Week 34, 2022

22–28 August 2022

New CVEs: 607
Critical: 24
High: 74
Newly exploited: 11
Advisories: 134
Malicious pkgs: 30

Newly exploited 11

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2022-22963 KEV Aug 25, 2022 Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression
EPSS 100%
Critical 9.8
CVE-2022-24706 KEV Aug 25, 2022 Remote Code Execution Vulnerability in Packaging
Apache Software Foundation · Apache CouchDB

EPSS 93%
Critical 9.8
CVE-2022-26352 KEV Aug 25, 2022 · ransomware An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is n…
EPSS 91%
Critical 9.8
CVE-2021-39226 KEV Aug 25, 2022 Snapshot authentication bypass in grafana
Grafana · Grafana

EPSS 100%
Critical 9.8
CVE-2022-24112 KEV Aug 25, 2022 apisix/batch-requests plugin allows overwriting the X-REAL-IP header
Apache Software Foundation · Apache APISIX

EPSS 96%
High 8.8
CVE-2022-2294 KEV Aug 25, 2022 · ransomware Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag…
Google · Chrome

EPSS 71%
High 7.8
CVE-2021-38406 KEV Aug 25, 2022 Delta Electronics DOPSoft 2 Out-of-Bounds Write
Delta Electronics · DOPSoft 2

EPSS 76%
High 7.8
CVE-2020-28949 KEV Aug 25, 2022 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite f…
EPSS 85%
High 7.5
CVE-2020-36193 KEV Aug 25, 2022 Directory Traversal in Archive_Tar
EPSS 71%
High 7.5
CVE-2021-31010 KEV Aug 25, 2022 A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14…
Apple · macOS · watchOS

EPSS 3.7%
High 8.6
CVE-2022-0028 KEV Aug 22, 2022 PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering
Palo Alto Networks · PAN-OS · Prisma Access · Cloud NGFW

EPSS 2.7%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.6
CVE-2022-30690 A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP re…
WWBN · AVideo

EPSS 84%
Critical 9.9
CVE-2022-30534 An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-craft…
WWBN · AVideo

EPSS 76%
Critical 9.9
CVE-2022-30547 A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP req…
WWBN · AVideo

EPSS 65%
Critical 9.8
CVE-2022-37055 D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
EPSS 56%
Critical 9.9
CVE-2022-2234 mySCADA myPRO Command Injection
mySCADA · mySCADA myPRO

EPSS 42%
Critical 9.9
CVE-2022-32572 An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT…
WWBN · AVideo

EPSS 25%
Critical 9.8
CVE-2022-37056 D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,
EPSS 11%
Critical 9.6
CVE-2022-32770 A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT…
WWBN · AVideo

EPSS 4.7%
Critical 9.6
CVE-2022-32771 A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT…
WWBN · AVideo

EPSS 4.5%
Critical 9.8
CVE-2022-32839 The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 1…
Apple · macOS · watchOS · tvOS

EPSS 4.1%
Critical 9.6
CVE-2022-32772 A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT…
WWBN · AVideo

EPSS 4%
Critical 9.6
CVE-2022-26842 A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A spe…
WWBN · AVideo

EPSS 3.9%
Critical 9.0
CVE-2022-28712 A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP…
WWBN · AVideo

EPSS 3.3%
Critical 9.1
CVE-2021-3563 Openstack Keystone Incorrect Authorization vulnerability
EPSS 2%
Critical 9.8
CVE-2022-34858 WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability
miniOrange · OAuth 2.0 client for SSO (WordPress plugin)

EPSS 1.8%

All 24 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

DLA-3083-1 puma - security update 4 CVEs
DSA-5218-1 zlib - security update 1 CVEs
ICSA-22-235-03 mySCADA myPRO 1 CVEs
ICSA-22-235-02 Delta Industrial Automation DIALink 1 CVEs