Week 2, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-3129 Unauthenticated remote code execution in Ignition
  EPSS 100%
• Critical 10.0
  CVE-2021-21242 Pre-Auth Unsafe Deserialization on AttachmentUploadServet

  theonedev · onedev

  EPSS 74%
• Critical 10.0
  CVE-2021-21243 Pre-Auth Unsafe Deserialization on KubernetesResource

  theonedev · onedev

  EPSS 54%
• Critical 10.0
  CVE-2020-29495 DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could p…

  Dell · Avamar

  EPSS 6.4%
• Critical 9.1
  CVE-2021-23926 XMLBeans XML Entity Expansion

  Apache Software Foundation · Apache XMLBeans

  EPSS 6.3%
• Critical 9.8
  CVE-2020-11995 Apache Dubbo default deserialization protocol Hessian2 cause CRE

  Apache Software Foundation · Apache Dubbo

  EPSS 5.9%
• Critical 9.8
  CVE-2020-23653 ThinkAdmin insecure unserialize vulnerability
  EPSS 4.3%
• Critical 9.9
  CVE-2021-21465 The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can includ…

  SAP · SAP Business Warehouse

  EPSS 3.7%
• Critical 9.9
  CVE-2021-21466 SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject cod…

  SAP · SAP Business Warehouse · SAP BW/4HANA

  EPSS 3.1%
• Critical 9.6
  CVE-2021-21249 Post-Auth Unsafe Yaml deserialization

  theonedev · onedev

  EPSS 3.1%
• Critical 9.8
  CVE-2021-3028 git-big-picture Code Execution
  EPSS 2.9%
• Critical 10.0
  CVE-2020-29493 DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potential…

  Dell · Avamar

  EPSS 2.7%
• Critical 9.8
  CVE-2021-23899 Arbitrary code injection in json-sanitizer
  EPSS 2.1%
• Critical 9.6
  CVE-2021-21247 Post-Auth Unsafe Deserialization on BasePage (AJAX)

  theonedev · onedev

  EPSS 1.5%
• Critical 10.0
  CVE-2021-21244 Pre-Auth SSTI via Bean validation message tampering

  theonedev · onedev

  EPSS 1.5%

All 18 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2020-35578 An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, …
  EPSS 82%
• Unscored
  CVE-2021-23124 [20210102] - Core - XSS in mod_breadcrumbs aria-label attribute

  Joomla! Project · Joomla! CMS

  EPSS 79%
• High 8.6
  CVE-2021-21246 Pre-Auth Access token leak

  theonedev · onedev

  EPSS 49%
• High 7.8
  CVE-2021-1647 Microsoft Defender Remote Code Execution Vulnerability

  Microsoft · Microsoft Security Essentials · Windows Defender · Microsoft System Center Endpoint Protection

  EPSS 40%
• Unscored
  CVE-2020-35749 Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows r…
  EPSS 30%
• Medium 5.9
  CVE-2021-24122 Apache Tomcat information disclosure

  Apache Software Foundation · Apache Tomcat

  EPSS 23%
• High 7.7
  CVE-2021-21251 ZipSlip Arbitrary File Upload

  theonedev · onedev

  EPSS 13%
• Unscored
  CVE-2020-27265 KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Aut…
  EPSS 13%