August 2022
2,435 CVEs published, +11% on July 2022 and +5% on August 2021. CISA added 23 to KEV.
2022 month by month
- Critical
- 39117% of the 2,323 with a CVSS score
- Added to CISA KEV
- 236 of this month's CVEs are in KEV, listed a median 24 days after publication
- Vendors
- 9314,254 products
- Top weakness
- Out-of-bounds WriteCWE-787 · 282 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Google Chrome, Chrome22114nonenew
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim16951new
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition14041new
- 4Red HatRed Hat Enterprise Linux, Enterprise Linux, Single Sign-on1304nonenew
- 5MicrosoftWindows 10, Windows 10 21h2, Windows 10 20h212631new
- 6Ао "нппкт"Осон Основа Оnyx1163nonenew
- 7FedoraprojectFedora, Extra Packages For Enterprise Linux11321new
- 8UnknownTransposh WordPress Translation, Yaysmtp – Simple Wp Smtp Mail, Givewp – Donation Plugin and Fundraising Platform1036nonenew
- 9SourcecodesterGym Management System, Company Website CMS, Simple E-learning System870nonenew
- 10DebianDebian Linux, Schroot6931new
- 11H3CMagic NX18 Plus Firmware, Gr-1200w Firmware, H200 Firmware6733nonenew
- 12MavenOrg.dspace:dspace-jspui, Org.apache.jspwiki:jspwiki-main, Org.keycloak:keycloak-core6491new
- 13Ао «ивк»Альт 8 Сп, Альт Сп 10641nonenew
- 14Ооо «ред Софт»Ред Ос603nonenew
- 15IntelWi-fi 6 AX201 Firmware, Wi-fi 6 AX200 Firmware, Wireless-ac 9462 Firmware594nonenew
- 16npm@openzeppelin/contracts, @openzeppelin/contracts-upgradeable, Raneto5314nonenew
- 17TendaAC1206 Firmware, M3 Firmware, AX1803 Firmware5224nonenew
- 18LinuxLinux Kernel450nonenew
- 19Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications452nonenew
- 20PackagistMagento/community-edition, Forkcms/forkcms, Getkirby/cms454nonenew
- 21TclLinkhub Mesh Wifi, Linkhub Mesh Wifi AC12004236nonenew
- 22TotolinkA7000R Firmware, N350RT Firmware, A3700R Firmware423nonenew
- 23Otfcc ProjectOtfcc380nonenew
- 24Samsung MobileSamsung Mobile Devices, Charm By Samsung, Galaxy Wearable330nonenew
- 25CanonicalUbuntu, Ubuntu Linux290nonenew
Severity
How this month's CVEs score on CVSS; 112 have no score yet. Severity is not exploitation.
- Critical391
- High868
- Medium969
- Low95
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-787Out-of-bounds Write282
- CWE-79XSS241
- CWE-89SQL Injection181
- CWE-125Out-of-bounds Read66
- CWE-862Missing Authorization65
- CWE-416Use After Free62
- CWE-20Improper Input Validation59
- CWE-78OS Command Injection59
- CWE-120Buffer Overflow58
- CWE-22Path Traversal58
- CWE-352CSRF53
- CWE-200Information Exposure44
- CWE-269Improper Privilege Mgmt41
- CWE-476NULL Pointer Dereference35
- CWE-284Improper Access Control34
- CWE-287Improper Authentication33
- CWE-400Resource Consumption31
- CWE-770Allocation Without Limits31
- CWE-434Unrestricted File Upload30
- CWE-119Memory Buffer Bounds27
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems49316% of sector-tagged CVEs
- Web & CMS Plugins40613% of sector-tagged CVEs
- OSS Libraries40213% of sector-tagged CVEs
- Enterprise Software36412% of sector-tagged CVEs
- Networking Infrastructure32410% of sector-tagged CVEs
- Mobile Apps2639% of sector-tagged CVEs
- ICS / OT / IoT1445% of sector-tagged CVEs
- Hardware Firmware1435% of sector-tagged CVEs
- 7 smaller sectors394
- Not yet classified159
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 787Out-of-bounds Write | 79XSS | 89SQL Injection | 125Out-of-bounds Read | 862Missing Authorization | 416Use After Free | 20Improper Input Validation | 78OS Command Injection | 120Buffer Overflow | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| 20 | 1 | 9 | 42 | 13 | 12 | 1 | ||||
| Сообщество Свободного Программного Обеспечения | 16 | 4 | 3 | 12 | 30 | 4 | 4 | 1 | ||
| Ооо «русбитех-астра» | 20 | 1 | 12 | 28 | 4 | 3 | 1 | |||
| Microsoft Corp | 2 | 1 | 7 | 2 | ||||||
| Ао «нппкт» | 13 | 2 | 7 | 27 | 4 | 3 | ||||
| Fedoraproject | 19 | 1 | 8 | 21 | 7 | 2 | ||||
| Microsoft | 1 | 1 | 2 | 1 | ||||||
| Red Hat | 4 | 2 | 2 | 7 | 7 | 2 | ||||
| Sourcecodester | 21 | 48 | ||||||||
| Debian | 14 | 1 | 1 | 4 | 6 | 8 | 3 | 1 | ||
| H3C | 64 | 3 | ||||||||
| Maven | 1 | 13 | 5 | 4 | 1 | 6 |
CVEs published in August 2022
16 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-37042Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an ...KEV9.8
- CVE-2022-37055D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,KEV9.8
- CVE-2022-32893An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted w...KEV8.8
- CVE-2022-36804Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version ...KEV8.8
- CVE-2022-0028PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL FilteringKEV8.6
- CVE-2022-32894An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An application may be able to execute arbitrary...KEV7.8
- CVE-2022-34713Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityKEV7.8
- CVE-2022-36537ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.KEV7.5
- CVE-2022-37056D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,9.8
- CVE-2022-38150In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted rea...7.5
- CVE-2022-31195Path traversal vulnerability in Simple Archive Format package import in DSpace7.2
- CVE-2021-3997A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.5.5
- CVE-2022-2600Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing5.4
- CVE-2022-37160Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms...5.4
- CVE-2022-1322Coming Soon - Under Construction <= 1.1.9 - Admin+ Stored Cross-Site Scripting4.8
- CVE-2022-2725SourceCodester Company Website CMS add-blog.php cross site scripting3.5