Week 1, 2023
2–8 January 2023
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2022-44877 login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metac…EPSS 100%
-
Critical 9.3
CVE-2022-42475 A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6…EPSS 99%
-
Critical 9.8
CVE-2022-47523 Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.EPSS 71%
-
Critical 9.8
CVE-2023-22463 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT tokenEPSS 70%
-
Critical 9.1
CVE-2023-22457 org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request ForgeryEPSS 19%
-
Critical 10.0
CVE-2022-43931 Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execu…EPSS 17%
- Critical 9.8 EPSS 5.1%
- Critical 9.8 EPSS 5.1%
-
Critical 9.8
CVE-2022-38627 Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerabilit…EPSS 4.7%
- Critical 9.8 EPSS 3.8%
-
Critical 9.8
CVE-2022-39073 There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to ex…EPSS 3.4%
- Critical 9.8 EPSS 3.4%
-
Critical 9.8
CVE-2023-22671 Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling anal…EPSS 2.9%
-
Critical 9.8
CVE-2022-45875 Apache DolphinScheduler: Remote command execution Vulnerability in script alert pluginEPSS 2.8%
- Critical 9.8 EPSS 2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2022-44149 The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host fiel…EPSS 64%
- High 7.2 EPSS 30%
-
High 8.8
CVE-2022-42979 Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a…EPSS 25%
-
High 7.5
CVE-2022-3842 Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to potentially exploit …EPSS 18%
- High 7.2 EPSS 18%
- High 7.2 EPSS 18%
-
High 8.8
CVE-2021-30558 Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v…EPSS 11%
-
Unscored
CVE-2022-48197 Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript l…EPSS 7.1%
Advisories
- SUSE / openSUSE Security Updates 274 critical
- BSI CERT-Bund (WID) 22
- Ubuntu Security Notices (USN) 111 critical
- Oracle Linux Security Advisories (ELSA) 4
- AlmaLinux Security Advisories 3
- Debian Security (DSA / DLA) 3
- Rocky Linux Security Advisories 3
- CISA ICS & IT advisories 3
- openSUSE-SU-2023:0005-1 Security update for python-Django 13 CVEs
- SUSE-SU-2023:0033-1 Security update for xrdp 9 CVEs
- SUSE-SU-2023:0012-1 Security update for xrdp 7 CVEs
- USN-5787-1 libksba vulnerability 1 CVEs
- SUSE-SU-2023:0031-1 Security update for libksba 1 CVEs