Week 20, 2021

17–23 May 2021

New CVEs: 278
Critical: 4
High: 23
Newly exploited: 0
Advisories: 367
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2021-31474 This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authenticati…
SolarWinds · Network Performance Monitor

EPSS 94%
Critical 9.9
CVE-2021-33509 Incorrect Permission Assignment for Critical Resource in Plone
EPSS 2%
Critical 9.6
CVE-2021-32630 Various
Admidio · admidio

EPSS 1.6%
Critical 9.6
CVE-2021-32454 SITEL CAP/PRX hardcoded credentials
SITEL · CAP/PRX

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Unscored
CVE-2021-32305 WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.
EPSS 87%
Unscored
CVE-2021-31324 The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.
EPSS 35%
High 8.8
CVE-2021-1531 Cisco Modeling Labs Web UI Command Injection Vulnerability
Cisco · Cisco Modeling Labs

EPSS 30%
High 8.8
CVE-2021-3518 Nokogiri Implements libxml2 version vulnerable to use-after-free
EPSS 22%
Medium 6.5
CVE-2021-29622 Arbitrary redirects under /new endpoint
prometheus · prometheus

EPSS 20%
High 8.6
CVE-2021-3517 Nokogiri contains libxml Out-of-bounds Write vulnerability
EPSS 17%
Unscored
CVE-2020-35580 A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the op…
EPSS 14%
Unscored
CVE-2021-31316 The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
EPSS 13%

Advisories

openSUSE-SU-2021:0753-1 Security update for exim 30 CVEs
openSUSE-SU-2021:0754-1 Security update for exim 26 CVEs
VDE-2021-014 WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3 12 CVEs
USN-4963-1 pillow vulnerabilities 6 CVEs