Week 50, 2022
12 December to 18 December 2022. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 753CVEs publishedin the whole week
- 63CriticalCVSS 9.0 and above
- 296HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-42856
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS…
Apple · tvOS
ExploitedHigh8.8 - CVE-2022-27518
Unauthenticated remote arbitrary code execution
Citrix · Citrix Gateway, Citrix ADC
ExploitedCritical9.8 - CVE-2022-26501
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
Product not named
ExploitedCritical9.8 - CVE-2022-42475
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11,…
Fortinet · FortiProxy
ExploitedCritical9.3 - CVE-2022-26500
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions…
Product not named
ExploitedHigh8.8 - CVE-2022-44698
Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedMedium5.4
Most severe new CVEsBy CVSS score
- CVE-2022-44588
WordPress Cryptocurrency Widgets Pack Plugin <=1.8.1 is vulnerable to SQL Injection
Blocksera · Cryptocurrency Widgets Pack
Critical9.9 - CVE-2022-41272
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process…
SAP · NetWeaver Process Integration
Critical9.9 - CVE-2022-41267
SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server…
SAP · BusinessObjects Business Intelligence Platform
Critical9.9 - CVE-2022-27518
Unauthenticated remote arbitrary code execution
Citrix · Citrix Gateway, Citrix ADC
ExploitedCritical9.8 - CVE-2022-3921
Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload
Unknown · Listingo
Critical9.8 - CVE-2022-3900
Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
Unknown · Cooked Pro
Critical9.8 - CVE-2022-38488
logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.
Product not named
Critical9.8 - CVE-2022-20473
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote code execution with…
Android
Critical9.8 - CVE-2022-20472
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote code execution with…
Android
Critical9.8 - CVE-2022-45005
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function.
Product not named
Critical9.8