Week 14, 2021

5–11 April 2021

New CVEs: 348
Critical: 15
High: 39
Newly exploited: 0
Advisories: 78
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2021-20021 A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to th…
SonicWall · Email Security

EPSS 89%
Critical 9.3
CVE-2021-21425 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution
getgrav · grav-plugin-admin

EPSS 81%
Critical 9.9
CVE-2021-21433 Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation
DEMON1A · Discord-Recon

EPSS 3.3%
Critical 9.8
CVE-2021-1459 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 3.1%
Critical 9.8
CVE-2021-28173 Vangene deltaFlow E-platform - Arbitrary File Upload
Vangene · deltaFlow E-platform

EPSS 1.6%
Critical 9.8
CVE-2021-28171 Vangene deltaFlow E-platform - Broken Authentication
Vangene · deltaFlow E-platform

EPSS 1.2%
Critical 9.8
CVE-2021-30454 Uninitialized memory access in outer_cgi
EPSS 1.1%
Critical 9.8
CVE-2021-30455 Double-free in id-map
EPSS 1.1%
Critical 9.1
CVE-2021-30246 RSA signature validation vulnerability on maleable encoded message in jsrsasign
Critical 9.3
CVE-2020-13534 A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 a…
Critical 9.0
CVE-2021-25360 An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrary code on mediaextra…
Samsung Mobile · Samsung Mobile Devices
Critical 9.3
CVE-2020-13533 A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with …
Critical 9.3
CVE-2020-13532 A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be repla…
Critical 9.3
CVE-2020-11210 Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…
Qualcomm · Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Critical
GHSA-prmc-5v5w-c465 Client TLS credentials sent raw to server in npm package nats

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Unscored
CVE-2021-20080 Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unau…
EPSS 93%
Unscored
CVE-2021-24155 Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload
EPSS 84%
Medium 5.3
CVE-2021-1472 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 72%
Medium 5.3
CVE-2021-1473 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 64%
Unscored
CVE-2021-26709 D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device…
EPSS 40%
Unscored
CVE-2021-24209 WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)
EPSS 28%
Unscored
CVE-2020-17453 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
EPSS 26%
Unscored
CVE-2021-24175 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass
EPSS 17%

Advisories

DSA-4885-1 netty - security update 7 CVEs
DLA-2618-1 smarty3 - security update 4 CVEs
DLA-2619-1 python3.5 - security update 3 CVEs