Week 33, 2021

16–22 August 2021

New CVEs: 394
Critical: 12
High: 80
Newly exploited: 0
Advisories: 121
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2021-35394 Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affe…
EPSS 100%
Critical 9.8
CVE-2021-35395 Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two …
EPSS 98%
Critical 9.8
CVE-2021-34730 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 19%
Critical 9.8
CVE-2021-32588 A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may…
Fortinet · Fortinet FortiPortal

EPSS 3.3%
Critical 9.6
CVE-2021-32829 Post-authentication Remote Code Execution (RCE) in ZStack REST API
zstackio · zstack

EPSS 2.9%
Critical 9.8
CVE-2020-18704 Unrestricted Upload of File with Dangerous Type in django-widgy
EPSS 2.9%
Critical 9.8
CVE-2020-18705 Improper Restriction of XML External Entity Reference in Quokka
EPSS 2.8%
Critical 9.8
CVE-2020-18703 Improper Restriction of XML External Entity Reference in Quokka
EPSS 2.8%
Critical 9.8
CVE-2020-18698 Lin-CMS-Flask vulnerable to Improper Authentication
EPSS 2.1%
Critical 9.8
CVE-2020-36474 SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
EPSS 1.8%
Critical 9.0
CVE-2021-22156 An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP)…
BlackBerry · QNX Software Development Platform (SDP), QNX OS for Medical and QNX OS for Safety

EPSS 1.8%
Critical 9.4
CVE-2021-3616 A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content an…
Lenovo · Smart Camera X3, X5, and C2E firmware

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 5.3
CVE-2021-26086 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/w…
Atlassian · Jira Server · Jira Data Center

EPSS 100%
Unscored
CVE-2021-35392 Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named…
EPSS 82%
Medium 6.8
CVE-2021-22238 An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.
GitLab · GitLab

EPSS 72%
Unscored
CVE-2021-35393 Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named…
EPSS 66%
High 7.8
CVE-2021-28639 Adobe Acrobat Reader DC setAction Use-After-Free Remote Code Execution Vulnerability
Adobe · Acrobat Reader

EPSS 66%
High 7.3
CVE-2021-28640 Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution Vulnerability
Adobe · Acrobat Reader

EPSS 53%
High 7.8
CVE-2021-28635 Adobe Acrobat Reader Use-After-Free Vulnerability
Adobe · Acrobat Reader

EPSS 51%
Unscored
CVE-2021-33193 Request splitting via HTTP/2 method injection and mod_proxy
Apache Software Foundation · Apache HTTP Server

EPSS 46%

Advisories

VDE-2021-028 Pepperl+Fuchs: Multiple VDM100-Distance Ethernet-IP sensors with multiple vulnerabilities 19 CVEs
ICSA-21-229-01 ThroughTek Kalay P2P SDK 1 CVEs