February 2022
2,053 CVEs published, −7% on January 2022 and +32% on February 2021. CISA added 32 to KEV.
2022 month by month
- Critical
- 32016% of the 1,954 with a CVSS score
- Added to CISA KEV
- 3216 of this month's CVEs are in KEV, listed a median 45 days after publication
- Vendors
- 8005,604 products
- Top weakness
- XSSCWE-79 · 243 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Tensorflow, Google Chrome17261new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim159154new
- 3FedoraprojectFedora, Extra Packages For Enterprise Linux1338nonenew
- 4Ао "нппкт"Осон Основа Оnyx128133new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition12352new
- 6UnknownSupportcandy – Helpdesk & Support Ticket System, Link Library, IP2LOCATION Country Blocker1204nonenew
- 7MicrosoftMicrosoft Edge, Windows 11 Version 21h2, Windows 119824new
- 8BentleyView, Microstation, Microstation Connect950nonenew
- 9DebianDebian Linux, Duck, Debian-edu-config95152new
- 10MavenOrg.jenkins-ci.plugins.workflow:workflow-cps-global-lib, Org.xwiki.platform:xwiki-platform-oldcore, Info.magnolia:magnolia-core8912nonenew
- 11PackagistMicroweber/microweber, Drupal/core, Librenms/librenms8681new
- 12Ао «концерн Вниинс»Ос Он «стрелец»7762new
- 13PyPITensorflow, Tensorflow-cpu, Tensorflow-gpu750nonenew
- 14IntelKiller Wi-fi 6e AX1675 Firmware, Proset Wi-fi 6 AX200 Firmware, Proset Wi-fi 6 AX201 Firmware730nonenew
- 15Red HatEnterprise Linux, Red Hat Enterprise Linux, Enterprise Linux For IBM Z Systems5361new
- 16Ооо «ред Софт»Ред Ос53112new
- 17NetappCloud Backup, Fas\/aff Bios, H410S Firmware4811new
- 18GoGithub.com/go-gitea/gitea, Github.com/hashicorp/nomad, Github.com/google/fscrypt475nonenew
- 19Ао «ивк»Альт 8 Сп, Альт Сп 104431new
- 20Schneider-electricInteractive Graphical Scada System Data Server, Interactive Graphical Scada System Data Collector, Wiser For Knx Firmware4311nonenew
- 21JenkinsPipeline\, Jenkins Pipeline: Shared Groovy Libraries Plugin, Jenkins Chef Sinatra Plugin420nonenew
- 22Fedora ProjectFedora, 389 Directory Server394nonenew
- 23SiemensSimcenter Femap, Simcenter Femap V2021.1, Simcenter Femap V2020.2373nonenew
- 24TensorflowTensorflow360nonenew
- 25TendaAX3 Firmware, AC11 Firmware, AC9 Firmware3312nonenew
Severity
How this month's CVEs score on CVSS; 99 have no score yet. Severity is not exploitation.
- Critical320
- High805
- Medium801
- Low28
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS243
- CWE-787Out-of-bounds Write197
- CWE-125Out-of-bounds Read99
- CWE-416Use After Free87
- CWE-89SQL Injection74
- CWE-20Improper Input Validation65
- CWE-352CSRF65
- CWE-22Path Traversal52
- CWE-77Command Injection48
- CWE-78OS Command Injection44
- CWE-862Missing Authorization43
- CWE-12138
- CWE-190Integer Overflow38
- CWE-200Information Exposure36
- CWE-476NULL Pointer Dereference35
- CWE-119Memory Buffer Bounds29
- CWE-120Buffer Overflow29
- CWE-863Incorrect Authorization28
- CWE-284Improper Access Control25
- CWE-287Improper Authentication24
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries45716% of sector-tagged CVEs
- Operating Systems40214% of sector-tagged CVEs
- Enterprise Software35713% of sector-tagged CVEs
- Web & CMS Plugins33812% of sector-tagged CVEs
- Mobile Apps2318% of sector-tagged CVEs
- Networking Infrastructure1987% of sector-tagged CVEs
- Hardware Firmware1656% of sector-tagged CVEs
- DevTools & CI1325% of sector-tagged CVEs
- ICS / OT / IoT1114% of sector-tagged CVEs
- 6 smaller sectors337
- Not yet classified85
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 416Use After Free | 89SQL Injection | 20Improper Input Validation | 352CSRF | 22Path Traversal | 77Command Injection | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| 26 | 17 | 28 | 11 | 1 | ||||||
| Сообщество Свободного Программного Обеспечения | 4 | 21 | 8 | 29 | 2 | 2 | 1 | |||
| Fedoraproject | 3 | 20 | 5 | 18 | 1 | 4 | 1 | 1 | 1 | |
| Ао «нппкт» | 1 | 17 | 7 | 30 | 1 | 2 | 1 | |||
| Ооо «русбитех-астра» | 1 | 15 | 6 | 26 | 1 | 1 | ||||
| Microsoft Corp | 8 | 2 | 21 | 1 | ||||||
| Bentley | 23 | 39 | 18 | |||||||
| Debian | 1 | 14 | 4 | 9 | 1 | 1 | ||||
| Maven | 8 | 1 | 1 | 3 | 10 | 5 | 3 | |||
| Packagist | 28 | 2 | 3 | 6 | 3 | 1 | ||||
| Ао «концерн Вниинс» | 12 | 2 | 25 | 1 | 1 | |||||
| PyPI | 4 | 6 | 7 | 1 | 1 | 1 |
CVEs published in February 2022
24 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-0543It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.KEV10.0
- CVE-2022-20699Cisco Small Business RV Series Routers VulnerabilitiesKEV10.0
- CVE-2022-20700Cisco Small Business RV Series Routers VulnerabilitiesKEV10.0
- CVE-2022-20701Cisco Small Business RV Series Routers VulnerabilitiesKEV10.0
- CVE-2022-20703Cisco Small Business RV Series Routers VulnerabilitiesKEV10.0
- CVE-2022-20708Cisco Small Business RV Series Routers VulnerabilitiesKEV10.0
- CVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concaten...KEV10.0
- CVE-2021-45382A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. N...KEV9.8
- CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code executionKEV9.8
- CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP headerKEV9.8
- CVE-2021-4102Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2022-23176WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerabili...KEV8.8
- CVE-2022-0185A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unpriv...KEV8.4
- CVE-2021-3560It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivil...KEV7.8
- CVE-2022-21971Windows Runtime Remote Code Execution VulnerabilityKEV7.8
- CVE-2022-21999Windows Print Spooler Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-22718Windows Print Spooler Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-24682An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HT...KEV6.1
- CVE-2022-25060TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.9.8
- CVE-2022-23320XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate in...7.5
- CVE-2021-42639PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulnerabilities. Attacker controlled input is reflected back in the page without sa...6.1
- CVE-2022-26146Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.5.4
- CVE-2021-24944Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site Scripting4.8
- CVE-2022-0763Cross-site Scripting (XSS) - Stored in microweber/microweber4.8