Week 12, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.9
  CVE-2021-22192 An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on t…

  GitLab · GitLab

  EPSS 13%
• Critical 9.8
  CVE-2021-21783 A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote c…
  EPSS 5.3%
• Critical 9.3
  CVE-2021-21386 Improper Neutralization of Argument Delimiters in a Decompiling Package Process

  dwisiswant0 · apkleaks

  EPSS 2.3%
• Critical 9.8
  CVE-2021-28955 Arbitrary code execution due to an uncontrolled search path for the git binary
  EPSS 1.7%
• Critical 9.1
  CVE-2021-26715 Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server
  EPSS 1.5%
• Critical 9.9
  CVE-2021-1411 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities

  Cisco · Cisco Jabber

  EPSS 1.4%
• Critical 9.9
  CVE-2021-1471 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities

  Cisco · Cisco Jabber

  EPSS 1.4%
• Critical 9.8
  CVE-2021-23274 TIBCO API Exchange Gateway Clickjack Vulnerability

  TIBCO Software · TIBCO API Exchange Gateway · TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric

  EPSS 1.2%
• Critical 9.9
  CVE-2021-29068 Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.98, R6400v2 before 1.0.4.98, R7000 before…
  EPSS 1.1%
• Critical 9.9
  CVE-2021-1469 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities

  Cisco · Cisco Jabber

  EPSS 1.1%
• Critical 9.9
  CVE-2021-1417 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities

  Cisco · Cisco Jabber

• Critical 9.9
  CVE-2021-1418 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities

  Cisco · Cisco Jabber

• Critical 9.6
  CVE-2021-29077 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 befo…
• Critical 9.6
  CVE-2021-29078 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854…
• Critical 9.6
  CVE-2021-29076 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854…

All 22 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2021-26295 RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

  Apache Software Foundation · Apache OFBiz

  EPSS 98%
• Medium 5.4
  CVE-2021-25921 In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` s…
  EPSS 89%
• Medium 5.4
  CVE-2021-21351 XStream is vulnerable to an Arbitrary Code Execution attack

  x-stream · xstream

  EPSS 82%
• High 7.7
  CVE-2021-21402 Unauthenticated Arbitrary File Access in Jellyfin

  jellyfin · jellyfin

  EPSS 79%
• High 7.5
  CVE-2021-21341 XStream can cause a Denial of Service

  x-stream · xstream

  EPSS 78%
• Unscored
  CVE-2021-29156 ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character re…
  EPSS 77%
• Medium 6.1
  CVE-2021-21346 XStream is vulnerable to an Arbitrary Code Execution attack

  x-stream · xstream

  EPSS 76%
• Medium 5.3
  CVE-2021-21344 XStream is vulnerable to an Arbitrary Code Execution attack

  x-stream · xstream

  EPSS 76%