Week 30, 2021
26 July – 1 August 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-36239 Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Ji…EPSS 50%
Atlassian · Jira Data Center · Jira Service Management Data Center · Jira Software Data Center
-
Critical 9.8
CVE-2020-5341 Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protectio…EPSS 4.3%
- Critical 9.8 EPSS 4.1%
-
Critical 9.8
CVE-2021-29781 IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending …EPSS 2.9%
- Critical 9.8 EPSS 2.5%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.6%
-
Critical 9.6
CVE-2021-21538 Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker cou…EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2021-35478 Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are a…EPSS 77%
- High 7.1 EPSS 73%
-
Unscored
CVE-2021-36754 PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exc…EPSS 65%
- High 7.5 EPSS 58%
- High 7.5 EPSS 17%
-
Unscored
CVE-2021-35479 Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. Th…EPSS 13%
-
Unscored
CVE-2021-32558 An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before…EPSS 9.2%
-
Unscored
CVE-2021-20114 When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which include…EPSS 6%
Advisories
- SUSE / openSUSE Security Updates 272 critical
- Debian Security (DSA / DLA) 10
- Ubuntu Security Notices (USN) 9
- CISA ICS & IT advisories 63 critical
- BSI CERT-Bund (WID) 5
- Oracle Linux Security Advisories (ELSA) 2
- CERT@VDE 1
- Rocky Linux Security Advisories 1
- Schneider Electric CPCERT 1
- SUSE-SU-2021:2554-1 Security update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema 16 CVEs
- ICSA-21-208-03 Geutebrück G-Cam E2 and G-Code 12 CVEs
- SUSE-SU-2021:2480-1 Security update for glibc 2 CVEs
- ICSA-21-208-01 KUKA KR C4 2 CVEs
- ICSA-21-208-04 LCDS LAquis SCADA 1 CVEs