Week 10, 2021

8–14 March 2021

New CVEs: 391
Critical: 16
High: 103
Newly exploited: 0
Advisories: 177
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.9
CVE-2021-21480 SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to …
SAP · SAP Manufacturing Integration and Intelligence

EPSS 52%
Critical 9.8
CVE-2021-26877 Windows DNS Server Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016

EPSS 17%
Critical 9.8
CVE-2021-26897 Windows DNS Server Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016

EPSS 12%
Critical 9.8
CVE-2021-26895 Windows DNS Server Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016

EPSS 7.8%
Critical 9.8
CVE-2021-26894 Windows DNS Server Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016

EPSS 7.8%
Critical 9.8
CVE-2021-26893 Windows DNS Server Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016

EPSS 7%
Critical 9.8
CVE-2021-27646 Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrar…
Synology · Synology DiskStation Manager (DSM)

EPSS 3.9%
Critical 9.8
CVE-2021-25915 Changeset vulnerable to prototype pollution
EPSS 3.5%
Critical 9.8
CVE-2021-20232 A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential conseque…
EPSS 3.4%
Critical 9.8
CVE-2021-27647 Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbi…
Synology · Synology DiskStation Manager (DSM)

EPSS 3.2%
Critical 9.9
CVE-2021-26867 Windows Hyper-V Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1909 · Windows Server, version 1909 (Server Core installation) · Windows Server version 20H2

EPSS 2.9%
Critical 9.8
CVE-2021-26569 Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to …
Synology · Synology DiskStation Manager (DSM)

EPSS 2.3%
Critical 9.8
CVE-2021-28305 Fix a use-after-free bug in diesels Sqlite backend
EPSS 1.3%
Critical 9.3
CVE-2021-27080 Azure Sphere Unsigned Code Execution Vulnerability
Microsoft · Azure Sphere

EPSS 1.3%
Critical 9.6
CVE-2021-21481 The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might all…
SAP · SAP NetWeaver AS JAVA (MigrationService)

All 16 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.0
CVE-2021-21300 malicious repositories can execute remote code while cloning
git · git

EPSS 89%
High 8.8
CVE-2021-26411 Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer 11 · Internet Explorer 9 · Microsoft Edge (EdgeHTML-based)

EPSS 82%
High 7.8
CVE-2021-27083 Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
Microsoft · Visual Studio Code Remote - Containers Extension

EPSS 62%
High 7.8
CVE-2021-27084 Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
Microsoft · Visual Studio Code - Java Extension Pack

EPSS 62%
Unscored
CVE-2021-28143 /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).
EPSS 47%
Unscored
CVE-2020-29045 The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_car…
EPSS 31%
High 8.8
CVE-2021-21166 Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Google · Chrome

EPSS 24%
High 8.8
CVE-2020-13936 Velocity Sandbox Bypass
Apache Software Foundation · Apache Velocity Engine

EPSS 23%

Advisories

USN-4763-1 pillow vulnerabilities 8 CVEs
USN-4754-3 python2.7, python3.7, python3.8 vulnerabilities 7 CVEs
VDE-2020-053 Pepperl+Fuchs: Comtrol RocketLinx ICRL-M - Multiple Vulnerabilities 3 CVEs
MSRC-CVE-2021-27074 Azure Sphere Unsigned Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-27080 Azure Sphere Unsigned Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-26867 Windows Hyper-V Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-26876 OpenType Font Parsing Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-26897 Windows DNS Server Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2021-26411 Internet Explorer Memory Corruption Vulnerability 1 CVEs
MSRC-CVE-2021-24089 HEVC Video Extensions Remote Code Execution Vulnerability 1 CVEs