Week 37, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.0
  CVE-2021-40438 mod_proxy SSRF

  Apache Software Foundation · Apache HTTP Server

  EPSS 100%
• Critical 9.8
  CVE-2021-33044 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by …
  EPSS 100%
• Critical 9.8
  CVE-2021-38647 Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

  Microsoft · Azure Stack Hub · Open Management Infrastructure · Azure Automation Update Management

  EPSS 100%
• Critical 9.8
  CVE-2021-33045 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by …
  EPSS 100%
• Critical 9.8
  CVE-2021-40870 An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unaut…
  EPSS 93%
• Critical 9.8
  CVE-2021-33543 UDP Technology/Geutebrück camera devices: Authentication Bypass

  Geutebrück · E2 Series · Encoder G-Code

  EPSS 81%
• Critical 9.8
  CVE-2021-41303 Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass

  Apache Software Foundation · Apache Shiro

  EPSS 76%
• Critical 9.9
  CVE-2021-33690 Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.2…

  SAP · SAP NetWeaver Development Infrastructure (Component Build Service)

  EPSS 69%
• Critical 9.9
  CVE-2021-38163 SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can uploa…

  SAP · SAP NetWeaver (Visual Composer 7.0 RT)

  EPSS 37%
• Critical 9.8
  CVE-2021-27391 A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE…

  Siemens · APOGEE PXC Compact (BACnet) · APOGEE PXC Modular (BACnet) · TALON TC Compact (BACnet)

  EPSS 3.4%
• Critical 9.9
  CVE-2021-37531 SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative au…

  SAP · SAP NetWeaver Knowledge Management XML Forms

  EPSS 3.2%
• Critical 9.8
  CVE-2021-37913 HGiga OAKlouds - Command Injection-2

  HGiga · OAKlouds OAKSv3 · OAKlouds OAKSv2

  EPSS 2.8%
• Critical 9.8
  CVE-2021-37912 HGiga OAKlouds - Command Injection-1

  HGiga · OAKlouds OAKSv3 · OAKlouds OAKSv2

  EPSS 2.8%
• Critical 9.1
  CVE-2021-33701 DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCOR…

  SAP · SAP S/4HANA · DMIS Mobile Plug-In

  EPSS 2.1%
• Critical 9.8
  CVE-2021-37909 CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation

  Changing · TSSServiSignAdapter

  EPSS 2%

All 26 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2021-40444 Microsoft MSHTML Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 98%
• High 7.2
  CVE-2021-33544 UDP Technology/Geutebrück camera devices: command injection leading to RCE

  Geutebrück · E2 Series · Encoder G-Code

  EPSS 96%
• Unscored
  CVE-2021-38156 In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
  EPSS 93%
• High 7.8
  CVE-2021-38406 Delta Electronics DOPSoft 2 Out-of-Bounds Write

  Delta Electronics · DOPSoft 2

  EPSS 76%
• Medium 5.3
  CVE-2021-39327 BulletProof Security <= 5.1 Sensitive Information Disclosure

  AITpro · BulletProof Security

  EPSS 72%
• High 7.2
  CVE-2021-33549 UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCE

  Geutebrück · Encoder G-Code · E2 Series

  EPSS 67%
• Unscored
  CVE-2021-34798 NULL pointer dereference in httpd core

  Apache Software Foundation · Apache HTTP Server

  EPSS 65%
• Unscored
  CVE-2021-36160 mod_proxy_uwsgi out of bound read

  Apache Software Foundation · Apache HTTP Server

  EPSS 64%