March 2022
2,136 CVEs published, +4% on February 2022. CISA added 226 to KEV.
2022 month by month
- Critical
- 39119% of the 2,083 with a CVSS score
- Added to CISA KEV
- 22613 of this month's CVEs are in KEV, listed a median 74 days after publication
- Vendors
- 9864,629 products
- Top weakness
- XSSCWE-79 · 310 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Wpe Webkit160113new
- 2GoogleAndroid, Data Transfer Project, Firebase Php-jwt13762new
- 3UnknownAmelia – Events & Appointments Booking Calendar, Custom Content Shortcode, WordPress File Upload12819nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition12373new
- 5Ао "нппкт"Осон Основа Оnyx114123new
- 6FedoraprojectFedora, Extra Packages For Enterprise Linux111112new
- 7PackagistShowdoc/showdoc, Microweber/microweber, Moodle/moodle11013nonenew
- 8DebianDebian Linux99111new
- 9MavenCom.liferay.portal:release.dxp.bom, Org.jenkins-ci.plugins:proxmox, Com.surenpi.jenkins:phoenix-autotest88131new
- 10ApplemacOS, iPadOS, iPhone OS8282new
- 11Red HatRed Hat Enterprise Linux, Enterprise Linux, Enterprise Linux For Power Little Endian7832new
- 12MicrosoftWindows 10, Windows 10 21h2, Windows 10 21h1720nonenew
- 13Ооо «ред Софт»Ред Ос6492new
- 14TendaAC6 Firmware, AX1806 Firmware, AC9 Firmware6144nonenew
- 15AdobeAdobe Audition, Adobe Bridge, Bridge541nonenew
- 16PyPISalt, Freetakserver-ui, Ansible547nonenew
- 17JenkinsJenkins Pipeline: Phoenix Autotest Plugin, Jenkins Kubernetes Continuous Deploy Plugin, Jenkins Extended Choice Parameter Plugin520nonenew
- 18Ао «ивк»Альт 8 Сп, Альт Сп 105161new
- 19NetappH700S Firmware, H300S Firmware, H410S Firmware5012new
- 20npmNode-forge, Node-ipc, Vditor488nonenew
- 21CanonicalUbuntu, Ubuntu Linux4552new
- 22LinuxLinux Kernel, Kernel4312new
- 23GoGogs.io/gogs, Code.gitea.io/gitea, Github.com/argoproj/argo-cd365nonenew
- 24IBMVios, Aix, Spectrum Copy Data Management301nonenew
- 25TotolinkA3100R Firmware, A800R Firmware, A3000RU Firmware2820nonenew
Severity
How this month's CVEs score on CVSS; 53 have no score yet. Severity is not exploitation.
- Critical391
- High760
- Medium863
- Low69
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS310
- CWE-787Out-of-bounds Write161
- CWE-89SQL Injection134
- CWE-22Path Traversal61
- CWE-434Unrestricted File Upload59
- CWE-862Missing Authorization57
- CWE-125Out-of-bounds Read55
- CWE-78OS Command Injection53
- CWE-200Information Exposure50
- CWE-20Improper Input Validation49
- CWE-120Buffer Overflow44
- CWE-119Memory Buffer Bounds43
- CWE-352CSRF42
- CWE-287Improper Authentication38
- CWE-416Use After Free34
- CWE-476NULL Pointer Dereference33
- CWE-863Incorrect Authorization33
- CWE-276Incorrect Default Permissions32
- CWE-77Command Injection31
- CWE-362Race Condition26
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries48216% of sector-tagged CVEs
- Web & CMS Plugins39513% of sector-tagged CVEs
- Operating Systems38513% of sector-tagged CVEs
- Enterprise Software33711% of sector-tagged CVEs
- Mobile Apps2468% of sector-tagged CVEs
- Networking Infrastructure2127% of sector-tagged CVEs
- ICS / OT / IoT1274% of sector-tagged CVEs
- Consumer Software1134% of sector-tagged CVEs
- 7 smaller sectors510
- Not yet classified161
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 22Path Traversal | 434Unrestricted File Upload | 862Missing Authorization | 125Out-of-bounds Read | 78OS Command Injection | 200Information Exposure | 20Improper Input Validation |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 19 | 2 | 2 | 5 | 6 | 4 | |||
| 20 | 15 | 9 | 7 | |||||||
| Ооо «русбитех-астра» | 4 | 15 | 2 | 5 | 6 | 3 | ||||
| Ао «нппкт» | 3 | 16 | 1 | 1 | 3 | 4 | 3 | |||
| Fedoraproject | 9 | 17 | 2 | 2 | 14 | 6 | ||||
| Packagist | 46 | 9 | 3 | 13 | 2 | 2 | 6 | 2 | ||
| Debian | 5 | 11 | 1 | 7 | 6 | 3 | ||||
| Maven | 23 | 1 | 2 | 7 | 12 | 2 | ||||
| Apple | 18 | 13 | 1 | |||||||
| Microsoft | 5 | |||||||||
| Microsoft Corp | 5 | |||||||||
| Ооо «ред Софт» | 2 | 10 | 2 | 4 | 2 | 1 | 6 |
CVEs published in March 2022
22 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-22947In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote a...KEV10.0
- CVE-2022-1040An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.KEV9.8
- CVE-2022-22587A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be ab...KEV9.8
- CVE-2022-26143The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of servi...KEV9.8
- CVE-2022-26258D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.KEV9.8
- CVE-2022-26318On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2...KEV9.8
- CVE-2022-26501Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).KEV9.8
- CVE-2022-26871An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.KEV9.8
- CVE-2022-22620A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). P...KEV8.8
- CVE-2022-26500Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and ex...KEV8.8
- CVE-2021-39793In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional exe...KEV7.8
- CVE-2022-0492A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 rele...KEV7.8
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thu...KEV7.8
- CVE-2022-0995An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local ...KEV7.8
- CVE-2022-22706Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 th...KEV7.8
- CVE-2022-22948The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issu...KEV6.5
- CVE-2021-26599ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.9.8
- CVE-2022-26188TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.9.8
- CVE-2022-26965In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.7.2
- CVE-2022-0894Cross-site Scripting (XSS) - Stored in pimcore/pimcore5.4
- CVE-2022-0388Interactive Medical Drawing of Human Body < 2.6 - Admin+ Stored XSS4.8
- CVE-2018-25031Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote ...4.3