September 2022
2,210 CVEs published, −9% on August 2022 and +14% on September 2021. CISA added 24 to KEV.
2022 month by month
- Critical
- 29914% of the 2,157 with a CVSS score
- Added to CISA KEV
- 248 of this month's CVEs are in KEV, listed a median 96.5 days after publication
- Vendors
- 1,0204,047 products
- Top weakness
- Out-of-bounds WriteCWE-787 · 268 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Tensorflow, Chrome186103new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim12891new
- 3Ао "нппкт"Осон Основа Оnyx11523new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition11533new
- 5PyPITensorflow, Tensorflow-cpu, Tensorflow-gpu1144nonenew
- 6MavenCom.fasterxml.woodstox:woodstox-core, Com.liferay.portal:release.dxp.bom, Org.yaml:snakeyaml10814nonenew
- 7FedoraprojectFedora, Extra Packages For Enterprise Linux9833new
- 8MicrosoftWindows Server 2022, Windows Server 2022 (Server Core Installation), Windows Server 2019 (Server Core Installation)9044new
- 9Ооо «ред Софт»Ред Ос8381new
- 10DebianDebian Linux, Logcheck803nonenew
- 11ApplemacOS, iPhone OS, iPadOS7251new
- 12AdobeIndesign, Adobe Indesign, Experience Manager660nonenew
- 13TensorflowTensorflow590nonenew
- 14Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Virtualization582nonenew
- 15UnknownClassified Listing Pro - Classified Ads & Business Directory Plugin, Wp Popup Builder – Popup Forms , Marketing Popup & Newsletter, Post Smtp Mailer/email Log552nonenew
- 16QualcommWCD9370 Firmware, WCD9375 Firmware, WSA8835 Firmware545nonenew
- 17Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile545nonenew
- 18PackagistTypo3/cms-core, Typo3/cms, Moodle/moodle516nonenew
- 19GoGithub.com/rancher/rancher, Github.com/grafana/grafana, Github.com/elrondnetwork/elrond-go476nonenew
- 20Ао «концерн Вниинс»Ос Он «стрелец»4413new
- 21npmSteal, Matrix-js-sdk, Parse-server4310nonenew
- 22Samsung MobileSamsung Mobile Devices, Samsung Pay, Com.samsung.android.waterplugin400nonenew
- 23TendaAC21 Firmware, I9 Firmware, AC18 Firmware3921nonenew
- 24HuaweiEmui, Harmonyos, Magic Ui379nonenew
- 25LinuxLinux Kernel, Kernel360nonenew
Severity
How this month's CVEs score on CVSS; 53 have no score yet. Severity is not exploitation.
- Critical299
- High905
- Medium900
- Low53
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-787Out-of-bounds Write268
- CWE-79XSS252
- CWE-89SQL Injection162
- CWE-125Out-of-bounds Read90
- CWE-352CSRF67
- CWE-20Improper Input Validation64
- CWE-416Use After Free60
- CWE-22Path Traversal57
- CWE-287Improper Authentication53
- CWE-200Information Exposure45
- CWE-434Unrestricted File Upload38
- CWE-61738
- CWE-862Missing Authorization38
- CWE-284Improper Access Control36
- CWE-78OS Command Injection36
- CWE-120Buffer Overflow35
- CWE-476NULL Pointer Dereference32
- CWE-122Heap Buffer Overflow31
- CWE-400Resource Consumption31
- CWE-269Improper Privilege Mgmt28
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries55218% of sector-tagged CVEs
- Operating Systems47515% of sector-tagged CVEs
- Web & CMS Plugins35311% of sector-tagged CVEs
- Mobile Apps33311% of sector-tagged CVEs
- Enterprise Software2909% of sector-tagged CVEs
- Networking Infrastructure2006% of sector-tagged CVEs
- Consumer Software1394% of sector-tagged CVEs
- Hardware Firmware1374% of sector-tagged CVEs
- DevTools & CI1244% of sector-tagged CVEs
- 6 smaller sectors414
- Not yet classified136
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 787Out-of-bounds Write | 79XSS | 89SQL Injection | 125Out-of-bounds Read | 352CSRF | 20Improper Input Validation | 416Use After Free | 22Path Traversal | 287Improper Authentication | 200Information Exposure |
|---|---|---|---|---|---|---|---|---|---|---|
| 35 | 1 | 6 | 1 | 19 | 20 | 2 | ||||
| Сообщество Свободного Программного Обеспечения | 22 | 3 | 1 | 9 | 6 | 22 | 1 | 1 | ||
| Ао «нппкт» | 26 | 1 | 5 | 1 | 7 | 28 | ||||
| Ооо «русбитех-астра» | 19 | 2 | 5 | 1 | 7 | 32 | ||||
| PyPI | 3 | 1 | 1 | 5 | 16 | 3 | 1 | |||
| Maven | 7 | 18 | 7 | 1 | 3 | 4 | ||||
| Fedoraproject | 17 | 5 | 1 | 2 | 1 | 6 | 20 | 1 | 1 | |
| Microsoft Corp | 4 | 1 | 1 | 1 | 1 | 2 | 9 | |||
| Ооо «ред Софт» | 17 | 4 | 3 | 6 | 4 | 8 | 1 | |||
| Debian | 16 | 1 | 1 | 7 | 4 | 11 | 1 | |||
| Apple | 16 | 1 | 10 | 4 | 2 | 4 | ||||
| Adobe | 15 | 13 | 26 | 1 | 5 | 1 |
CVEs published in September 2022
19 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-27593DeadBolt RansomwareKEV10.0
- CVE-2022-3236A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.KEV9.8
- CVE-2022-35914/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.KEV9.8
- CVE-2022-41352An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/publi...KEV9.8
- CVE-2022-3075Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafte...KEV9.6
- CVE-2022-3038Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2022-20775Cisco SD-WAN Software Privilege Escalation VulnerabilityKEV7.8
- CVE-2022-32917The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrar...KEV7.8
- CVE-2022-37969Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-40139Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct a...KEV7.2
- CVE-2022-2856Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML p...KEV6.5
- CVE-2022-39197An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnera...KEV6.1
- CVE-2022-38542Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1....9.8
- CVE-2022-40083Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forge...9.6
- CVE-2022-22610A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing malicio...8.8
- CVE-2022-36859Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices.5.7
- CVE-2022-41847An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode, AP4_ByteStream*&) in System/StdC/Ap4S...5.5
- CVE-2022-37250Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.5.4
- CVE-2022-3326Weak Password Requirements in ikus060/rdiffweb4.3