Week 52, 2022
26 December to 1 January 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 377CVEs publishedin the whole week
- 70CriticalCVSS 9.0 and above
- 100HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability
TIBCO Software Inc. · TIBCO JasperReports Library
ExploitedCritical9.9 - CVE-2018-5430
TIBCO JasperReports Server Information Disclosure Vulnerability
TIBCO Software Inc. · TIBCO JasperReports Server
ExploitedHigh7.7
Most severe new CVEsBy CVSS score
- CVE-2021-45467
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an…
Product not named
Critical9.8 - CVE-2021-45466
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an…
Product not named
Critical9.8 - CVE-2022-4120
Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection
Unknown · Stop Spammers Security | Block Spam Users, Comments, Forms
Critical9.8 - CVE-2022-4047
Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload
Unknown · Return Refund and Exchange For WooCommerce
Critical9.8 - CVE-2022-4117
IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi
Unknown · IWS
Critical9.8 - CVE-2022-44621
Apache Kylin: Command injection by Diagnosis Controller
Apache Software Foundation · Apache Kylin
Critical9.8 - CVE-2022-46764
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL…
TrueConf · TrueConf Server
Critical9.8 - CVE-2022-46598
TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action…
Product not named
Critical9.8 - CVE-2022-46597
TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8)…
Product not named
Critical9.8 - CVE-2019-11851
The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to…
Product not named
Critical9.8