December 2022
2,862 CVEs published, +34% on November 2022 and +14% on December 2021. CISA added 9 to KEV.
2022 month by month
- Critical
- 30013% of the 2,364 with a CVSS score
- Added to CISA KEV
- 94 of this month's CVEs are in KEV, listed a median 1.5 days after publication
- Vendors
- 1,1004,630 products
- Top weakness
- XSSCWE-79 · 342 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Google Chrome, Chrome27031new
- 2Ао "нппкт"Осон Основа Оnyx243253new
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Xrdp21026nonenew
- 4MozillaFirefox, Thunderbird, Firefox Esr175182new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition169222new
- 6Ао «ивк»Альт 8 Сп, Альт Сп 10144212new
- 7GoGithub.com/usememos/memos, Helm.sh/helm/v3, Github.com/alist-org/alist/v312615nonenew
- 8Ооо «ред Софт»Ред Ос122162new
- 9UnknownContest Gallery Pro, Contest Gallery, Popup Manager10310nonenew
- 10Red HatRed Hat Enterprise Linux, Red Hat Satellite, Openshift977nonenew
- 11TendaF1203 Firmware, W30E Firmware, A15 Firmware9121nonenew
- 12DebianDebian Linux7816nonenew
- 13Фссп РоссииОс Тд Аис Фссп России77122new
- 14Ао «концерн Вниинс»Ос Он «стрелец»74102new
- 15MavenCn.hutool:hutool-json, Net.mingsoft:ms-mcms, Io.apiman:apiman-manager-api-rest-impl568nonenew
- 16MicrosoftWindows 10 Version 1809, Windows 11, Windows 10 Version 22h25502new
- 17CanonicalUbuntu546nonenew
- 18Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications546nonenew
- 19PackagistFeehi/feehicms, Typo3/cms, Typo3/cms-core544nonenew
- 20ApplemacOS, iPhone OS, iPadOS5131new
- 21Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000, Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8001, Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8002490nonenew
- 22UnspecifiedMovie Ticket Booking System, House Rental System, Wp-ban490nonenew
- 23npmJsonwebtoken, Nadesiko3, @cubejs-backend/api-gateway487nonenew
- 24UsememosUsememos/memos, Memos473nonenew
- 25SiemensTeamcenter Visualization V13.3, Teamcenter Visualization V13.2, Teamcenter Visualization443nonenew
Severity
How this month's CVEs score on CVSS; 498 have no score yet. Severity is not exploitation.
- Critical300
- High794
- Medium1,074
- Low196
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS342
- CWE-787Out-of-bounds Write252
- CWE-125Out-of-bounds Read111
- CWE-70795
- CWE-89SQL Injection86
- CWE-120Buffer Overflow82
- CWE-22Path Traversal80
- CWE-416Use After Free58
- CWE-78OS Command Injection57
- CWE-352CSRF56
- CWE-20Improper Input Validation53
- CWE-284Improper Access Control53
- CWE-862Missing Authorization51
- CWE-287Improper Authentication49
- CWE-200Information Exposure45
- CWE-863Incorrect Authorization42
- CWE-476NULL Pointer Dereference36
- CWE-400Resource Consumption33
- CWE-434Unrestricted File Upload33
- CWE-269Improper Privilege Mgmt31
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries51015% of sector-tagged CVEs
- Operating Systems45213% of sector-tagged CVEs
- Mobile Apps36811% of sector-tagged CVEs
- Web & CMS Plugins35010% of sector-tagged CVEs
- Enterprise Software34610% of sector-tagged CVEs
- Consumer Software3049% of sector-tagged CVEs
- Networking Infrastructure2638% of sector-tagged CVEs
- Hardware Firmware1625% of sector-tagged CVEs
- 7 smaller sectors413
- Not yet classified246
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 707 | 89SQL Injection | 120Buffer Overflow | 22Path Traversal | 416Use After Free | 78OS Command Injection | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| 62 | 49 | 3 | 2 | 3 | 19 | |||||
| Ао «нппкт» | 13 | 41 | 18 | 1 | 30 | 2 | ||||
| Сообщество Свободного Программного Обеспечения | 6 | 36 | 23 | 4 | 21 | 1 | ||||
| Mozilla | 10 | 29 | 5 | 1 | 20 | |||||
| Ооо «русбитех-астра» | 5 | 32 | 18 | 4 | 1 | 23 | 1 | |||
| Mozilla Corp. | 10 | 29 | 5 | 1 | 20 | |||||
| Ао «ивк» | 7 | 23 | 12 | 4 | 20 | |||||
| Go | 17 | 1 | 1 | 1 | 12 | 1 | 8 | |||
| Ооо «ред Софт» | 7 | 15 | 10 | 4 | 15 | |||||
| Tenda | 46 | 31 | 6 | 5 | ||||||
| Red Hat Inc. | 5 | 13 | 6 | 1 | 1 | 8 | 2 | |||
| Debian | 6 | 14 | 13 | 4 | 3 | 2 |
CVEs published in December 2022
18 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-27518Unauthenticated remote arbitrary code executionKEV9.8
- CVE-2022-46169Unauthenticated Command InjectionKEV9.8
- CVE-2022-26486An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability aff...KEV9.6
- CVE-2022-26485Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97....KEV8.8
- CVE-2022-4262Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)KEV8.8
- CVE-2022-42856A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciousl...KEV8.8
- CVE-2022-44698Windows SmartScreen Security Feature Bypass VulnerabilityKEV5.4
- CVE-2022-40434Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.9.8
- CVE-2022-4063InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE9.8
- CVE-2022-44456CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafte...9.8
- CVE-2022-46020WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.9.8
- CVE-2022-47945ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can explo...9.8
- CVE-2022-45045Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary command...8.8
- CVE-2022-45980Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .8.8
- CVE-2022-46443mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter.8.8
- CVE-2022-47938An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.6.5
- CVE-2022-4860KBase Metrics methods_upload_user_stats.py upload_user_data sql injection5.5
- CVE-2017-20153aerouk imageserve cross site scripting2.6