Week 3, 2021

18–24 January 2021

New CVEs: 433
Critical: 27
High: 118
Newly exploited: 0
Advisories: 89
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2020-14756 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.…
Oracle · Utilities Framework

EPSS 75%
Critical 9.8
CVE-2021-3199 Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an imag…
EPSS 30%
Critical 9.8
CVE-2021-3177 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications tha…
EPSS 24%
Critical 9.8
CVE-2021-1994 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 …
Oracle · WebLogic Server

EPSS 5.5%
Critical 9.8
CVE-2021-3190 OS Command Injection in async-git
EPSS 5.4%
Critical 9.8
CVE-2021-1138 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Cisco · Cisco Smart Software Manager On-Prem

EPSS 4.4%
Critical 9.8
CVE-2021-1140 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Cisco · Cisco Smart Software Manager On-Prem

EPSS 4.4%
Critical 9.8
CVE-2021-1142 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Cisco · Cisco Smart Software Manager On-Prem

EPSS 4.4%
Critical 9.8
CVE-2021-1139 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Cisco · Cisco Smart Software Manager On-Prem

EPSS 4%
Critical 9.8
CVE-2021-1141 Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerabilities
Cisco · Cisco Smart Software Manager On-Prem

EPSS 4%
Critical 9.6
CVE-2021-1264 Cisco DNA Center Command Runner Command Injection Vulnerability
Cisco · Cisco Digital Network Architecture Center (DNA Center)

EPSS 3.9%
Critical 9.8
CVE-2021-2075 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 10.3.6.0.0, 12.1…
Oracle · WebLogic Server

EPSS 3.8%
Critical 9.8
CVE-2021-2047 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 10.3.6.0…
Oracle · WebLogic Server

EPSS 3.8%
Critical 9.8
CVE-2021-2108 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 12.1.3.…
Oracle · WebLogic Server

EPSS 3.7%
Critical 9.8
CVE-2021-2064 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 12.1.3.…
Oracle · WebLogic Server

EPSS 3.7%

All 27 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

ICSA-21-021-03 Honeywell OPC UA Tunneller 4 CVEs
DSA-4837-1 salt - security update 3 CVEs
ICSA-21-019-02 Reolink P2P Cameras 2 CVEs
USN-4699-1 log4net vulnerability 1 CVEs