Week 45, 2022

7–13 November 2022

New CVEs: 571
Critical: 71
High: 205
Newly exploited: 7
Advisories: 290
Malicious pkgs: 21

Newly exploited 7

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 8.8
CVE-2022-41128 KEV Nov 8, 2022 Windows Scripting Languages Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows 10 Version 1809 · Windows Server 2022

EPSS 25%
High 7.8
CVE-2022-41125 KEV Nov 8, 2022 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 3%
High 7.8
CVE-2022-41073 KEV Nov 8, 2022 · ransomware Windows Print Spooler Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 2.6%
Medium 6.2
CVE-2021-25369 KEV Nov 8, 2022 An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
Samsung Mobile · Samsung Mobile Devices

EPSS 1.1%
Medium 6.1
CVE-2021-25370 KEV Nov 8, 2022 An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
Samsung Mobile · Samsung Mobile Devices
Medium 5.4
CVE-2022-41091 KEV Nov 8, 2022 · ransomware Windows Mark of the Web Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 2.3%
Medium 4.4
CVE-2021-25337 KEV Nov 8, 2022 Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain l…
Samsung Mobile · Samsung Mobile Devices

EPSS 2.8%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2022-43671 Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.
EPSS 75%
Critical 9.8
CVE-2022-43672 Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software compo…
EPSS 68%
Critical 9.8
CVE-2022-39396 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
parse-community · parse-server

EPSS 39%
Critical 9.8
CVE-2022-31199 Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents…
EPSS 36%
Critical 9.8
CVE-2022-44088 ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.
EPSS 20%
Critical 9.8
CVE-2022-3481 WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi
EPSS 5.3%
Critical 9.8
CVE-2022-40797 Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5…
EPSS 4.1%
Critical 9.8
CVE-2022-42920 Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
Apache Software Foundation · Apache Commons BCEL

EPSS 3.5%
Critical 9.1
CVE-2022-44727 The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).
EPSS 3.2%
Critical 9.1
CVE-2022-37865 Apache Ivy allows creating/overwriting any file on the system
Apache Software Foundation · Apache Ivy

EPSS 2.1%
Critical 9.9
CVE-2022-43546 A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al…
Siemens · SICAM P850 · SICAM P855 · POWER METER SICAM Q100

EPSS 2.1%
Critical 9.9
CVE-2022-43439 A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All ver…
Siemens · SICAM T · SICAM P855 · SICAM P850

EPSS 2.1%
Critical 9.8
CVE-2022-44087 ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOOM_HIGHT.
EPSS 1.9%
Critical 9.8
CVE-2022-44089 ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.
EPSS 1.9%
Critical 9.9
CVE-2022-43545 A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al…
Siemens · SICAM P850 · SICAM P855 · POWER METER SICAM Q100

EPSS 1.9%

All 71 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.3
CVE-2022-3265 A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was…
GitLab · GitLab

EPSS 87%
High 8.8
CVE-2022-41080 Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12

EPSS 77%
Medium 6.5
CVE-2022-44793 handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote att…
EPSS 53%
Medium 6.5
CVE-2022-44792 handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker …
EPSS 52%
High 8.8
CVE-2022-41128 Windows Scripting Languages Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows 10 Version 1809 · Windows Server 2022

EPSS 25%
High 7.8
CVE-2022-41113 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 8.1%
High 7.8
CVE-2022-41109 Windows Win32k Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 8.1%
Medium 6.5
CVE-2022-38120 POWERCOM CO., LTD. UPSMON PRO - Path Traversal
POWERCOM · UPSMON PRO

EPSS 7.7%

Advisories

VDE-2022-046 PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware 83 CVEs
SSA-506569 SSA-506569: Multiple Vulnerabilities in SCALANCE W1750D 13 CVEs
ICSA-22-314-10 Siemens SCALANCE W1750D 13 CVEs
DSA-5275-1 chromium - security update 6 CVEs
DSA-5277-1 php7.4 - security update 4 CVEs
USN-5717-1 php7.2, php7.4, php8.1 vulnerabilities 4 CVEs
ICSA-22-314-11 Siemens SICAM Q100 4 CVEs
SSA-570294 SSA-570294: Multiple Vulnerabilities in SICAM Q100 Before V2.50 4 CVEs
VDE-2022-043 Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family 3 CVEs
SUSE-SU-2022:3924-1 Security update for python3 2 CVEs