Week 38, 2021
20–26 September 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-22005 The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Serve…EPSS 100%
-
Critical 9.8
CVE-2021-36260 A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability…EPSS 100%
-
Critical 9.8
CVE-2021-22941 Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zo…EPSS 54%
-
Critical 9.1
CVE-2021-22945 When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and bo…EPSS 6.7%
-
Critical 10.0
CVE-2021-34770 Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Remote Code Execution VulnerabilityEPSS 3%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.4%
-
Critical 10.0
CVE-2021-21913 An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to…EPSS 2.2%
- Critical 9.8 EPSS 1.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2021-40655 An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request…EPSS 87%
-
Medium 6.5
CVE-2021-36749 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)EPSS 81%
- Unscored EPSS 53%
- Unscored EPSS 51%
-
Medium 5.3
CVE-2021-22017 Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port…EPSS 49%
-
Unscored
CVE-2021-40875 Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on t…EPSS 47%
-
Unscored
CVE-2021-37925 Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.EPSS 10%
-
Unscored
CVE-2021-40847 The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a Mit…EPSS 10%
Advisories
- SUSE / openSUSE Security Updates 525 critical
- Oracle Linux Security Advisories (ELSA) 14
- AlmaLinux Security Advisories 13
- Ubuntu Security Notices (USN) 10
- Debian Security (DSA / DLA) 8
- Rocky Linux Security Advisories 6
- BSI CERT-Bund (WID) 5
- CISA ICS & IT advisories 31 critical
- CERT@VDE 21 critical
- openSUSE-SU-2021:1303-1 Security update for chromium 28 CVEs
- openSUSE-SU-2021:1300-1 Security update for chromium 28 CVEs
- VDE-2021-009 Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities 5 CVEs
- SUSE-SU-2021:3170-1 Security update for SUSE Manager Server 4.2 3 CVEs
- SUSE-RU-2021:3162-1 Recommended update for SUSE Manager 4.2.2 Release Notes 3 CVEs
- SUSE-SU-2021:3151-1 Security update for cobbler 3 CVEs
- ICSA-21-266-02 Trane Tracer 1 CVEs