January 2022
2,210 CVEs published, −12% on December 2021 and +12% on January 2021. CISA added 40 to KEV.
2022 month by month
- Critical
- 21011% of the 2,000 with a CVSS score
- Added to CISA KEV
- 4011 of this month's CVEs are in KEV, listed a median 104 days after publication
- Vendors
- 7303,331 products
- Top weakness
- XSSCWE-79 · 234 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, MySQL Cluster, MySQL Server186152new
- 2Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт 8 Сп Сервер12381new
- 3DebianDebian Linux111182new
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim106164new
- 5NetappOncommand Workflow Automation, Oncommand Insight, Active Iq Unified Manager10521new
- 6MicrosoftWindows Server 2019, Windows 10, Windows Server 2019 (Server Core Installation)10372new
- 7PackagistRemdex/livehelperchat, Pimcore/pimcore, Moodle/moodle885nonenew
- 8ReolinkRlc-410w Firmware, Reolink Rlc-410w7931new
- 9BentleyMicrostation, Bentley View, View780nonenew
- 10FedoraprojectFedora, Extra Packages For Enterprise Linux7741new
- 11MavenNet.mingsoft:ms-mcms, Org.apache.kylin:kylin, Org.jenkins-ci.plugins:publish-over-ssh7515nonenew
- 12HuaweiHarmonyos, Emui, Magic Ui7310nonenew
- 13UnknownBooster For Woocommerce, All In One Seo – Best WordPress Seo Plugin – Easily Improve Seo Rankings & Increase Traffic, Eventcalendar732nonenew
- 14Red HatRed Hat Enterprise Linux, Red Hat Software Collections, Enterprise Linux7291new
- 15Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition71123new
- 16GoogleAndroid, Google Chrome, Android Studio6341new
- 17Ао "нппкт"Осон Основа Оnyx59132new
- 18Ооо «ред Софт»Ред Ос5381new
- 19Ао «нтц Ит Роса»Rosa Virtualization, Роса Кобальт, Роса Хром5281new
- 20AdobeAcrobat, Acrobat Dc, Acrobat Reader481nonenew
- 21Netapp Inc.Oncommand Workflow Automation, Oncommand Insight, Active Iq Unified Manager For VMware Vsphere481nonenew
- 22GpacGpac460nonenew
- 23Ао «концерн Вниинс»Ос Он «стрелец»4562new
- 24CesantaMjs440nonenew
- 25npmNode-forge, Marked, Shelljs415nonenew
Severity
How this month's CVEs score on CVSS; 210 have no score yet. Severity is not exploitation.
- Critical210
- High821
- Medium886
- Low83
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS234
- CWE-787Out-of-bounds Write143
- CWE-20Improper Input Validation108
- CWE-89SQL Injection92
- CWE-416Use After Free69
- CWE-476NULL Pointer Dereference67
- CWE-125Out-of-bounds Read65
- CWE-352CSRF44
- CWE-22Path Traversal43
- CWE-200Information Exposure38
- CWE-61738
- CWE-862Missing Authorization35
- CWE-400Resource Consumption33
- CWE-287Improper Authentication29
- CWE-78OS Command Injection29
- CWE-434Unrestricted File Upload28
- CWE-120Buffer Overflow25
- CWE-284Improper Access Control24
- CWE-190Integer Overflow23
- CWE-122Heap Buffer Overflow22
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries54519% of sector-tagged CVEs
- Operating Systems46316% of sector-tagged CVEs
- Enterprise Software40214% of sector-tagged CVEs
- Web & CMS Plugins2709% of sector-tagged CVEs
- Databases2147% of sector-tagged CVEs
- Mobile Apps1686% of sector-tagged CVEs
- Hardware Firmware1666% of sector-tagged CVEs
- ICS / OT / IoT1646% of sector-tagged CVEs
- 7 smaller sectors434
- Not yet classified98
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 89SQL Injection | 416Use After Free | 476NULL Pointer Dereference | 125Out-of-bounds Read | 352CSRF | 22Path Traversal | 200Information Exposure |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | 1 | 1 | 2 | 1 | 2 | 1 | 1 | |
| Oracle Corp. | 1 | 1 | 1 | |||||||
| Oracle Corporation | 1 | 1 | ||||||||
| Ао «ивк» | 2 | 8 | 1 | 1 | 1 | 1 | 5 | 1 | ||
| Debian | 3 | 13 | 2 | 2 | 5 | 5 | 11 | 2 | 2 | |
| Сообщество Свободного Программного Обеспечения | 3 | 15 | 1 | 2 | 8 | 5 | 13 | 1 | 1 | |
| Netapp | 1 | 2 | 2 | 1 | 1 | |||||
| Microsoft | 1 | 2 | 2 | |||||||
| Packagist | 29 | 1 | 4 | 1 | 5 | 1 | 1 | |||
| Microsoft Corp | 1 | 2 | 1 | 2 | ||||||
| Reolink | 2 | 61 | ||||||||
| Bentley | 34 | 19 | 23 |
CVEs published in January 2022
17 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2021-35587Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exp...KEV9.8
- CVE-2022-23227NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentica...KEV9.8
- CVE-2022-23131Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAMLKEV9.1
- CVE-2021-4034A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users acc...KEV7.8
- CVE-2021-40407An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that...KEV7.2
- CVE-2022-21882Win32k Elevation of Privilege VulnerabilityKEV7.0
- CVE-2022-21919Windows User Profile Service Elevation of Privilege VulnerabilityKEV7.0
- CVE-2021-22600Double Free in net/packet/af_packet.c leading to priviledge escalationKEV6.6
- CVE-2022-22265An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.KEV5.0
- CVE-2021-35247Improper Input Validation Vulnerability in Serv-UKEV4.3
- CVE-2022-23134Possible view of the setup pages by unauthenticated users if config file already existsKEV3.7
- CVE-2021-44168A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the...KEV3.3
- CVE-2021-4133A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API ev...8.8
- CVE-2021-46486Jsish v3.5.0 was discovered to contain a SEGV vulnerability via jsi_ArraySpliceCmd at src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).5.5
- CVE-2021-46505Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.5.5
- CVE-2021-46544Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x59e19. This vulnerability can lead to a Denial of Service (DoS).5.5
- CVE-2022-21894Secure Boot Security Feature Bypass Vulnerability4.4