Week 24, 2021

14–20 June 2021

New CVEs: 251
Critical: 9
High: 56
Newly exploited: 0
Advisories: 113
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2021-32682 Multiple vulnerabilities leading to RCE
Studio-42 · elFinder

EPSS 68%
Critical 9.8
CVE-2021-21669 XXE vulnerability in Jenkins Generic Webhook Trigger Plugin
Jenkins Project · Jenkins Generic Webhook Trigger Plugin

EPSS 26%
Critical 9.8
CVE-2020-9493 Java deserialization in Chainsaw
Apache Software Foundation · Apache Chainsaw

EPSS 4.6%
Critical 9.9
CVE-2021-34809 Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station bef…
Synology · Download Station

EPSS 1.9%
Critical 9.8
CVE-2021-24037 Use After Free in Hermes
Facebook · Hermes

EPSS 1.8%
Critical 9.8
CVE-2021-3604 Primion-Digitek Secure 8 SQL injection vulnerability
PRIMION DIGITEK · Secure 8 (Evalos)

EPSS 1.6%
Critical 9.9
CVE-2021-34810 Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbit…
Synology · Download Station

EPSS 1.4%
Critical 9.0
CVE-2021-27610 SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal …
SAP · SAP NetWeaver AS ABAP and ABAP Platform

EPSS 1.3%
Critical 9.8
CVE-2021-32685 Improper Verification of Cryptographic Signature in tenvoy
TogaTech · tEnvoy

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 5.4
CVE-2021-21668 Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Project · Jenkins Scriptler Plugin

EPSS 76%
Medium 5.4
CVE-2021-21667 Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Project · Jenkins Scriptler Plugin

EPSS 76%
High 8.8
CVE-2021-30551 Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Google · Chrome

EPSS 65%
Unscored
CVE-2021-24347 SP Project & Document Manager <2 4.22 - Authenticated Shell Upload
EPSS 54%
Unscored
CVE-2021-31618 NULL pointer dereference on specially crafted HTTP/2 request
Apache Software Foundation · Apache HTTP Server

EPSS 52%
Unscored
CVE-2021-20093 A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap …
EPSS 33%
High 7.5
CVE-2021-33813 XML External Entity (XXE) Injection in JDOM
EPSS 19%
Unscored
CVE-2021-31159 Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password fun…
EPSS 18%

Advisories

SUSE-SU-2021:1990-1 Security update for webkit2gtk3 17 CVEs
USN-4991-1 libxml2 vulnerabilities 8 CVEs
ICSA-21-166-02 Automation Direct CLICK PLC CPU Modules 5 CVEs
DLA-2686-1 python-urllib3 - security update 4 CVEs
ICSA-21-166-01 ThroughTek P2P SDK 1 CVEs