July 2022
2,201 CVEs published, −4% on June 2022 and +33% on July 2021. CISA added 3 to KEV.
2022 month by month
- Critical
- 28914% of the 2,003 with a CVSS score
- Added to CISA KEV
- 36 of this month's CVEs are in KEV, listed a median 33.5 days after publication
- Vendors
- 8763,203 products
- Top weakness
- XSSCWE-79 · 230 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleChrome, Google Chrome, Android199103new
- 2Ао "нппкт"Осон Основа Оnyx19183new
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim175102new
- 4MicrosoftMicrosoft Edge, Windows Server 2016, Windows Server Version 20h216332new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition13873new
- 6Ао «концерн Вниинс»Ос Он «стрелец»12763new
- 7OracleMySQL Server, Database, Security Service963nonenew
- 8FedoraprojectFedora, Extra Packages For Enterprise Linux9151new
- 9MavenIo.dataease:dataease-plugin-common, Org.jenkins-ci.plugins:openshift-deployer, Org.jenkins-ci.plugins:git7581new
- 10DebianDebian Linux684nonenew
- 11IBMEngineering Lifecycle Optimization - Publishing, Sterling Partner Engagement Manager On Cloud, Sterling Partner Engagement Manager653nonenew
- 12UnknownRequest A Quote, Awin Data Feed, Ninja Forms Contact Form – The Drag and Drop Form Builder For WordPress652nonenew
- 13Ао «ивк»Альт 8 Сп, Альт Сп 10622nonenew
- 14Ооо «ред Софт»Ред Ос, Ред База Данных622nonenew
- 15CiscoCisco Small Business RV Series Router Firmware, RV130 Firmware, RV130W Wireless-N Multifunction VPN Router555nonenew
- 16SiemensPads Viewer, Pads Standard/plus Viewer, Sinec Ins513nonenew
- 17NetappActive Iq Unified Manager, Oncommand Insight, Snapcenter493nonenew
- 18npmUndici, Llhttp, @openzeppelin/contracts499nonenew
- 19JenkinsJenkins Openshift Deployer Plugin, Openshift Deployer, Jenkins Coverity Plugin440nonenew
- 20Cd FoundationJenkins Deployer Framework Plugin, Jenkins Coverity Plugin, Jenkins Openshift Deployer Plugin420nonenew
- 21Samsung MobileSamsung Mobile Devices, Galaxy Store, Findmymobile380nonenew
- 22Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Container Platform363nonenew
- 23PackagistMicroweber/microweber, Moodle/moodle, Idno/known352nonenew
- 24Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization, Роса Кобальт350nonenew
- 25AdobeAcrobat, Acrobat Dc, Acrobat Reader340nonenew
Severity
How this month's CVEs score on CVSS; 198 have no score yet. Severity is not exploitation.
- Critical289
- High755
- Medium892
- Low67
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS230
- CWE-787Out-of-bounds Write138
- CWE-22Path Traversal127
- CWE-416Use After Free111
- CWE-89SQL Injection81
- CWE-125Out-of-bounds Read62
- CWE-78OS Command Injection53
- CWE-120Buffer Overflow50
- CWE-352CSRF46
- CWE-20Improper Input Validation40
- CWE-476NULL Pointer Dereference36
- CWE-434Unrestricted File Upload33
- CWE-862Missing Authorization32
- CWE-200Information Exposure31
- CWE-798Hard-coded Credentials28
- CWE-287Improper Authentication27
- CWE-863Incorrect Authorization23
- CWE-502Deserialization22
- CWE-306Missing Auth for Critical Function21
- CWE-66821
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems53219% of sector-tagged CVEs
- OSS Libraries37413% of sector-tagged CVEs
- Enterprise Software35012% of sector-tagged CVEs
- Mobile Apps2398% of sector-tagged CVEs
- Web & CMS Plugins2348% of sector-tagged CVEs
- Networking Infrastructure2067% of sector-tagged CVEs
- ICS / OT / IoT1325% of sector-tagged CVEs
- Databases1184% of sector-tagged CVEs
- 7 smaller sectors521
- Not yet classified136
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 22Path Traversal | 416Use After Free | 89SQL Injection | 125Out-of-bounds Read | 78OS Command Injection | 120Buffer Overflow | 352CSRF | 20Improper Input Validation |
|---|---|---|---|---|---|---|---|---|---|---|
| 2 | 25 | 3 | 68 | 6 | 7 | |||||
| Ао «нппкт» | 5 | 23 | 1 | 71 | 1 | 4 | 1 | 3 | ||
| Сообщество Свободного Программного Обеспечения | 6 | 22 | 61 | 1 | 6 | 2 | 4 | |||
| Microsoft Corp | 2 | 8 | 1 | 39 | 2 | 2 | ||||
| Ооо «русбитех-астра» | 3 | 20 | 43 | 1 | 5 | 1 | 1 | |||
| Ао «концерн Вниинс» | 2 | 13 | 1 | 65 | 2 | 2 | ||||
| Google Inc | 3 | 11 | 1 | 66 | 2 | 2 | ||||
| Oracle | 1 | 3 | ||||||||
| Fedoraproject | 4 | 9 | 1 | 13 | 5 | 1 | 2 | |||
| Oracle Corp. | 1 | |||||||||
| Oracle Corporation | 1 | |||||||||
| Microsoft | 2 | 1 |
CVEs published in July 2022
17 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-26138The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded...KEV9.8
- CVE-2022-26352An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows di...KEV9.8
- CVE-2022-35405Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 w...KEV9.8
- CVE-2022-1096Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2022-1364Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2022-2294Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UIKEV8.8
- CVE-2022-22047Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-25046A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.9.8
- CVE-2022-33318Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsub...9.8
- CVE-2022-31208An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmd_string URL parameter.8.8
- CVE-2022-35871This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this ...7.8
- CVE-2022-2193Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering ...7.5
- CVE-2022-24660The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in p...7.5
- CVE-2022-35650The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability al...7.5
- CVE-2022-31854Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.7.2
- CVE-2022-34903GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forger...6.5