Week 28, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 19 · Microsoft Exchange Server 2019 Cumulative Update 8

  EPSS 100%
• Critical 9.0
  CVE-2021-34523 Microsoft Exchange Server Elevation of Privilege Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19

  EPSS 100%
• Critical 9.0
  CVE-2021-35211 Serv-U Remote Memory Escape Vulnerability

  SolarWinds · Serv-U Managed File Transfer Server and Serv-U Secured FTP

  EPSS 91%
• Critical 9.6
  CVE-2021-21801 This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack…
  EPSS 59%
• Critical 9.6
  CVE-2021-21800 Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially c…
  EPSS 14%
• Critical 9.6
  CVE-2021-21799 Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a speciall…
  EPSS 12%
• Critical 9.6
  CVE-2021-21802 This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack…
  EPSS 9.9%
• Critical 9.6
  CVE-2021-21803 This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack…
  EPSS 7.9%
• Critical 9.8
  CVE-2021-23389 Arbitrary Code Execution
  EPSS 3.6%
• Critical 9.8
  CVE-2021-34552 Buffer Overflow in Pillow
  EPSS 3.2%
• Critical 9.8
  CVE-2021-1965 Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna…

  Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

  EPSS 3%
• Critical 9.8
  CVE-2021-23390 Arbitrary Code Execution
  EPSS 3%
• Critical 10.0
  CVE-2021-21820 A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lea…
  EPSS 3%
• Critical 9.8
  CVE-2021-25953 Prototype Pollution in putil-merge
  EPSS 3%
• Critical 9.1
  CVE-2021-21819 A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to …
  EPSS 2.9%

All 21 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.3
  CVE-2021-34429 Encoded URIs can access WEB-INF directory in Eclipse Jetty

  The Eclipse Foundation · Eclipse Jetty

  EPSS 99%
• High 7.3
  CVE-2021-33766 Microsoft Exchange Server Information Disclosure Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19

  EPSS 98%
• Medium 5.3
  CVE-2021-33037 Incorrect Transfer-Encoding handling with HTTP/1.0

  Apache Software Foundation · Apache Tomcat

  EPSS 75%
• Unscored
  CVE-2021-35064 KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, inc…
  EPSS 71%
• High 7.2
  CVE-2021-31196 Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 21 · Microsoft Exchange Server 2019 Cumulative Update 10

  EPSS 54%
• Medium 5.4
  CVE-2021-28114 Cross-site Scripting in Froala WYSIWYG Editor
  EPSS 52%
• High 7.8
  CVE-2021-34501 Microsoft Excel Remote Code Execution Vulnerability

  Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Excel 2016

  EPSS 52%
• High 8.8
  CVE-2021-34481 Windows Print Spooler Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 48%