Week 47, 2022

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2022-45933 KubeView vulnerable to full cluster takeover due to improper authentication
  EPSS 52%
• Critical 9.8
  CVE-2020-23584 Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using …
  EPSS 41%
• Critical 9.8
  CVE-2022-4116 Code injection in quarkus dev ui config editor
  EPSS 33%
• Critical 9.6
  CVE-2022-4135 Heap buffer overflow in GPU

  Google · Chrome

  EPSS 32%
• Critical 9.8
  CVE-2021-3437 Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or denial of service. HP …

  HP · OMEN Gaming Hub SDK

  EPSS 16%
• Critical 9.8
  CVE-2022-40189 Apache Airlfow Pig Provider RCE

  Apache Software Foundation · Apache Airflow · Apache Airlfow Pig Provider

  EPSS 4.2%
• Critical 9.8
  CVE-2022-3634 Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection
  EPSS 4%
• Critical 9.8
  CVE-2022-44808 A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operatin…
  EPSS 3.9%
• Critical 9.8
  CVE-2022-38649 Apache Airflow Pinot provider allowed Command Injection

  Apache Software Foundation · Apache Airflow · Apache Airflow Pinot Provider

  EPSS 3.4%
• Critical 9.8
  CVE-2022-45462 Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability

  Apache Software Foundation · Apache DolphinScheduler

  EPSS 2.9%
• Critical 9.8
  CVE-2020-23583 OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "Ping…
  EPSS 2.4%
• Critical 9.8
  CVE-2022-44255 TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
  EPSS 2.3%
• Critical 9.8
  CVE-2022-44844 TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function.
  EPSS 2%
• Critical 9.8
  CVE-2022-44843 TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg fu…
  EPSS 2%
• Critical 9.8
  CVE-2022-41705 Badaso vulnerable to Remote Code Execution (RCE)
  EPSS 2%

All 95 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.2
  CVE-2022-40770 Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
  EPSS 81%
• High 7.5
  CVE-2022-40303 An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer cou…
  EPSS 41%
• High 8.8
  CVE-2022-39066 There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attac…
  EPSS 27%
• High 7.5
  CVE-2022-24999 qs vulnerable to Prototype Pollution
  EPSS 16%
• High 8.8
  CVE-2021-43258 CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchIn…
  EPSS 12%
• Medium 6.8
  CVE-2022-41223 The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via cra…
  EPSS 11%
• Medium 6.8
  CVE-2022-40765 A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network …
  EPSS 11%
• High 7.8
  CVE-2022-40304 An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic …
  EPSS 5.8%