Week 49, 2022
5 December to 11 December 2022. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 428CVEs publishedin the whole week
- 49CriticalCVSS 9.0 and above
- 144HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-4262
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2022-30123
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger…
https://github.com/rack/rack
Critical10.0 - CVE-2022-46161
Code injection in pdfmake
bpampuch · pdfmake
Critical10.0 - CVE-2022-46742
Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.
PaddlePaddle · PaddlePaddle
Critical10.0 - CVE-2022-4390
A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by…
NETGEAR Nighthawk RAX30
Critical10.0 - CVE-2022-45822
WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL Injection
Advanced Booking Calendar · Advanced Booking Calendar
Critical10.0 - CVE-2022-46169
Unauthenticated Command Injection
Cacti · cacti
ExploitedCritical9.8 - CVE-2022-45025
Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.
Product not named
Critical9.8 - CVE-2022-45359
WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload
YITH · YITH WooCommerce Gift Cards
Critical9.8 - CVE-2020-6627
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in…
Product not named
Critical9.8 - CVE-2022-32221
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the…
https://github.com/curl/curl
Critical9.8