Week 25, 2021
21–27 June 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.9 EPSS 4.6%
- Critical 9.8 EPSS 3.5%
-
Critical 9.8
CVE-2021-27649 Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute …EPSS 2%
- Critical EPSS 1.8%
- Critical 9.9 EPSS 1.6%
- Critical 9.8 EPSS 1.4%
- Critical 9.1 EPSS 1.4%
- Critical 9.8 EPSS 1.3%
- Critical 9.1
- Critical
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2021-28958 Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.EPSS 73%
-
Unscored
CVE-2021-34427 In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir)…EPSS 58%
- Unscored EPSS 47%
-
Unscored
CVE-2021-31586 Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.EPSS 44%
-
High 8.2
CVE-2021-21809 Moodle command execution vulnerability exists in the default legacy spellchecker pluginEPSS 24%
-
Unscored
CVE-2021-21998 VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the…EPSS 11%
-
Unscored
CVE-2021-28976 Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.EPSS 7.5%
-
Unscored
CVE-2021-34074 PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path…EPSS 7.5%
Advisories
- SUSE / openSUSE Security Updates 587 critical
- Ubuntu Security Notices (USN) 15
- CERT@VDE 71 critical
- CISA ICS & IT advisories 62 critical
- BSI CERT-Bund (WID) 5
- Debian Security (DSA / DLA) 5
- Amazon Linux Security Center (ALAS) 1
- SICK PSIRT 1
- openSUSE-SU-2021:0899-1 Security update for salt 7 CVEs
- SUSE-SU-2021:2106-1 Security update for salt 7 CVEs
- SUSE-SU-2021:2105-1 Security update for salt 7 CVEs
- ICSA-21-173-02 CODESYS V2 web server 6 CVEs
- ICSA-21-173-03 CODESYS Control V2 communication 3 CVEs
- SUSE-SU-2021:2104-1 Security update for Salt 2 CVEs
- openSUSE-SU-2021:0907-1 Security update for cryptctl 1 CVEs
- VDE-2021-021 PHOENIX CONTACT: Security Advisory for AXL F BK and IL BK products 1 CVEs
- SUSE-SU-2021:2137-1 Security update for cryptctl 1 CVEs
- SUSE-SU-2021:2136-1 Security update for cryptctl 1 CVEs