Zero-day report: December 2022
CISA added 9 exploited vulnerabilities to its catalog in December 2022, 1 fewer than November (10). 5 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was TIBCO, with 2.
By technology
Most-hit vendors
Every flaw added in December 2022
- TIBCO · JasperReportsTIBCO JasperReports Library Directory Traversal Vulnerability
- TIBCO · JasperReportsTIBCO JasperReports Server Information Disclosure Vulnerability
- Apple · iOSApple iOS Type Confusion Vulnerability
- Veeam · Backup & ReplicationVeeam Backup & Replication Remote Code Execution Vulnerability
- Veeam · Backup & ReplicationVeeam Backup & Replication Remote Code Execution Vulnerability
- Citrix · Application Delivery Controller (ADC) and GatewayCitrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
- Fortinet · FortiOSFortinet FortiOS Heap-Based Buffer Overflow Vulnerability
- Microsoft · DefenderMicrosoft Defender SmartScreen Security Feature Bypass Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.