Week 36, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-40539 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
  EPSS 99%
• Critical 9.8
  CVE-2021-38540 Apache Airflow: Variable Import endpoint missed authentication check

  Apache Software Foundation · Apache Airflow

  EPSS 81%
• Critical 9.1
  CVE-2020-11264 Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdra…

  Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

  EPSS 13%
• Critical 9.1
  CVE-2020-11301 Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Comput…

  Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

  EPSS 11%
• Critical 9.8
  CVE-2021-37579 Bypass deserialization checks in Apache Dubbo

  Apache Software Foundation · Apache Dubbo

  EPSS 6.6%
• Critical 9.8
  CVE-2021-40146 A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java

  Apache Software Foundation · Apache Any23

  EPSS 5.7%
• Critical 9.8
  CVE-2021-36440 Unrestricted File Upload in ShowDoc v2.9.5
  EPSS 4.8%
• Critical 9.8
  CVE-2021-36163 Unsafe deserialization in providers using the Hessian protocol

  Apache Software Foundation · Apache Dubbo

  EPSS 3.3%
• Critical 9.1
  CVE-2021-38555 An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java

  Apache Software Foundation · Apache Any23

  EPSS 2.8%
• Critical 9.3
  CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server

  Nextcloud · security-advisories

  EPSS 2.6%
• Critical 9.8
  CVE-2021-36161 Unprotected input value toString cause RCE

  Apache Software Foundation · Apache Dubbo

  EPSS 2.5%
• Critical 9.9
  CVE-2021-32724 check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack

  check-spelling · check-spelling

  EPSS 2.3%
• Critical 9.8
  CVE-2021-34346 Stack Based Overflow Vulnerability in NVR Storage Expansion

  QNAP Systems · NVR Storage Expansion

  EPSS 1.6%
• Critical 9.8
  CVE-2021-34345 Stack Based Overflow Vulnerability in NVR Storage Expansion

  QNAP Systems · NVR Storage Expansion

  EPSS 1.6%
• Critical 9.8
  CVE-2021-34344 Stack Buffer Overflow Vulnerability in QUSBCam2

  QNAP Systems · QUSBCam2

  EPSS 1.6%

All 27 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.9
  CVE-2021-35217 Insecure Deserialization of untrusted data causing Remote code execution vulnerability.

  SolarWinds · Orion Platform

  EPSS 73%
• Medium 5.5
  CVE-2021-30657 A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious applicati…

  Apple · macOS

  EPSS 69%
• Unscored
  CVE-2021-40346 An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker…
  EPSS 59%
• Unscored
  CVE-2021-40531 Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine ext…
  EPSS 33%
• Unscored
  CVE-2021-30721 A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 202…

  Apple · macOS

  EPSS 24%
• High 8.4
  CVE-2021-24040 Deserialization of Untrusted Data in parlai

  Facebook · ParlAI

  EPSS 17%
• Unscored
  CVE-2021-38408 A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied…
  EPSS 12%
• High 8.8
  CVE-2021-30762 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to…

  Apple · iOS

  EPSS 11%