Vulnerabilitycritical
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
- CVEs
- CVE-2017-5638CVE-2017-9841CVE-2018-19986CVE-2019-02320CVE-2019-19597CVE-2019-2725CVE-2019-2729CVE-2019-9082CVE-2020-5902CVE-2020-14882CVE-2020-14883CVE-2020-15505CVE-2020-15506CVE-2020-25078CVE-2021-21315CVE-2021-22986CVE-2021-26855CVE-2021-31805CVE-2021-34473CVE-2021-35464CVE-2021-38647CVE-2021-40438CVE-2021-40539CVE-2021-41773CVE-2021-42013CVE-2021-44228CVE-2021-45046CVE-2022-22963CVE-2022-22965
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-9841 | Unauthenticated Remote Code Execution in PHPUnit eval-stdin.php | 9.8 | 100% | KEV | KEV |
| CVE-2018-19986 | In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1… | 9.8 | 42% | PoC | |
| CVE-2019-19597 | D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH… | 8.8 | 21% | PoC | |
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2019-2729 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent | 9.8 | 89% | PoC | |
| CVE-2019-9082 | Unauthenticated RCE in ThinkPHP < 3.2.4 (Open Source BMS, ZzzCMS zzzphp) | 8.8 | 97% | KEVPoC ×3 | KEV |
CVE-2020-14882+1 related CVE | Remote Code Execution in Oracle WebLogic Server | 9.8 group max | 100% | KEVPoC ×3 | KEV |
| CVE-2020-15505 | Unauthenticated Hessian Java Deserialization RCE in Ivanti MobileIron | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2020-15506 | An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0… | 9.8 | 3% | ||
| CVE-2020-25078 | Unauthenticated Admin Password Disclosure in D-Link DCS-2530L/2670L Cameras | 7.5 | 98% | KEV | KEV |
| CVE-2020-5902 | Unauthenticated RCE via path traversal in F5 BIG-IP TMUI | 9.8 | 100% | KEVRansomwarePoC ×8 | KEV |
| CVE-2021-21315 | Command Injection in systeminformation npm Package (CVE-2021-21315) | 7.8 | 91% | KEV | KEV |
| CVE-2021-22986 | Unauthenticated RCE in F5 BIG-IP and BIG-IQ iControl REST | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2021-31805 | The fix issued for CVE-2020-17530 was incomplete | 9.8 | 85% | ||
| CVE-2021-34473 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-35464 | Java Deserialization RCE in ForgeRock Access Management (AM) | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2021-38647 | Unauthenticated RCE in Microsoft Open Management Infrastructure (OMI) | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-40438 | Server-Side Request Forgery (SSRF) in Apache HTTP Server mod_proxy | 9.0 | 100% | KEVRansomware | KEV |
| CVE-2021-40539 | Unauthenticated RCE via REST API auth bypass in Zoho ManageEngine ADSelfService Plus | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2021-41773 | Path Traversal to RCE in Apache HTTP Server 2.4.49 | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2021-42013 | Path Traversal and RCE in Apache HTTP Server (follow-up to CVE-2021-41773) | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) | 10.0 | 100% | KEVRansomwarePoC ×9 | KEV |
| CVE-2021-45046 | Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix | 9.0 | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-22963 | SpEL Expression Injection RCE in VMware Tanzu Spring Cloud Function | 9.8 | 100% | KEVPoC | KEV |
| CVE-2022-22965 | Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs | 9.8 | 100% | KEVPoC | KEV |
From the original article
5 min read at unit42.paloaltonetworks.com
Tens of thousands of vulnerabilities are reported every year, but not all are used by threat actors in real-world attacks.
By Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.