Week 22, 2021
31 May – 6 June 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-30180 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)EPSS 60%
- Critical 9.8 EPSS 4.1%
-
Critical 9.8
CVE-2017-20005 NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer …EPSS 3.3%
- Critical 9.8 EPSS 3%
-
Critical 10.0
CVE-2020-4561 IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access …EPSS 2.9%
- Critical 9.1 EPSS 2.9%
- Critical 9.1 EPSS 2.4%
- Critical 9.8 EPSS 2.3%
- Critical 9.6 EPSS 2.2%
-
Critical 9.8
CVE-2021-29089 Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.…EPSS 1.9%
- Critical 9.8 EPSS 1.9%
- Critical 9.0 EPSS 1.9%
-
Critical 9.0
CVE-2021-29665 IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a local attacker to execu…EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2021-31643 An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization …EPSS 88%
-
High 7.6
CVE-2021-22123 An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated…EPSS 84%
-
Unscored
CVE-2021-31250 Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitiza…EPSS 80%
- Unscored EPSS 67%
-
Unscored
CVE-2021-23017 A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory ov…EPSS 53%
-
Unscored
CVE-2021-31642 A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, a…EPSS 44%
-
Unscored
CVE-2021-31251 An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileg…EPSS 36%
-
Unscored
CVE-2021-31252 An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploi…EPSS 29%
Advisories
- SUSE / openSUSE Security Updates 57
- Ubuntu Security Notices (USN) 13
- Debian Security (DSA / DLA) 11
- Oracle Linux Security Advisories (ELSA) 92 critical
- Rocky Linux Security Advisories 5
- BSI CERT-Bund (WID) 4
- AlmaLinux Security Advisories 2
- CISA ICS & IT advisories 21 critical
- ICSA-21-154-01 Advantech iView 2 CVEs
- ELSA-2021-2233 Critical: firefox security update (Oracle Linux 8) 1 CVEs
- ELSA-2021-2206 Critical: firefox security update (Oracle Linux 7) 1 CVEs