Week 6, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-22502 Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to al…
  EPSS 97%
• Critical 9.8
  CVE-2020-27868 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to…

  Qognify · Ocularis

  EPSS 82%
• Critical 9.9
  CVE-2021-21477 SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with th…

  SAP · SAP Commerce

  EPSS 30%
• Critical 9.8
  CVE-2020-14343 Improper Input Validation in PyYAML
  EPSS 6.2%
• Critical 9.8
  CVE-2020-13576 A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote c…
  EPSS 6.1%
• Critical 9.8
  CVE-2021-26541 Command injection in gitlog
  EPSS 5.4%
• Critical 9.8
  CVE-2020-15798 A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All ve…

  Siemens · SIMATIC HMI Comfort Panels (incl. SIPLUS variants) · SINAMICS SM120 · SINAMICS SM150i

  EPSS 5.3%
• Critical 9.8
  CVE-2021-27185 Command injection in samba-client
  EPSS 4.9%
• Critical 9.1
  CVE-2021-21016 Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

  Adobe · Magento Commerce

  EPSS 4.8%
• Critical 9.1
  CVE-2021-21014 Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

  Adobe · Magento Commerce

  EPSS 4.4%
• Critical 9.8
  CVE-2021-25913 Prototype Pollution in set-or-get
  EPSS 4.4%
• Critical 9.1
  CVE-2021-21018 Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution

  Adobe · Magento Commerce

  EPSS 3.9%
• Critical 9.1
  CVE-2021-21019 Magento Commerce XML Injection Could Lead To Remote Code Execution

  Adobe · Magento Commerce

  EPSS 3.6%
• Critical 9.1
  CVE-2021-21025 Magento Commerce XML Injection Could Lead To Arbitrary Code Execution

  Adobe · Magento Commerce

  EPSS 3.2%
• Critical 9.6
  CVE-2020-35125 Mautic is vulnerable to XSS vulnerability
  EPSS 2.7%

All 28 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.2
  CVE-2021-21311 SSRF in adminer

  vrana · adminer

  EPSS 98%
• High 7.2
  CVE-2020-27871 This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication i…

  SolarWinds · Orion Platform

  EPSS 91%
• High 8.6
  CVE-2021-21307 Remote Code Exploit in Lucee Admin

  lucee · Lucee

  EPSS 89%
• Medium 6.1
  CVE-2021-22881 Actionpack Open Redirect Vulnerability
  EPSS 87%
• High 8.8
  CVE-2021-21017 Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution

  Adobe · Acrobat Reader

  EPSS 86%
• Unscored
  CVE-2020-28871 Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.
  EPSS 86%
• Medium 4.8
  CVE-2021-21029 Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution

  Adobe · Magento Commerce

  EPSS 85%
• Medium 6.1
  CVE-2020-13947 Cross-site scripting (XSS) in Apache ActiveMQ
  EPSS 79%