token Exchange feature
  EPSS 1.4%
• Critical 9.4
  CVE-2022-34151 Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 …

  Omron · Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series

  EPSS 1.3%
• Critical 9.0
  CVE-2022-20813 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities

  Cisco · Cisco TelePresence Video Communication Server (VCS) Expressway

  EPSS 1.1%

All 16 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2022-25046 A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.
  EPSS 57%
• Unscored
  CVE-2022-33098 Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to…
  EPSS 54%
• Medium 6.5
  CVE-2022-32206 curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different alg…
  EPSS 36%
• Unscored
  CVE-2022-32054 Tenda AC10 US_AC10V1.0RTL_V15.03.06.26_multi_TD01 was discovered to contain a remote code execution (RCE) vulnerability via the lanIp parameter.
  EPSS 35%
• Unscored
  CVE-2022-31854 Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
  EPSS 32%
• Medium 4.3
  CVE-2022-32205 A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large a…
  EPSS 31%
• Unscored
  CVE-2022-25048 Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.
  EPSS 20%
• Unscored
  CVE-2022-32449 TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vuln…
  EPSS 19%