Week 41, 2022

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2022-42889 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Software Foundation · Apache Commons Text

  EPSS 100%
• Critical 9.8
  CVE-2022-24697 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

  Apache Software Foundation · Apache Kylin

  EPSS 85%
• Critical 9.8
  CVE-2022-38418 Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

  Adobe · ColdFusion

  EPSS 80%
• Critical 9.8
  CVE-2022-35711 Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability

  Adobe · ColdFusion

  EPSS 74%
• Critical 9.8
  CVE-2022-35690 Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability

  Adobe · ColdFusion

  EPSS 73%
• Critical 9.0
  CVE-2022-32174 Gogs - XSS

  Gogs · Gogs

  EPSS 58%
• Critical 9.8
  CVE-2022-35710 Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability

  Adobe · ColdFusion

  EPSS 43%
• Critical 9.8
  CVE-2022-35712 Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability

  Adobe · ColdFusion

  EPSS 38%
• Critical 9.8
  CVE-2022-40871 Dolibarr vulnerable to Eval Injection
  EPSS 35%
• Critical 10.0
  CVE-2022-35698 Adobe Commerce Stored XSS Arbitrary code execution

  Adobe · Magento Commerce

  EPSS 15%
• Critical 9.8
  CVE-2022-42040 The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the demo…
  EPSS 6.7%
• Critical 9.8
  CVE-2022-40664 Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher

  Apache Software Foundation · Apache Shiro

  EPSS 3.6%
• Critical 9.8
  CVE-2022-37601 Prototype pollution in webpack loader-utils
  EPSS 3.5%
• Critical 9.8
  CVE-2022-33874 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login components of FortiTester 2…

  Fortinet · Fortinet FortiTester

  EPSS 3%
• Critical 9.8
  CVE-2022-33872 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login components of FortiTeste…

  Fortinet · Fortinet FortiTester

  EPSS 3%

All 67 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.2
  CVE-2022-38421 Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

  Adobe · ColdFusion

  EPSS 80%
• High 8.8
  CVE-2022-38053 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 76%
• High 7.8
  CVE-2022-41034 Visual Studio Code Remote Code Execution Vulnerability

  Microsoft · Visual Studio Code

  EPSS 67%
• High 7.5
  CVE-2022-39288 Denial of service in Fastify via Content-Type header

  fastify · fastify

  EPSS 59%
• High 7.8
  CVE-2022-38044 Windows CD-ROM File System Driver Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 56%
• High 7.5
  CVE-2022-38419 Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read

  Adobe · ColdFusion

  EPSS 54%
• High 7.2
  CVE-2022-38424 Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write

  Adobe · ColdFusion

  EPSS 46%
• Medium 4.9
  CVE-2022-38423 Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability

  Adobe · ColdFusion

  EPSS 46%