In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues
- CVEs
- CVE-2022-21882CVE-2021-1732CVE-2022-22587CVE-2021-30983CVE-2022-22620CVE-2022-26485CVE-2021-39793CVE-2022-22706CVE-2021-28664CVE-2022-1040CVE-2020-12271CVE-2022-1096CVE-2021-30551CVE-2022-1364CVE-2021-21195CVE-2022-26925CVE-2021-36942CVE-2022-30190CVE-2021-40444CVE-2022-26134CVE-2021-26084CVE-2022-2856CVE-2021-38000CVE-2022-41040CVE-2021-34473CVE-2022-41082CVE-2023-21529CVE-2022-41128CVE-2021-34480CVE-2022-41073CVE-2022-37987CVE-2022-42856
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-12271 | SQL Injection RCE in Sophos SFOS Firewalls with WAN-Exposed Admin or User Portal | 9.8 | 42% | KEVRansomwarePoC | KEV |
| CVE-2021-1732 | Out-of-Bounds Write Local Privilege Escalation in Microsoft Win32k (CVE-2021-1732) | 7.8 | 78% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-21195 | Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | 1% | ||
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-28664 | Out-of-Bounds Write in Arm Mali GPU Kernel Drivers Enables Privilege Escalation | 8.8 | 5% | KEV | KEV |
| CVE-2021-30551 | V8 Type Confusion Zero-Day in Google Chrome (CVE-2021-30551), Exploited in the Wild | 8.8 | 65% | KEVPoC | KEV |
| CVE-2021-30983 | Kernel Buffer Overflow in Apple iOS and iPadOS Enables Arbitrary Code Execution | 7.8 | 3% | KEV | KEV |
| CVE-2021-34473 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-34480 | Scripting Engine Memory Corruption Vulnerability | 6.8 | 34% | ||
| CVE-2021-36942 | Unauthenticated LSA Spoofing (PetitPotam NTLM Relay) in Microsoft Windows | 7.5 | 66% | KEVRansomwarePoC | KEV |
| CVE-2021-38000 | Improper Input Validation in Google Chrome for Android Allows Forced URL Navigation | 6.1 | 5% | KEVPoC | KEV |
| CVE-2021-39793 | Out-of-Bounds Write in Google Pixel Kernel Driver Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) | 8.8 | 98% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-1040 | Authentication Bypass Leading to Unauthenticated RCE in Sophos Firewall (SFOS) | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2022-1096 | Actively Exploited Type Confusion in Chromium V8 Engine (Chrome, Edge, Opera) | 8.8 | 25% | KEV | KEV |
| CVE-2022-1364 | Actively Exploited V8 Turbofan Type Confusion in Google Chrome (CVE-2022-1364) | 8.8 | 14% | KEVPoC | KEV |
| CVE-2022-21882 | Out-of-Bounds Write LPE in Microsoft Win32k on Windows 10/11 and Windows Server | 7.8 | 59% | KEVRansomware | KEV |
| CVE-2022-22587 | Memory Corruption in Apple iOS, iPadOS, and macOS Allows Kernel-Privilege Code Execution | 9.8 | 12% | KEV | KEV |
| CVE-2022-22620 | WebKit Use-After-Free (CVE-2022-22620) Enables RCE on iOS, iPadOS, and macOS | 8.8 | 16% | KEV | KEV |
| CVE-2022-22706 | Unprivileged Memory-Write Flaw in Arm Mali GPU Kernel Drivers | 7.8 | 1% | KEV | KEV |
| CVE-2022-26134 | Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-26485 | Use-After-Free in Mozilla Firefox XSLT Processing Exploited in the Wild | 8.8 | 14% | KEVPoC | KEV |
| CVE-2022-26925 | Spoofing Flaw in Windows LSA (CVE-2022-26925) Exploited Against Domain Controllers | 5.9 | 10% | KEV | KEV |
| CVE-2022-2856 | Intents Input Validation Flaw in Google Chrome for Android (CVE-2022-2856) | 6.5 | 5% | KEVPoC | KEV |
| CVE-2022-30190 | MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) | 7.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2022-37987 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability | 7.8 | 9% | ||
CVE-2022-41040+1 related CVE | Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell) | 8.8 group max | 100% | KEVRansomwarePoC | KEV |
CVE-2022-41128+1 related CVE | Out-of-bounds Write RCE in Microsoft Windows JScript9 Scripting Engine | 8.8 group max | 25% | KEV | KEV |
| CVE-2022-42856 | Type Confusion in Apple WebKit (Safari/iOS/macOS/tvOS), Actively Exploited | 8.8 | 9% | KEV | KEV |
| CVE-2023-21529 | Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529) | 8.8 | 59% | KEVRansomware | KEV |
From the original article
3 min read at securityaffairs.com
Google’s Threat Analysis Group Google states that more than 40% of zero-day flaws discovered in 2022 were variants of previous issues. The popular Threat Analysis Group (TAG) Maddie Stone wrote Google’s fourth annual year-in-review of zero-day flaws exploited in-the-wild [ 2021 , 2020 , 2019 ], it is built off of the mid-year 2022 review.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.