Week 39, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2021-41097 Prototype pollution in aurelia-path

  aurelia · path

  EPSS 4.9%
• Critical 9.8
  CVE-2021-41616 Apache ddlutils 1.0 readobject vulnerability

  Apache Software Foundation · Apache DB ddlutils

  EPSS 3.5%
• Critical 9.1
  CVE-2021-41110 CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker

  common-workflow-language · cwlviewer

  EPSS 2.8%
• Critical 9.8
  CVE-2021-41290 ECOA BAS controller - Path Traversal-1

  ECOA · RiskTerminator · RiskBuster Terminator E6L45 · RiskBuster System TRANE 1.0

  EPSS 2.3%
• Critical 9.8
  CVE-2021-36879 WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability

  StylemixThemes · uListing (WordPress plugin)

  EPSS 2.2%
• Critical 9.8
  CVE-2021-41299 ECOA BAS controller - Use of Hard-coded Credentials

  ECOA · RiskTerminator · RiskBuster Terminator E6L45 · RiskBuster System TRANE 1.0

  EPSS 2.1%
• Critical 9.8
  CVE-2021-41301 ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor

  ECOA · RiskBuster Terminator E6L45 · RiskBuster System TRANE 1.0 · SmartHome II E9246

  EPSS 2%
• Critical 9.8
  CVE-2021-41862 Expression injection in AviatorScript
  EPSS 1.9%
• Critical 9.8
  CVE-2020-20120 SQL Injection in topthink/thinkphp
  EPSS 1.8%
• Critical 9.8
  CVE-2021-38299 Improper Access Control in Webauthn Framework
  EPSS 1.8%
• Critical 9.6
  CVE-2021-3825 Missing Authorization Checks in LiderAhenk

  TUBITAK · Lider

  EPSS 1.6%
• Critical 9.8
  CVE-2021-34351 Command Injection Vulnerability in QVR

  QNAP Systems · QVR

  EPSS 1.5%
• Critical 9.8
  CVE-2021-34348 Command Injection Vulnerability in QVR

  QNAP Systems · QVR

  EPSS 1.5%
• Critical 9.1
  CVE-2021-41294 ECOA BAS controller - Path Traversal-4

  ECOA · SmartHome II E9246 · ECS Router Controller ECS (FLASH) · RiskBuster System RB 3.0.0

  EPSS 1.2%
• Critical 9.8
  CVE-2021-41292 ECOA BAS controller - Broken Authentication

  ECOA · RiskBuster System RB 3.0.0 · Graphic Control Software · RiskTerminator

  EPSS 1.2%

All 18 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2021-37539 Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.
  EPSS 93%
• High 7.5
  CVE-2021-41291 ECOA BAS controller - Path Traversal-1

  ECOA · RiskBuster System TRANE 1.0 · SmartHome II E9246 · ECS Router Controller ECS (FLASH)

  EPSS 83%
• Unscored
  CVE-2021-20034 An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file po…

  SonicWall · SMA100

  EPSS 82%
• Unscored
  CVE-2021-41288 Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
  EPSS 80%
• High 7.8
  CVE-2021-39843 Adobe Acrobat Reader XObject Out-of-Bound Write Vulnerability

  Adobe · Acrobat Reader

  EPSS 77%
• High 7.8
  CVE-2021-39836 Adobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution Vulnerability

  Adobe · Acrobat Reader

  EPSS 70%
• High 7.8
  CVE-2021-39838 Adobe Acrobat Reader DC AcroForm buttonGetCaption Use-After-Free Remote Code Execution Vulnerability

  Adobe · Acrobat Reader

  EPSS 65%
• High 7.8
  CVE-2021-39837 Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability

  Adobe · Acrobat Reader

  EPSS 65%