November 2022
2,135 CVEs published, +10% on October 2022 and +26% on November 2021. CISA added 10 to KEV.
2022 month by month
- Critical
- 28414% of the 2,076 with a CVSS score
- Added to CISA KEV
- 108 of this month's CVEs are in KEV, listed a median 91 days after publication
- Vendors
- 8977,711 products
- Top weakness
- XSSCWE-79 · 294 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Webkitgtk1488nonenew
- 2Ао "нппкт"Осон Основа Оnyx13932new
- 3GoogleChrome, Google Chrome, Android13722new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус»11142new
- 5MicrosoftWindows Server 2022, Windows 11, Windows Server 201910337new
- 6ApplemacOS, iPhone OS, iPadOS9531new
- 7MavenCom.liferay.portal:release.portal.bom, Com.liferay.portal:release.dxp.bom, Org.jeecgframework.boot:jeecg-module-system9320nonenew
- 8PackagistConcrete5/concrete5, Librenms/librenms, Tribalsystems/zenario808nonenew
- 9FedoraprojectFedora, Extra Packages For Enterprise Linux695nonenew
- 10Ооо «ред Софт»Ред Ос6781new
- 11DebianDebian Linux654nonenew
- 12UnknownWp User Merger, Booster For Woocommerce, Booster Elite For Woocommerce647nonenew
- 13PyPITensorflow, Tensorflow-gpu, Tensorflow-cpu596nonenew
- 14IntelXmm 7560 Firmware, Nuc Kit Wireless Adapter Driver Installer, Active Management Technology Firmware580nonenew
- 15CiscoCisco Firepower Management Center, Secure Firewall Management Center, Cisco Firepower Threat Defense Software470nonenew
- 16Red HatRed Hat Enterprise Linux, Migration Toolkit For Applications, Migration Toolkit For Runtimes455nonenew
- 17IBMCics Tx, Infosphere Information Server, Robotic Process Automation For Cloud Pak433nonenew
- 18Novell Inc.Opensuse Leap, Opensuse Tumbleweed, Suse Linux Enterprise Server For Sap Applications395nonenew
- 19Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization 3.0, Rosa Virtualization371nonenew
- 20npmHummus, Muhammara, Sweetalert23541new
- 21Fedora ProjectFedora, Coreos344nonenew
- 22GoGithub.com/ibax-io/go-ibax, Github.com/grafana/grafana, Github.com/hashicorp/nomad348nonenew
- 23TendaW15E Firmware, AC18 Firmware, AC23 Firmware3418nonenew
- 24Ао «ивк»Альт 8 Сп, Альт Сп 10331nonenew
- 25Aruba NetworksSD-WAN, Arubaos, Edgeconnect Enterprise291nonenew
Severity
How this month's CVEs score on CVSS; 59 have no score yet. Severity is not exploitation.
- Critical284
- High748
- Medium945
- Low99
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS294
- CWE-787Out-of-bounds Write157
- CWE-89SQL Injection148
- CWE-352CSRF80
- CWE-20Improper Input Validation77
- CWE-22Path Traversal63
- CWE-200Information Exposure56
- CWE-416Use After Free56
- CWE-70748
- CWE-434Unrestricted File Upload43
- CWE-125Out-of-bounds Read42
- CWE-284Improper Access Control38
- CWE-78OS Command Injection38
- CWE-287Improper Authentication37
- CWE-94Code Injection33
- CWE-362Race Condition32
- CWE-119Memory Buffer Bounds31
- CWE-120Buffer Overflow30
- CWE-862Missing Authorization29
- CWE-400Resource Consumption26
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries43815% of sector-tagged CVEs
- Operating Systems39413% of sector-tagged CVEs
- Web & CMS Plugins39113% of sector-tagged CVEs
- Enterprise Software36412% of sector-tagged CVEs
- Mobile Apps2599% of sector-tagged CVEs
- Networking Infrastructure2187% of sector-tagged CVEs
- Hardware Firmware1906% of sector-tagged CVEs
- Cloud & SaaS1204% of sector-tagged CVEs
- 7 smaller sectors452
- Not yet classified141
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 352CSRF | 20Improper Input Validation | 22Path Traversal | 200Information Exposure | 416Use After Free | 707 | 434Unrestricted File Upload |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 27 | 1 | 6 | 1 | 1 | 25 | |||
| Ао «нппкт» | 1 | 23 | 5 | 1 | 1 | 30 | ||||
| 18 | 15 | 1 | 30 | |||||||
| Ооо «русбитех-астра» | 1 | 26 | 5 | 1 | 24 | |||||
| Microsoft Corp | 7 | 3 | 12 | |||||||
| Apple | 1 | 17 | 2 | 1 | 12 | 7 | ||||
| Maven | 9 | 2 | 7 | 3 | 1 | 10 | 5 | 1 | ||
| Packagist | 44 | 3 | 3 | 1 | 3 | 1 | ||||
| Fedoraproject | 2 | 6 | 1 | 3 | 2 | |||||
| Ооо «ред Софт» | 7 | 7 | 1 | 1 | 5 | 3 | 2 | 4 | ||
| Debian | 20 | 2 | 1 | 4 | ||||||
| Microsoft | 4 |
CVEs published in November 2022
19 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-31199Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The r...KEV9.8
- CVE-2022-4135Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML pa...KEV9.6
- CVE-2022-3723Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)KEV8.8
- CVE-2022-40799Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.KEV8.8
- CVE-2022-41080Microsoft Exchange Server Elevation of Privilege VulnerabilityKEV8.8
- CVE-2022-41128Windows Scripting Languages Remote Code Execution VulnerabilityKEV8.8
- CVE-2022-23748mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker...KEV7.8
- CVE-2022-41073Windows Print Spooler Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-41125Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-42827An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrar...KEV7.8
- CVE-2022-40765A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection ...KEV6.8
- CVE-2022-41223The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrict...KEV6.8
- CVE-2022-41049Windows Mark of the Web Security Feature Bypass VulnerabilityKEV5.4
- CVE-2022-41091Windows Mark of the Web Security Feature Bypass VulnerabilityKEV5.4
- CVE-2022-41412An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF) attacks.8.6
- CVE-2022-2794Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.7.5
- CVE-2022-38120POWERCOM CO., LTD. UPSMON PRO - Path Traversal6.5
- CVE-2022-3998MonikaBrzica scm uredi_korisnika.php sql injection6.3
- CVE-2022-3817Axiomatic Bento4 mp4mux memory leak4.3