Week 15, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical
  CVE-2021-27850 Bypass of the fix for CVE-2019-0195

  Apache Software Foundation · Apache Tapestry

  EPSS 94%
• Critical 9.8
  CVE-2021-28480 Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19

  EPSS 71%
• Critical 9.8
  CVE-2021-28481 Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 19 · Microsoft Exchange Server 2019 Cumulative Update 8

  EPSS 36%
• Critical 9.8
  CVE-2020-2509 Command Injection Vulnerability in QTS and QuTS hero

  QNAP Systems · QTS · QuTS hero

  EPSS 34%
• Critical 9.8
  CVE-2021-28797 Stack Buffer Overflow in Surveillance Station

  QNAP Systems · Surveillance Station

  EPSS 5.9%
• Critical 9.1
  CVE-2021-29943 Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections

  Apache Software Foundation · Apache Solr

  EPSS 4.7%
• Critical 9.1
  CVE-2021-26830 SQL Injection in tribalsystems/zenario
  EPSS 4.6%
• Critical 9.8
  CVE-2021-27258 This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. Authentication is not …

  SolarWinds · Orion Platform

  EPSS 4.1%
• Critical 9.8
  CVE-2021-21524 Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker…

  Dell · Dell EMC Storage Monitoring and Reporting

  EPSS 3.6%
• Critical 9.8
  CVE-2021-23377 Arbitrary Command Injection
  EPSS 3%
• Critical 10.0
  CVE-2020-27227 An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the s…
  EPSS 2.9%
• Critical 10.0
  CVE-2021-23281 Remote Code execution

  Eaton · Intelligent Power manager (IPM)

  EPSS 2.3%
• Critical 9.9
  CVE-2021-27602 SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to dr…

  SAP · SAP Commerce

  EPSS 2.1%
• Critical 9.8
  CVE-2021-23376 Arbitrary Command Injection
  EPSS 2%
• Critical 9.8
  CVE-2021-23378 Arbitrary Command Injection
  EPSS 1.9%

All 24 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2021-26812 Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious U…
  EPSS 97%
• High 7.1
  CVE-2021-27905 SSRF vulnerability with the Replication handler

  Apache Software Foundation · Apache Solr

  EPSS 93%
• High 7.1
  CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8

  WordPress · wordpress-develop

  EPSS 86%
• High 8.8
  CVE-2021-28482 Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19

  EPSS 83%
• Unscored
  CVE-2021-26030 [20210401] - Core - Escape xss in logo parameter error pages

  Joomla! Project · Joomla! CMS

  EPSS 83%
• Medium 6.5
  CVE-2021-27250 This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access poi…

  D-Link · DAP-2020

  EPSS 67%
• Medium 6.5
  CVE-2021-28325 Windows SMB Information Disclosure Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 64%
• Unscored
  CVE-2021-3017 The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspasswo…
  EPSS 63%