Week 42, 2022

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2022-40684 An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy versi…

  Fortinet · Fortinet FortiOS, FortiProxy, FortiSwitchManager

  EPSS 100%
• Critical 9.8
  CVE-2022-21587 Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected ar…

  Oracle · Web Applications Desktop Integrator

  EPSS 98%
• Critical 9.9
  CVE-2022-2992 A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remot…

  GitLab · GitLab

  EPSS 86%
• Critical 9.8
  CVE-2016-20016 MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated att…
  EPSS 86%
• Critical 9.9
  CVE-2022-2884 A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to a…

  GitLab · GitLab

  EPSS 76%
• Critical 9.8
  CVE-2016-20017 D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2…
  EPSS 66%
• Critical 9.8
  CVE-2022-42233 Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.
  EPSS 43%
• Critical 9.8
  CVE-2022-39428 Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected ar…

  Oracle · Web Applications Desktop Integrator

  EPSS 38%
• Critical 9.8
  CVE-2022-37454 Buffer overflow in sponge queue functions
  EPSS 7.4%
• Critical 9.8
  CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

  Apache Software Foundation · Apache Dubbo

  EPSS 3.3%
• Critical 9.8
  CVE-2022-37298 Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control
  EPSS 3.1%
• Critical 9.8
  CVE-2022-43019 OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.
  EPSS 2.8%
• Critical 9.8
  CVE-2022-42149 kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.
  EPSS 2.7%
• Critical 9.9
  CVE-2022-43403 Jenkins Script Security Plugin sandbox bypass vulnerability

  Jenkins Project · Jenkins Script Security Plugin

  EPSS 1.9%
• Critical 9.8
  CVE-2022-43184 D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.
  EPSS 1.9%

All 56 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2022-36958 SolarWinds Platform Deserialization of Untrusted Data

  SolarWinds · SolarWinds Platform · Orion Platform

  EPSS 82%
• High 7.2
  CVE-2022-38108 SolarWinds Platform Deserialization of Untrusted Data

  SolarWinds · SolarWinds Platform · Orion Platform

  EPSS 67%
• High 7.2
  CVE-2022-3552 Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling

  boxbilling · boxbilling/boxbilling

  EPSS 44%
• High 7.2
  CVE-2022-36957 SolarWinds Platform Deserialization of Untrusted Data

  SolarWinds · SolarWinds Platform · Orion Platform

  EPSS 15%
• High 8.8
  CVE-2022-41544 GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.
  EPSS 14%
• Medium 4.6
  CVE-2022-3559 Exim Regex use after free
  EPSS 5%
• Medium 5.4
  CVE-2022-41358 A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payl…
  EPSS 4.5%
• High 8.5
  CVE-2022-39260 Git vulnerable to Remote Code Execution via Heap overflow in `git shell`

  git · git

  EPSS 4%