Week 36, 2022
5–11 September 2022
Newly exploited 11
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
- Critical 10.0 EPSS 88%
-
Critical 9.8
CVE-2018-2628 KEV Sep 8, 2022 Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are…EPSS 100%
-
Critical 9.8
CVE-2022-26258 KEV Sep 8, 2022 D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.EPSS 92%
-
Critical 9.8
CVE-2018-6530 KEV Sep 8, 2022 · ransomware OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L…EPSS 97%
-
Critical 9.8
CVE-2018-7445 KEV Sep 8, 2022 A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service …EPSS 66%
-
Critical 9.6
CVE-2022-3075 KEV Sep 8, 2022 Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially…EPSS 5.8%
-
High 8.1
CVE-2017-5521 KEV Sep 8, 2022 An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They ar…EPSS 89%
-
High 7.8
CVE-2011-1823 KEV Sep 8, 2022 The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to exec…EPSS 41%
-
Medium 5.7
CVE-2011-4723 KEV Sep 8, 2022 The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.EPSS 3.1%
-
Medium 5.5
CVE-2020-9934 KEV Sep 8, 2022 An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, …EPSS 3.2%
-
Medium 4.3
CVE-2018-13374 KEV Sep 8, 2022 · ransomware A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server…EPSS 38%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2022-31814 pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3…EPSS 92%
- Critical 10.0 EPSS 88%
- Critical 9.9 EPSS 76%
-
Critical 9.9
CVE-2022-36100 XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval InjectionEPSS 74%
- Critical 10.0 EPSS 48%
-
Critical 9.9
CVE-2021-36782 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectEPSS 4.2%
-
Critical 9.8
CVE-2022-36663 Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameterEPSS 2.6%
-
Critical 9.8
CVE-2022-31860 An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule.EPSS 2.4%
- Critical 9.8 EPSS 2.2%
-
Critical 9.8
CVE-2022-34747 A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution…EPSS 1.8%
- Critical 9.9 EPSS 1.5%
- Critical 9.8 EPSS 1.3%
- Critical 9.1 EPSS 1.3%
- Critical 10.0 EPSS 1.2%
-
Critical 9.8
CVE-2022-36660 xhyve commit dfbe09b was discovered to contain a stack buffer overflow via the component pci_vtrnd_notify().EPSS 1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.9 EPSS 72%
- High 8.9 EPSS 65%
- High 8.9 EPSS 60%
-
Unscored
CVE-2022-39810 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console…EPSS 58%
-
High 8.9
CVE-2022-36097 XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formEPSS 58%
- High 7.3 EPSS 43%
-
High 7.5
CVE-2022-2633 The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found …EPSS 36%
-
Unscored
CVE-2022-30079 Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that could allow remote aut…EPSS 25%
Advisories
- SUSE / openSUSE Security Updates 593 critical
- BSI CERT-Bund (WID) 18
- Ubuntu Security Notices (USN) 11
- Oracle Linux Security Advisories (ELSA) 10
- Debian Security (DSA / DLA) 91 critical
- CISA ICS & IT advisories 62 critical
- CERT@VDE 52 critical
- Rocky Linux Security Advisories 2
- AlmaLinux Security Advisories 2
- Amazon Linux Security Center (ALAS) 1
- VDE-2022-039 Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual 20 CVEs
- VDE-2021-003 MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 (Update A) 18 CVEs
- ICSA-22-251-01 MZ Automation libIEC61850 3 CVEs
- SUSE-SU-2022:15034-1 Security update for ruby 3 CVEs
- ICSA-22-249-03 Cognex 3D-A1000 Dimensioning System 3 CVEs
- SUSE-SU-2022:3231-1 Security update for python-PyYAML 1 CVEs
- SUSE-SU-2022:3103-1 Security update for python-bottle 1 CVEs
- DSA-5225-1 chromium - security update 1 CVEs