Week 13, 2021
29 March – 4 April 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-22986 On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x …EPSS 100%
-
Critical 9.8
CVE-2021-21975 Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Op…EPSS 78%
- Critical 9.8 EPSS 75%
-
Critical 9.8
CVE-2021-22991 On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed reques…EPSS 62%
- Critical 9.1 EPSS 15%
-
Critical 9.8
CVE-2021-27274 This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Authentic…EPSS 8.5%
-
Critical 9.8
CVE-2021-1870 A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 …EPSS 7.7%
Apple · macOS · iOS and iPadOS
-
Critical 9.8
CVE-2021-1871 A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 …EPSS 7%
Apple · macOS · iOS and iPadOS
- Critical 9.8 EPSS 3.8%
-
Critical 9.6
CVE-2021-22201 An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.EPSS 3.1%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
-
Critical 9.8
CVE-2021-21776 An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed fi…EPSS 1.4%
-
Critical 9.8
CVE-2021-21782 An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed fi…EPSS 1.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 5.3 EPSS 82%
- Medium 5.4 EPSS 79%
-
High 7.1
CVE-2021-27272 This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although …EPSS 75%
-
High 8.3
CVE-2021-27275 This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Ma…EPSS 74%
-
High 7.1
CVE-2021-27276 This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although …EPSS 73%
- Medium 5.4 EPSS 69%
-
Unscored
CVE-2021-21983 Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network acc…EPSS 69%
-
Unscored
CVE-2021-22992 On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6…EPSS 68%
Advisories
- SUSE / openSUSE Security Updates 241 critical
- Debian Security (DSA / DLA) 13
- Ubuntu Security Notices (USN) 92 critical
- BSI CERT-Bund (WID) 5
- Oracle Linux Security Advisories (ELSA) 4
- CISA ICS & IT advisories 11 critical
- Amazon Linux Security Center (ALAS) 1
- Rocky Linux Security Advisories 1
- ICSA-21-091-01 Rockwell Automation FactoryTalk AssetCentre 9 CVEs
- USN-4894-1 webkit2gtk vulnerabilities 7 CVEs
- SUSE-RU-2021:0985-1 Recommended update for the Azure SDK and CLI 2 CVEs
- USN-4895-1 squid, squid3 vulnerabilities 2 CVEs