Week 27, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2021-30116 Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
  EPSS 86%
• Critical 9.8
  CVE-2021-30117 Authenticated SQL injection in Kaseya VSA < v9.5.6
  EPSS 72%
• Critical 9.8
  CVE-2021-34621 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

  ProfilePress · ProfilePress

  EPSS 69%
• Critical 9.8
  CVE-2021-30118 Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5
  EPSS 60%
• Critical 9.8
  CVE-2021-28809 Missing Authentication for Critical Function in RTRR Server in HBS3

  QNAP Systems · HBS 3

  EPSS 16%
• Critical 9.8
  CVE-2021-34624 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component

  ProfilePress · ProfilePress

  EPSS 7.8%
• Critical 9.9
  CVE-2021-30120 2FA bypass in Kaseya VSA <= v9.5.6
  EPSS 5.7%
• Critical 9.8
  CVE-2021-34622 ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation

  ProfilePress · ProfilePress

  EPSS 4.9%
• Critical 9.8
  CVE-2021-25952 Prototype polluation in just-safe-set
  EPSS 3.3%
• Critical 9.8
  CVE-2021-32530 QSAN XEVO - Command Injection Following via Array function

  QSAN · XEVO

  EPSS 2.3%
• Critical 9.8
  CVE-2021-32529 QSAN XEVO, SANOS - Command Injection -1

  QSAN · XEVO · SANOS

  EPSS 2.3%
• Critical 9.8
  CVE-2021-32513 QSAN Storage Manager - Command Injection Following via QsanTorture function

  QSAN · Storage Manager

  EPSS 2.1%
• Critical 9.8
  CVE-2021-32512 QSAN Storage Manager - Command Injection Following via QuickInstall function

  QSAN · Storage Manager

  EPSS 2.1%
• Critical 9.8
  CVE-2021-34623 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component

  ProfilePress · ProfilePress

  EPSS 2.1%
• Critical 9.8
  CVE-2021-32531 QSAN XEVO - Command Injection Following via Init function

  QSAN · XEVO

  EPSS 2.1%

All 31 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.3
  CVE-2021-22555 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
  EPSS 79%
• Medium 5.4
  CVE-2021-30119 Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
  EPSS 59%
• Unscored
  CVE-2021-33221 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints.
  EPSS 56%
• High 7.5
  CVE-2021-30201 Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6
  EPSS 26%
• High 7.5
  CVE-2021-1585 Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability

  Cisco · Cisco Adaptive Security Appliance (ASA) Software

  EPSS 20%
• Unscored
  CVE-2020-24148 Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml acti…
  EPSS 14%
• Unscored
  CVE-2021-33216 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account.
  EPSS 14%
• Unscored
  CVE-2021-24405 Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting

  IZSoft · Easy Cookies Policy

  EPSS 11%