Week 11, 2021
15–21 March 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 3.8%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 3.2%
- Critical 9.8 EPSS 3%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.3%
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2021-24145 Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCEEPSS 88%
- High 8.2 EPSS 83%
- Unscored EPSS 40%
-
Unscored
CVE-2021-27928 A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server t…EPSS 38%
- Unscored EPSS 31%
-
Unscored
CVE-2021-28133 Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the p…EPSS 20%
-
Unscored
CVE-2021-28295 Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information…EPSS 16%
-
Unscored
CVE-2021-28419 The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databas…EPSS 11%
Advisories
- Ubuntu Security Notices (USN) 10510 critical
- SUSE / openSUSE Security Updates 532 critical
- Debian Security (DSA / DLA) 11
- Oracle Linux Security Advisories (ELSA) 10
- Amazon Linux Security Center (ALAS) 8
- CISA ICS & IT advisories 62 critical
- BSI CERT-Bund (WID) 5
- USN-4813-1 jackson-databind vulnerabilities 39 CVEs
- USN-4843-1 phpmyadmin vulnerabilities 21 CVEs
- ICSA-21-075-02 GE UR Family (Update A) 10 CVEs
- USN-4769-1 salt vulnerabilities 8 CVEs
- ICSA-21-077-03 Hitachi ABB Power Grids eSOMS Telerik 7 CVEs
- USN-4773-1 drupal7 vulnerabilities 5 CVEs
- USN-4853-1 liblivemedia vulnerabilities 4 CVEs
- USN-4875-1 opensmtpd vulnerabilities 3 CVEs
- USN-5102-2 mercurial vulnerabilities 2 CVEs
- openSUSE-SU-2021:0450-1 Security update for froxlor 1 CVEs