Week 23, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2021-32671 XSS vulnerability with translator

  flarum · core

  EPSS 40%
• Critical 9.4
  CVE-2021-31962 Kerberos AppContainer Security Feature Bypass Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 3.8%
• Critical 9.8
  CVE-2021-25949 set-getter Prototype Pollution Vulnerability
  EPSS 3.3%
• Critical 9.8
  CVE-2021-25948 Prototype Pollution
  EPSS 3.3%
• Critical 9.8
  CVE-2021-22765 A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause …
  EPSS 2.8%
• Critical 9.8
  CVE-2021-22768 A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause …
  EPSS 2.8%
• Critical 9.8
  CVE-2021-22767 A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause …
  EPSS 2.8%
• Critical 10.0
  CVE-2021-26472 Unauthenticated remote command execution with SYSTEM privileges in Vembu products
  EPSS 2.5%
• Critical 9.8
  CVE-2021-26471 Unauthenticated remote command execution in Vembu products
  EPSS 2.3%
• Critical 10.0
  CVE-2021-33841 Circutor SGE-PLC1000 OS command Injection

  Circutor · SGE-PLC1000

  EPSS 2.2%
• Critical 9.8
  CVE-2021-3013 OS command injection in ripgrep
  EPSS 1.9%
• Critical 9.8
  CVE-2021-22763 A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLog…
  EPSS 1.9%
• Critical 9.1
  CVE-2021-34363 The Fuck Arbitrary File Deletion via Path Traversal
  EPSS 1.8%
• Critical 9.8
  CVE-2021-26473 Unauthenticated arbitrary file upload and command execution in Vembu products
  EPSS 1.8%
• Critical 9.0
  CVE-2021-27635 SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a…

  SAP · SAP NetWeaver AS for JAVA

  EPSS 1.6%

All 29 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.8
  CVE-2021-1675 Windows Print Spooler Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 85%
• Medium 5.5
  CVE-2021-31955 Windows Kernel Information Disclosure Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 81%
• Medium 5.3
  CVE-2021-28169 Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

  The Eclipse Foundation · Eclipse Jetty

  EPSS 78%
• Unscored
  CVE-2021-26691 Apache HTTP Server mod_session response handling heap overflow

  Apache Software Foundation · Apache HTTP Server

  EPSS 68%
• Unscored
  CVE-2021-26690 mod_session NULL pointer dereference

  Apache Software Foundation · Apache HTTP Server

  EPSS 65%
• Unscored
  CVE-2021-22901 curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over …
  EPSS 64%
• Unscored
  CVE-2019-17567 mod_proxy_wstunnel tunneling of non Upgraded connections

  Apache Software Foundation · Apache HTTP Server

  EPSS 60%
• High 7.5
  CVE-2021-33742 Windows MSHTML Platform Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows 10 Version 1809 · Windows Server 2016

  EPSS 59%