Zero-day report: November 2022
CISA added 10 exploited vulnerabilities to its catalog in November 2022, 2 fewer than October (12). 6 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Microsoft, with 5.
By technology
Most-hit vendors
Every flaw added in November 2022
- Oracle · Fusion MiddlewareOracle Fusion Middleware Unspecified Vulnerability
- Google · Chromium GPUGoogle Chromium GPU Heap Buffer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Improper Access Control Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Improper Access Control Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Memory Corruption Vulnerability
- Microsoft · WindowsMicrosoft Windows Print Spooler Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
- Microsoft · WindowsMicrosoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Scripting Languages Remote Code Execution Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.