April 2022
2,106 CVEs published, −1% on March 2022 and +7% on April 2021. CISA added 45 to KEV.
2022 month by month
- Critical
- 30115% of the 2,069 with a CVSS score
- Added to CISA KEV
- 4514 of this month's CVEs are in KEV, listed a median 109.5 days after publication
- Vendors
- 9303,900 products
- Top weakness
- XSSCWE-79 · 270 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Cgal, Linux182221new
- 2MicrosoftWindows Server 2022, Windows Server 2016, Windows Server Version 20h218162new
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition13861new
- 4GoogleAndroid, Google Chrome, Chrome13641new
- 5Ао "нппкт"Осон Основа Оnyx111102new
- 6DebianDebian Linux1086nonenew
- 7UnknownMycred, Visual Form Builder, Salon Booking System Pro9912nonenew
- 8OracleMySQL Server, MySQL, Weblogic Server9853new
- 9Ао «ивк»Альт 8 Сп, Альт Сп 10782nonenew
- 10Ооо «ред Софт»Ред Ос7214nonenew
- 11NetappOncommand Insight, Active Iq Unified Manager, Snapcenter610nonenew
- 12CiscoCisco IOS XE, IOS XE, Cisco IOS5941new
- 13FedoraprojectFedora, Extra Packages For Enterprise Linux583nonenew
- 14MavenCom.liferay.portal:release.dxp.bom, Net.sourceforge.htmlunit:neko-htmlunit, Org.owasp.antisamy:antisamy5873new
- 15Ао «концерн Вниинс»Ос Он «стрелец»5731new
- 16Samsung MobileSamsung Mobile Devices, Galaxy Store, Samsung Flow550nonenew
- 17PackagistPimcore/pimcore, Remdex/livehelperchat, Shopware/shopware534nonenew
- 18Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Software Collections492nonenew
- 19IBMQradar Security Information and Event Manager, Qradar Siem, Cognos Analytics483nonenew
- 20CgalComputational Geometry Algorithms Library380nonenew
- 21Cgal ProjectLibcgal380nonenew
- 22Ао «нтц Ит Роса»Роса Хром, Роса Кобальт, Rosa Virtualization381nonenew
- 23DellEmc Powerscale Onefs, Powerscale Onefs, VNX2331nonenew
- 24npmFullpage.js, Ghost, Urijs299nonenew
- 25FisglobalGt.m283nonenew
Severity
How this month's CVEs score on CVSS; 37 have no score yet. Severity is not exploitation.
- Critical301
- High919
- Medium796
- Low53
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS270
- CWE-89SQL Injection149
- CWE-787Out-of-bounds Write121
- CWE-125Out-of-bounds Read88
- CWE-22Path Traversal78
- CWE-20Improper Input Validation71
- CWE-416Use After Free60
- CWE-434Unrestricted File Upload58
- CWE-352CSRF56
- CWE-12941
- CWE-200Information Exposure40
- CWE-78OS Command Injection36
- CWE-287Improper Authentication35
- CWE-476NULL Pointer Dereference35
- CWE-284Improper Access Control32
- CWE-863Incorrect Authorization31
- CWE-122Heap Buffer Overflow30
- CWE-269Improper Privilege Mgmt28
- CWE-362Race Condition28
- CWE-862Missing Authorization23
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems57019% of sector-tagged CVEs
- Enterprise Software35612% of sector-tagged CVEs
- OSS Libraries35212% of sector-tagged CVEs
- Web & CMS Plugins31311% of sector-tagged CVEs
- Networking Infrastructure1786% of sector-tagged CVEs
- Mobile Apps1746% of sector-tagged CVEs
- Databases1615% of sector-tagged CVEs
- ICS / OT / IoT1565% of sector-tagged CVEs
- DevTools & CI1224% of sector-tagged CVEs
- Hardware Firmware1134% of sector-tagged CVEs
- Not yet classified192
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 125Out-of-bounds Read | 22Path Traversal | 20Improper Input Validation | 416Use After Free | 434Unrestricted File Upload | 352CSRF | 129 |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 9 | 17 | 46 | 1 | 2 | 30 | 38 | |||
| Microsoft Corp | 9 | 2 | 2 | 1 | 23 | |||||
| Ооо «русбитех-астра» | 7 | 17 | 43 | 1 | 29 | 38 | ||||
| Microsoft | 1 | |||||||||
| 23 | 13 | 1 | 9 | 32 | ||||||
| Ао «нппкт» | 8 | 16 | 7 | 1 | 34 | |||||
| Debian | 1 | 9 | 4 | 41 | 2 | 1 | 10 | 38 | ||
| Oracle | 2 | 1 | ||||||||
| Oracle Corporation | ||||||||||
| Ао «ивк» | 7 | 8 | 3 | 9 | ||||||
| Oracle Corp. | 1 | |||||||||
| Ооо «ред Софт» | 2 | 8 | 7 | 3 | 1 | 10 |
CVEs published in April 2022
29 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-24816Improper Control of Generation of Code in jai-extKEV10.0
- CVE-2022-21445Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0....KEV9.8
- CVE-2022-22954VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side...KEV9.8
- CVE-2022-22963In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression...KEV9.8
- CVE-2022-22965A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a W...KEV9.8
- CVE-2022-24706Remote Code Execution Vulnerability in PackagingKEV9.8
- CVE-2022-29464Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to re...KEV9.8
- CVE-2022-29499The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.KEV9.8
- CVE-2022-0609Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2022-22960VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local acces...KEV7.8
- CVE-2022-24521Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-27924Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing a...KEV7.5
- CVE-2022-27925Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to...KEV7.2
- CVE-2022-26904Windows User Profile Service Elevation of Privilege VulnerabilityKEV7.0
- CVE-2022-28810Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to ...KEV6.8
- CVE-2022-27926A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web scr...KEV6.1
- CVE-2021-46422Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.9.8
- CVE-2022-0142Visual Form Builder < 3.0.6 - CSV Injection9.8
- CVE-2022-22956VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism an...9.8
- CVE-2022-27984CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.9.8
- CVE-2022-28001Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter.9.8
- CVE-2022-28368Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).9.8
- CVE-2022-28381Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.9.8
- CVE-2021-3100Log4j hot patch package privilege escalation8.8
- CVE-2022-24785Path Traversal in Moment.js7.5
- CVE-2022-27649A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectl...7.5
- CVE-2022-22323IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password...6.5
- CVE-2022-28290Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the speci...6.1
- CVE-2021-42782Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.5.3