October 2022
1,936 CVEs published, −12% on September 2022 and +10% on October 2021. CISA added 12 to KEV.
2022 month by month
- Critical
- 30716% of the 1,878 with a CVSS score
- Added to CISA KEV
- 125 of this month's CVEs are in KEV, listed a median 156 days after publication
- Vendors
- 7173,400 products
- Top weakness
- Out-of-bounds WriteCWE-787 · 226 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Opencats1105nonenew
- 2GoogleAndroid, Android Studio, Bazel991nonenew
- 3MicrosoftWindows 11 Version 21h2, Windows 11, Windows Server 2022 (Server Core Installation)9414new
- 4Ао "нппкт"Осон Основа Оnyx834nonenew
- 5OracleMySQL, MySQL Server, Vm VirtualBox8121new
- 6Ао «ивк»Альт 8 Сп, Альт Сп 10804nonenew
- 7MavenCommons-jxpath:commons-jxpath, Com.liferay.portal:release.dxp.bom, Org.jenkins-ci.plugins:katalon7315nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition692nonenew
- 9DebianDebian Linux664nonenew
- 10UnknownFrontend File Manager Plugin, Wp Custom Cursors, Wp All Export Pro652nonenew
- 11Sap3d Visual Enterprise Author, 3d Visual Enterprise Viewer, Businessobjects Business Intelligence551nonenew
- 12Sap SeSap 3d Visual Enterprise Author, Sap 3d Visual Enterprise Viewer, Sap Customer Data Cloud (Gigya)551nonenew
- 13FedoraprojectFedora, Supybot-fedora542nonenew
- 14Ооо «ред Софт»Ред Ос536nonenew
- 15Red HatRed Hat Enterprise Linux, Openshift, Red Hat Software Collections513nonenew
- 16NetappOncommand Workflow Automation, Oncommand Insight, Active Iq Unified Manager472nonenew
- 17LinuxLinux Kernel, Kernel460nonenew
- 18SourcecodesterHuman Resource Management System, Sanitization Management System, Simple Cold Storage Management System400nonenew
- 19Abode Systems, Inc.Iota All-in-one Security Kit3824nonenew
- 20GoabodeIota All-in-one Security Kit Firmware3824nonenew
- 21Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000380nonenew
- 22JuniperJunos, Junos OS Evolved, Paragon Active Assurance Control Center371nonenew
- 23AutodeskAutocad Plant 3d, Autocad, Autocad Advance Steel361nonenew
- 24Juniper NetworksJunos OS, Junos, Junos OS Evolved360nonenew
- 25SiemensScalance W1750D Firmware, Scalance W1750D, Desigo PXM40-1 Firmware3611nonenew
Severity
How this month's CVEs score on CVSS; 58 have no score yet. Severity is not exploitation.
- Critical307
- High730
- Medium759
- Low82
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-787Out-of-bounds Write226
- CWE-79XSS202
- CWE-89SQL Injection110
- CWE-119Memory Buffer Bounds76
- CWE-125Out-of-bounds Read63
- CWE-434Unrestricted File Upload62
- CWE-862Missing Authorization59
- CWE-20Improper Input Validation54
- CWE-284Improper Access Control54
- CWE-78OS Command Injection50
- CWE-22Path Traversal49
- CWE-352CSRF42
- CWE-70741
- CWE-416Use After Free40
- CWE-287Improper Authentication37
- CWE-200Information Exposure34
- CWE-502Deserialization33
- CWE-400Resource Consumption29
- CWE-120Buffer Overflow28
- CWE-40127
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Enterprise Software39715% of sector-tagged CVEs
- Operating Systems38715% of sector-tagged CVEs
- OSS Libraries34813% of sector-tagged CVEs
- Web & CMS Plugins25010% of sector-tagged CVEs
- Networking Infrastructure2068% of sector-tagged CVEs
- Mobile Apps1656% of sector-tagged CVEs
- Security Products1305% of sector-tagged CVEs
- Hardware Firmware1094% of sector-tagged CVEs
- DevTools & CI1074% of sector-tagged CVEs
- 6 smaller sectors394
- Not yet classified109
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 787Out-of-bounds Write | 79XSS | 89SQL Injection | 119Memory Buffer Bounds | 125Out-of-bounds Read | 434Unrestricted File Upload | 862Missing Authorization | 20Improper Input Validation | 284Improper Access Control | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 9 | 6 | 15 | 1 | 2 | |||||
| 23 | 1 | 1 | 3 | 28 | 3 | 5 | ||||
| Microsoft Corp | 1 | 1 | ||||||||
| Microsoft | 1 | |||||||||
| Ао «нппкт» | 9 | 1 | 15 | 2 | 2 | |||||
| Ао «ивк» | 7 | 1 | 4 | 2 | 1 | 1 | ||||
| Oracle | 3 | 5 | ||||||||
| Oracle Corporation | 3 | 5 | ||||||||
| Maven | 2 | 11 | 5 | 4 | 1 | 1 | ||||
| Ооо «русбитех-астра» | 9 | 1 | 12 | 2 | 2 | |||||
| Debian | 10 | 1 | 11 | 1 | 1 | 1 | ||||
| Sap | 28 | 4 | 43 |
CVEs published in October 2022
13 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2016-20017D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.KEV9.8
- CVE-2022-21587Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable v...KEV9.8
- CVE-2022-40684An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0...KEV9.8
- CVE-2022-38181The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 throu...KEV8.8
- CVE-2022-41040Microsoft Exchange Server Elevation of Privilege VulnerabilityKEV8.8
- CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityKEV8.0
- CVE-2022-38028Windows Print Spooler Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-41033Windows COM+ Event System Service Elevation of Privilege VulnerabilityKEV7.8
- CVE-2016-20016MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating ...9.8
- CVE-2022-41302An Out-Of-Bounds Read Vulnerability in Autodesk FBX SDK version 2020. and prior may lead to code execution or information disclosure through maliciously crafted FBX files. This vulnerability in con...7.8
- CVE-2022-38421Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability7.2
- CVE-2021-42553STM32 USB Host Library Buffer Overflow6.8
- CVE-2022-42114A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to in...5.4