Week 29, 2021

19–25 July 2021

New CVEs: 465
Critical: 17
High: 81
Newly exploited: 0
Advisories: 154
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2021-35464 ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require …
EPSS 100%
Critical 9.8
CVE-2021-2456 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). The supported vers…
Oracle · Business Intelligence Enterprise Edition

EPSS 81%
Critical 9.8
CVE-2021-2394 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…
Oracle · WebLogic Server

EPSS 76%
Critical 10.0
CVE-2020-7388 Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing
Sage · X3

EPSS 69%
Critical 9.1
CVE-2021-35942 The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an u…
EPSS 2.8%
Critical 9.8
CVE-2021-35963 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type
Learningdigital.com · Orca HCM

EPSS 2.4%
Critical 9.8
CVE-2021-35965 Learningdigital.com, Inc. Orca HCM - Hard-code password
Learningdigital.com · Orca HCM

EPSS 2.4%
Critical 9.1
CVE-2020-5322 Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated malicious user with …
Dell · Dell OpenManage Enterprise Modular

EPSS 2.3%
Critical 9.8
CVE-2021-2382 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 10.3.6.0.0, 12.…
Oracle · WebLogic Server

EPSS 1.8%
Critical 9.8
CVE-2021-2397 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…
Oracle · WebLogic Server

EPSS 1.6%
Critical 9.8
CVE-2021-2463 Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11…
Oracle · Commerce Platform

EPSS 1.6%
Critical 9.6
CVE-2021-2446 Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily e…
Oracle · Secure Global Desktop

EPSS 1.6%
Critical 9.1
CVE-2021-2355 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1…
Oracle · Marketing

EPSS 1.4%
Critical 9.8
CVE-2020-5349 Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential vulnerability. A remote unauthenticated …
Dell · Networking

EPSS 1.2%
Critical 9.9
CVE-2021-2447 Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily e…
Oracle · Secure Global Desktop

EPSS 1.1%

All 17 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

DLA-2716-1 pillow - security update 5 CVEs
VDE-2021-017 MB connect line: Privilege escalation in mbDIALUP 2 CVEs
DLA-2719-1 ruby-actionpack-page-caching - security update 1 CVEs