Week 4, 2021
25–31 January 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-29557 An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-au…EPSS 56%
- Critical 9.1 EPSS 4.4%
-
Critical 10.0
CVE-2020-6779 Hard-coded Credentials in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 ServerEPSS 3.7%
- Critical 9.8 EPSS 3.6%
-
Critical
CVE-2020-35124 XSS vulnerability leveraged through referrers could allow un-authorized admin access in MauticEPSS 2.4%
- Critical 9.8 EPSS 1.7%
- Critical
- Critical
- Critical
- Critical
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2021-3156 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" a…EPSS 100%
-
High 8.8
CVE-2021-25646 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.EPSS 99%
-
Unscored
CVE-2020-36228 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial …EPSS 85%
-
Unscored
CVE-2020-36221 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of se…EPSS 85%
-
Unscored
CVE-2020-36222 A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.EPSS 77%
-
Unscored
CVE-2020-36227 A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.EPSS 77%
-
Medium 6.3
CVE-2020-4888 IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure…EPSS 62%
-
Unscored
CVE-2020-35576 A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute …EPSS 42%
Advisories
- SUSE / openSUSE Security Updates 351 critical
- Debian Security (DSA / DLA) 13
- Ubuntu Security Notices (USN) 10
- BSI CERT-Bund (WID) 9
- Amazon Linux Security Center (ALAS) 81 critical
- Oracle Linux Security Advisories (ELSA) 7
- CISA ICS & IT advisories 4
- SUSE-SU-2021:0210-1 Security update for rubygem-nokogiri 2 CVEs
- ALAS2-2021-1594 Critical: thunderbird security update (Amazon Linux 2) 1 CVEs