Week 48, 2022
28 November to 4 December 2022. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 367CVEs publishedin the whole week
- 39CriticalCVSS 9.0 and above
- 140HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2021-35587
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0,…
Oracle Corporation · Access Manager
ExploitedCritical9.8 - CVE-2022-4135
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform…
Google · Chrome
ExploitedCritical9.6
Most severe new CVEsBy CVSS score
- CVE-2022-44366
Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo.
Product not named
Critical9.8 - CVE-2022-43325
An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.* allows attackers…
Product not named
Critical9.8 - CVE-2022-4221
OS command injection in ASUS M25 NAS
Asus · NAS-M25
Critical9.8 - CVE-2022-44291
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
Product not named
Critical9.8 - CVE-2022-44290
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
Product not named
Critical9.8 - CVE-2022-46366
Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input
Apache Software Foundation · Apache Tapestry
Critical9.8 - CVE-2022-44928
D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.
Product not named
Critical9.8 - CVE-2022-44930
D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.
Product not named
Critical9.8 - CVE-2022-46414
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur…
Product not named
Critical9.8 - CVE-2022-43333
Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php.
Product not named
Critical9.8