Week 51, 2022

19–25 December 2022

New CVEs: 661
Critical: 90
High: 222
Newly exploited: 0
Advisories: 85
Malicious pkgs: 5

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2022-44456 CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is…
Contec · CONPROSYS HMI System(CHS)

EPSS 70%
Critical 9.9
CVE-2022-29517 A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP r…
Lansweeper · lansweeper

EPSS 58%
Critical 9.8
CVE-2022-47939 An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT.
EPSS 49%
Critical 9.8
CVE-2022-46020 WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
EPSS 39%
Critical 9.1
CVE-2022-27498 A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially…
Lansweeper · lansweeper

EPSS 38%
Critical 9.8
CVE-2022-47945 ThinkPHP Framework vulnerable to remote code execution
EPSS 30%
Critical 9.8
CVE-2022-47949 The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code v…
EPSS 23%
Critical 9.8
CVE-2022-45711 IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckTools function.
EPSS 20%
Critical 9.6
CVE-2022-41654 ghost vulnerable to unauthorized newsletter modification via improper access controls
Ghost Foundation · Ghost

EPSS 19%
Critical 9.8
CVE-2022-40624 pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than …
EPSS 18%
Critical 9.8
CVE-2022-3184 Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an o…
Dataprobe · iBoot-PDU FW

EPSS 12%
Critical 9.8
CVE-2022-4063 InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE
EPSS 10%
Critical 9.8
CVE-2022-4050 JoomSport < 5.2.8 - Unauthenticated SQLi
EPSS 5.1%
Critical 9.8
CVE-2022-45709 IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLevel, and pModule parameters in the formS…
EPSS 4.3%
Critical 9.8
CVE-2022-45717 IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount f…
EPSS 4.3%

All 90 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

SUSE-SU-2022:4579-1 Security update for MozillaThunderbird 7 CVEs
SUSE-SU-2022:4606-1 Security update for helm 5 CVEs
DLA-3248-1 libksba - security update 1 CVEs
DSA-5305-1 libksba - security update 1 CVEs
WID-SEC-2022-2379 Netgate pfSense (pfBlocker-NG): Schwachstelle ermöglicht Ausführen von beliebigen Kommandos mit Administratorrechten 1 CVEs
SUSE-RU-2022:4567-1 Recommended update for python-crcmod, python-cryptography, python-cryptography-vectors 1 CVEs