Week 52, 2022

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-45467 In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an ar…
  EPSS 71%
• Critical 9.8
  CVE-2021-45466 In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_ke…
  EPSS 55%
• Critical 9.8
  CVE-2022-4120 Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection
  EPSS 18%
• Critical 9.8
  CVE-2022-4047 Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload
  EPSS 6.6%
• Critical 9.8
  CVE-2022-4117 IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi
  EPSS 5.3%
• Critical 9.8
  CVE-2022-44621 Apache Kylin: Command injection by Diagnosis Controller

  Apache Software Foundation · Apache Kylin

  EPSS 3.1%
• Critical 9.8
  CVE-2022-46764 A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL com…

  TrueConf · TrueConf Server

  EPSS 2.3%
• Critical 9.8
  CVE-2022-46597 TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) fu…
  EPSS 2.3%
• Critical 9.8
  CVE-2022-46598 TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin…
  EPSS 2.3%
• Critical 9.8
  CVE-2019-11851 The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to …
  EPSS 1.8%
• Critical 9.1
  CVE-2020-36561 Path traversal in github.com/yi-ge/unzip

  github.com/yi-ge/unzip · github.com/yi-ge/unzip

  EPSS 1.4%
• Critical 9.1
  CVE-2021-4238 Insufficient randomness in github.com/Masterminds/goutils

  github.com/Masterminds/goutils · github.com/Masterminds/goutils

  EPSS 1.4%
• Critical 9.1
  CVE-2020-36560 Path traversal in github.com/artdarek/go-unzip

  github.com/artdarek/go-unzip · github.com/artdarek/go-unzip

  EPSS 1.3%
• Critical 9.1
  CVE-2018-25046 Path traversal in code.cloudfoundry.org/archiver

  code.cloudfoundry.org/archiver · code.cloudfoundry.org/archiver/extractor

  EPSS 1.3%
• Critical 9.8
  CVE-2021-4236 Panic or authentication bypass in github.com/ecnepsnai/web

  github.com/ecnepsnai/web · github.com/ecnepsnai/web

  EPSS 1.2%

All 70 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.7
  CVE-2023-0028 Cross-site Scripting (XSS) - Stored in linagora/twake

  LINAGORA · linagora/twake

  EPSS 56%
• High 8.8
  CVE-2022-43396 Apache Kylin: Command injection by Useless configuration

  Apache Software Foundation · Apache Kylin

  EPSS 55%
• High 8.8
  CVE-2022-48194 TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a cr…
  EPSS 33%
• High 7.3
  CVE-2022-4855 SourceCodester Lead Management System login.php sql injection

  SourceCodester · Lead Management System

  EPSS 25%
• High 8.8
  CVE-2022-34324 Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment…
  EPSS 12%
• High 8.2
  CVE-2022-41966 XStream Denial of Service via stack overflow

  x-stream · xstream

  EPSS 9.3%
• Medium 6.1
  CVE-2022-36664 Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter.
  EPSS 4%
• High 8.1
  CVE-2020-10650 jackson-databind vulnerable to unsafe deserialization
  EPSS 3.6%