Zero-day report: April 2022
CISA added 45 exploited vulnerabilities to its catalog in April 2022, 181 fewer than March (226). 8 were zero-days, listed within a week of going public. 10 are known to be used by ransomware. The most-hit vendor was Microsoft, with 11.
By technology
Most-hit vendors
Every flaw added in April 2022
- Jenkins · Script Security PluginJenkins Script Security Plugin Sandbox Bypass Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Linux · KernelLinux Kernel Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows User Profile Service Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows User Profile Service Privilege Escalation Vulnerability
- WSO2 · Multiple ProductsWSO2 Multiple Products Unrestrictive Upload of File Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- Meta Platforms · WhatsAppWhatsApp VOIP Stack Buffer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows Print Spooler Privilege Escalation Vulnerability
- Alcatel · OmniPCX EnterpriseAlcatel OmniPCX Enterprise Remote Code Execution Vulnerability
- Ubiquiti · AirOSUbiquiti AirOS Command Injection Vulnerability
- InduSoft · Web StudioInduSoft Web Studio NTWebServer Directory Traversal Vulnerability
- Trihedral · VTScada (formerly VTS)Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
- Schneider Electric · U.motion BuilderSchneider Electric U.motion Builder SQL Injection Vulnerability
- D-Link · DNS-320 Storage DeviceD-Link DNS-320 Remote Code Execution Vulnerability
- Crestron · Multiple ProductsCrestron Multiple Products Command Injection Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- VMware · Multiple ProductsVMware Multiple Products Privilege Escalation Vulnerability
- VMware · Workspace ONE Access and Identity ManagerVMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
- Adobe · Flash PlayerAdobe Flash Player Stack-Based Buffer Overflow Vulnerability
- Adobe · Flash PlayerAdobe Flash Player Remote Code Execution Vulnerability
- Adobe · Flash PlayerAdobe Flash Player Use-After-Free Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Memory Corruption Vulnerability
- Adobe · Flash PlayerAdobe Flash Player Heap-Based Buffer Overflow Vulnerability
- Adobe · Flash PlayerAdobe Flash Player Use-After-Free Vulnerability
- Adobe · Flash PlayerAdobe Flash Player Use-After-Free Vulnerability
- Kaseya · Virtual System/Server Administrator (VSA)Kaseya VSA Remote Code Execution Vulnerability
- Drupal · CoreDrupal Core Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows CLFS Driver Privilege Escalation Vulnerability
- Telerik · User Interface (UI) for ASP.NET AJAXTelerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
- QNAP · QNAP Network-Attached Storage (NAS)QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
- Linux · KernelLinux Kernel Privilege Escalation Vulnerability
- Checkbox · Checkbox SurveyCheckbox Survey Deserialization of Untrusted Data Vulnerability
- Google · PixelGoogle Pixel Out-of-Bounds Write Vulnerability
- Microsoft · Active DirectoryMicrosoft Active Directory Domain Services Privilege Escalation Vulnerability
- Microsoft · Active DirectoryMicrosoft Active Directory Domain Services Privilege Escalation Vulnerability
- WatchGuard · Firebox and XTMWatchGuard Firebox and XTM Privilege Escalation Vulnerability
- Microsoft · SMBv1 serverMicrosoft SMBv1 Server Remote Code Execution Vulnerability
- Microsoft · HTTP Protocol StackMicrosoft HTTP Protocol Stack Remote Code Execution Vulnerability
- Sudo · SudoSudo Heap-Based Buffer Overflow Vulnerability
- D-Link · Multiple RoutersD-Link Multiple Routers Remote Code Execution Vulnerability
- Apple · macOSApple macOS Out-of-Bounds Read Vulnerability
- Apple · macOSApple macOS Out-of-Bounds Write Vulnerability
- VMware · Spring FrameworkSpring Framework JDK 9+ Remote Code Execution Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.