Week 40, 2022
3–9 October 2022
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.1
CVE-2022-42457 Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., c…EPSS 3.2%
- Critical 9.3 EPSS 1.6%
-
Critical 9.8
CVE-2022-40872 An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, classCode.EPSS 1.2%
-
Critical 9.8
CVE-2022-40824 B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple t…EPSS 1.1%
-
Critical 9.8
CVE-2022-40828 B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Mul…EPSS 1.1%
-
Critical 9.8
CVE-2022-40829 B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple th…EPSS 1.1%
-
Critical 9.8
CVE-2022-40826 B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple …EPSS 1.1%
-
Critical 9.8
CVE-2022-40830 B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multip…EPSS 1.1%
-
Critical 9.8
CVE-2022-40827 B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple thir…EPSS 1%
- Critical 9.8 EPSS 1%
- Critical 9.1
- Critical 9.1
- Critical 9.0
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.0
CVE-2022-41082 Microsoft Exchange Server Remote Code Execution VulnerabilityEPSS 100%
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12
-
High 8.8
CVE-2022-41040 Microsoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100%
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12
-
Unscored
CVE-2022-31680 The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter s…EPSS 31%
-
Unscored
CVE-2022-36635 ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.EPSS 17%
- Unscored EPSS 8.3%
- High 8.0 EPSS 7.9%
- Medium 5.4 EPSS 7.1%
-
Medium 6.5
CVE-2022-36551 Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import moduleEPSS 6.9%
Advisories
- SUSE / openSUSE Security Updates 363 critical
- Ubuntu Security Notices (USN) 19
- BSI CERT-Bund (WID) 16
- Oracle Linux Security Advisories (ELSA) 16
- Debian Security (DSA / DLA) 14
- AlmaLinux Security Advisories 7
- CISA ICS & IT advisories 71 critical
- Rocky Linux Security Advisories 7
- SUSE-SU-2022:3524-1 Security update for nodejs16 4 CVEs
- ICSA-22-279-01 Rockwell Automation FactoryTalk VantagePoint 2 CVEs
- SUSE-SU-2022:3516-1 Security update for nodejs14 2 CVEs
- SUSE-SU-2022:3503-1 Security update for nodejs12 2 CVEs