Zero-day report: December 2021

CISA added 20 exploited vulnerabilities to its catalog in December 2021, 271 fewer than November (291). 6 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Apache, with 3.

By technology

• Servers, cloud & backup6
• Other business software4
• Remote access & IT tools3
• Phones & computers2
• Firewalls, VPNs & network gear2
• Developer, data & AI tools2
• Web browsers1
• Office, email & file sharing0
• Websites & online stores0

Most-hit vendors

• Apache3
• Zoho3
• Red Hat2
• Embedthis1
• Fortinet1
• Fuel CMS1
• Google1
• Linux1

Every flaw added in December 2021

• Google · Chromium V8Google Chromium V8 Use-After-Free VulnerabilityCVE-2021-4102 · Dec 15, 2021 · zero-day
• Microsoft · WindowsMicrosoft Windows AppX Installer Spoofing VulnerabilityCVE-2021-43890 · Dec 15, 2021 · zero-day · ransomware
• Red Hat · JBoss Seam 2Red Hat Linux JBoss Seam 2 Remote Code Execution VulnerabilityCVE-2010-1871 · Dec 10, 2021
• Red Hat · JBoss Application ServerRed Hat JBoss Application Server Remote Code Execution VulnerabilityCVE-2017-12149 · Dec 10, 2021 · ransomware
• Embedthis · GoAheadEmbedthis GoAhead Remote Code Execution VulnerabilityCVE-2017-17562 · Dec 10, 2021
• Apache · SolrApache Solr DataImportHandler Code Injection VulnerabilityCVE-2019-0193 · Dec 10, 2021
• MongoDB · mongo-expressMongoDB mongo-express Remote Code Execution VulnerabilityCVE-2019-10758 · Dec 10, 2021
• Linux · KernelLinux Kernel Improper Privilege Management VulnerabilityCVE-2019-13272 · Dec 10, 2021
• Sonatype · Nexus Repository ManagerSonatype Nexus Repository Manager Incorrect Access Control VulnerabilityCVE-2019-7238 · Dec 10, 2021
• Fuel CMS · Fuel CMSFuel CMS SQL Injection VulnerabilityCVE-2020-17463 · Dec 10, 2021
• Pi-hole · AdminLTEPi-Hole AdminLTE Remote Code Execution VulnerabilityCVE-2020-8816 · Dec 10, 2021
• Realtek · Jungle Software Development Kit (SDK)Realtek Jungle SDK Remote Code Execution VulnerabilityCVE-2021-35394 · Dec 10, 2021
• Fortinet · FortiOSFortinet FortiOS Arbitrary File DownloadCVE-2021-44168 · Dec 10, 2021 · zero-day
• Apache · Log4j2Apache Log4j2 Remote Code Execution VulnerabilityCVE-2021-44228 · Dec 10, 2021 · zero-day · ransomware
• Zoho · Desktop CentralZoho Desktop Central Authentication Bypass VulnerabilityCVE-2021-44515 · Dec 10, 2021 · zero-day
• MikroTik · RouterOSMikroTik Router OS Directory Traversal VulnerabilityCVE-2018-14847 · Dec 1, 2021
• Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon WearablesQualcomm Multiple Chipsets Improper Input Validation VulnerabilityCVE-2020-11261 · Dec 1, 2021
• Zoho · ManageEngine ServiceDesk Plus (SDP)Zoho ManageEngine ServiceDesk Authentication Bypass VulnerabilityCVE-2021-37415 · Dec 1, 2021
• Apache · ApacheApache HTTP Server-Side Request Forgery (SSRF)CVE-2021-40438 · Dec 1, 2021 · ransomware
• Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusZoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityCVE-2021-44077 · Dec 1, 2021 · zero-day

← November 2021January 2022 →

Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.