Week 5, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2020-25506 D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
  EPSS 100%
• Critical 9.8
  CVE-2020-17523 Authentication bypass in Apache Shiro
  EPSS 86%
• Critical 9.6
  CVE-2020-13562 A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e…
  EPSS 78%
• Critical 9.6
  CVE-2020-13564 A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e…
  EPSS 76%
• Critical 9.6
  CVE-2020-13563 A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e…
  EPSS 76%
• Critical 9.8
  CVE-2021-20016 A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password …

  SonicWall · SonicWall SMA100

  EPSS 40%
• Critical 9.3
  CVE-2021-21276 Privilege escalation in Polr

  cydrobolt · polr

  EPSS 7.3%
• Critical 9.1
  CVE-2020-36242 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow
  EPSS 6.8%
• Critical 9.8
  CVE-2021-1293 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities

  Cisco · Cisco Small Business RV Series Router Firmware

  EPSS 5.7%
• Critical 9.8
  CVE-2021-23330 Command Injection
  EPSS 5.3%
• Critical 9.8
  CVE-2021-1294 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities

  Cisco · Cisco Small Business RV Series Router Firmware

  EPSS 4.7%
• Critical 9.8
  CVE-2021-1290 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities

  Cisco · Cisco Small Business RV Series Router Firmware

  EPSS 4.4%
• Critical 9.8
  CVE-2021-1291 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities

  Cisco · Cisco Small Business RV Series Router Firmware

  EPSS 4.4%
• Critical 9.8
  CVE-2021-1295 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities

  Cisco · Cisco Small Business RV Series Router Firmware

  EPSS 4.4%
• Critical 9.8
  CVE-2021-1289 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities

  Cisco · Cisco Small Business RV Series Router Firmware

  EPSS 4.4%

All 22 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2021-3378 FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting …
  EPSS 98%
• Unscored
  CVE-2021-3122 CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) …
  EPSS 88%
• Unscored
  CVE-2020-28653 Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servl…
  EPSS 78%
• High 8.8
  CVE-2020-13580 An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application…
  EPSS 71%
• High 8.8
  CVE-2020-13579 An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specia…
  EPSS 71%
• Unscored
  CVE-2020-36243 The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenti…
  EPSS 64%
• Unscored
  CVE-2021-25274 The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a …
  EPSS 36%
• Unscored
  CVE-2020-35765 doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the …
  EPSS 27%