Week 7, 2021
15–21 February 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-27104 Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380…EPSS 46%
-
Critical 9.8
CVE-2021-27103 Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.EPSS 8.2%
-
Critical 9.8
CVE-2021-27101 Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380…EPSS 4.3%
- Critical 9.1 EPSS 2.6%
- Critical 9.8 EPSS 2.1%
- Critical 9.8 EPSS 1.5%
-
Critical 9.0
CVE-2020-29026 A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions…EPSS 1.5%
- Critical 9.8 EPSS 1.5%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.3%
- Critical 9.0 EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2021-25299 Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to im…EPSS 98%
- High 7.1 EPSS 91%
-
High 8.8
CVE-2021-25298 Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/c…EPSS 74%
-
High 8.8
CVE-2021-25296 Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi…EPSS 72%
-
High 8.1
CVE-2020-8625 A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 65%
-
High 8.8
CVE-2021-25297 Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/swi…EPSS 57%
-
Unscored
CVE-2021-26747 Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.EPSS 55%
- High 7.5 EPSS 51%
Advisories
- SUSE / openSUSE Security Updates 411 critical
- Debian Security (DSA / DLA) 26
- AlmaLinux Security Advisories 21
- Oracle Linux Security Advisories (ELSA) 17
- Amazon Linux Security Center (ALAS) 13
- Rocky Linux Security Advisories 7
- Ubuntu Security Notices (USN) 72 critical
- BSI CERT-Bund (WID) 5
- CISA ICS & IT advisories 4
- CERT@VDE 21 critical
- USN-4741-1 libjackson-json-java vulnerabilities 3 CVEs
- SUSE-SU-2021:0529-1 Security update for python3 2 CVEs
- USN-4740-1 shiro vulnerabilities 2 CVEs
- VDE-2020-050 Pepperl+Fuchs: Multiple Products - Vulnerability may allow remote attackers to cause a Denial Of Service 1 CVEs