Zero-day report: January 2022
CISA added 40 exploited vulnerabilities to its catalog in January 2022, 20 more than December (20). 1 was a zero-day, listed within a week of going public. 9 are known to be used by ransomware. The most-hit vendor was Microsoft, with 6.
By technology
Most-hit vendors
Every flaw added in January 2022
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Memory Corruption Vulnerability
- GNU · Bourne-Again Shell (Bash)GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
- GNU · Bourne-Again Shell (Bash)GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
- Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard ManageabilityIntel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
- Grandstream · UCM6200Grandstream Networks UCM6200 Series SQL Injection Vulnerability
- SonicWall · SMA 100 AppliancesSonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
- Apple · iOS and macOSApple Memory Corruption Vulnerability
- Apache · Struts 1Apache Struts 1 ActionForm Denial-of-Service Vulnerability
- Apache · Struts 2Apache Struts 2 Improper Input Validation Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- SolarWinds · Serv-USolarWinds Serv-U Improper Input Validation Vulnerability
- Apache · AirflowApache Airflow Command Injection
- Drupal · Drupal coreDrupal core Un-restricted Upload of File
- Apache · Airflow's Experimental APIApache Airflow's Experimental API Authentication Bypass
- Oracle · Intelligence Enterprise EditionOracle Business Intelligence Enterprise Edition Path Transversal
- Npm package · System Information Library for Node.JSSystem Information Library for Node.JS Command Injection
- VMware · vRealize Operations Manager APIVMware Server Side Request Forgery in vRealize Operations Manager API
- F5 · BIG-IP Traffic Management MicrokernelF5 BIG-IP Traffic Management Microkernel Buffer Overflow
- Nagios · Nagios XINagios XI OS Command Injection
- Nagios · Nagios XINagios XI OS Command Injection
- Nagios · Nagios XINagios XI OS Command Injection
- October CMS · October CMSOctober CMS Improper Authentication
- Microsoft · Exchange ServerMicrosoft Exchange Server Information Disclosure
- Aviatrix · Aviatrix ControllerAviatrix Controller Unrestricted Upload of File
- Microsoft · WinVerifyTrust functionMicrosoft WinVerifyTrust function Remote Code Execution
- IBM · WebSphere Application Server and Server Hypervisor EditionIBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
- Primetek · Primefaces ApplicationPrimetek Primefaces Remote Code Execution Vulnerability
- Fortinet · FortiOS and FortiProxyFortinet FortiOS and FortiProxy Improper Authorization
- Fortinet · FortiOS and FortiProxyFortinet FortiOS and FortiProxy Out-of-bounds Write
- Exim · Mail Transfer Agent (MTA)Exim Mail Transfer Agent (MTA) Improper Input Validation
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Palo Alto Networks · PAN-OSPalo Alto Networks PAN-OS Remote Code Execution Vulnerability
- Oracle · WebLogic ServerOracle WebLogic Server, Injection
- Elastic · KibanaKibana Arbitrary Code Execution
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
- Google · Chrome MediaGoogle Chrome Media Use-After-Free Vulnerability
- VMware · vCenter ServerVMware vCenter Server Improper Access Control
- FatPipe · WARP, IPVPN, and MPVPN softwareFatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
- Hikvision · Security cameras web serverHikvision Improper Input Validation
← December 2021February 2022 →
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.