Week 19, 2021
10–16 May 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-31166 HTTP Protocol Stack Remote Code Execution VulnerabilityEPSS 100%
Microsoft · Windows 10 Version 20H2 · Windows Server version 20H2 · Windows 10 Version 2004
-
Critical 10.0
CVE-2021-28799 Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)EPSS 78%
QNAP Systems · HBS 3 · HBS 2 · HBS 1.3
-
Critical 9.9
CVE-2021-28476 Windows Hyper-V Remote Code Execution VulnerabilityEPSS 39%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
- Critical 9.8 EPSS 7.3%
- Critical 9.8 EPSS 3.3%
- Critical 9.8 EPSS 3.3%
-
Critical 9.8
CVE-2021-27384 A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI C…EPSS 2.6%
Siemens · SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) · SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) · SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F
- Critical 9.1 EPSS 1.6%
- Critical 10.0 EPSS 1.1%
- Critical 9.4
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Medium 6.6
CVE-2021-31207 Microsoft Exchange Server Security Feature Bypass VulnerabilityEPSS 100%
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19
-
Medium 5.3
CVE-2020-36289 Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the …EPSS 99%
-
Medium 6.5
CVE-2021-31195 Microsoft Exchange Server Remote Code Execution VulnerabilityEPSS 74%
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19
- Medium 5.4 EPSS 73%
- High 8.0 EPSS 58%
-
High 8.8
CVE-2021-27068 Visual Studio Remote Code Execution VulnerabilityEPSS 54%
Microsoft · Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) · Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
-
High 7.8
CVE-2021-31213 Visual Studio Code Remote Containers Extension Remote Code Execution VulnerabilityEPSS 53%
Microsoft · Visual Studio Code Remote - Containers Extension
-
High 8.8
CVE-2021-28474 Microsoft SharePoint Server Remote Code Execution VulnerabilityEPSS 51%
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Foundation 2013 Service Pack 1
Advisories
- SUSE / openSUSE Security Updates 41
- CISA ICS & IT advisories 204 critical
- Ubuntu Security Notices (USN) 162 critical
- Debian Security (DSA / DLA) 141 critical
- Siemens ProductCERT 144 critical
- BSI CERT-Bund (WID) 8
- Schneider Electric CPCERT 41 critical
- Oracle Linux Security Advisories (ELSA) 3
- CERT@VDE 1
- SSA-723417 SSA-723417: Multiple Vulnerabilities in SCALANCE W1750D 21 CVEs
- ICSA-21-131-14 Siemens SCALANCE W1750D (Update B) 21 CVEs
- ICSA-21-131-04 Siemens SINAMICS Medium Voltage Products Remote Access (Update B) 14 CVEs
- SSA-286838 SSA-286838: Multiple Vulnerabilities in SINAMICS Medium Voltage Products 14 CVEs
- SSA-940818 SSA-940818: UltraVNC Vulnerabilities in SIMATIC HMIs/WinCC Products 10 CVEs
- ICSA-21-131-11 Siemens SIMATIC UltraVNC HMI WinCC Products 10 CVEs
- SSA-538778 SSA-538778: SmartVNC Vulnerabilities in SIMATIC HMI/WinCC Products 7 CVEs
- ICSA-21-131-12 Siemens SIMATIC SmartVNC HMI WinCC Products (Update B) 7 CVEs
- USN-4939-1 webkit2gtk vulnerabilities 3 CVEs
- DLA-2660-1 libgetdata - security update 1 CVEs