Week 40, 2021
4–10 October 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-42013 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100%
- Critical 9.8 EPSS 100%
- Critical 9.8 EPSS 87%
-
Critical 9.6
CVE-2021-30633 Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perfo…EPSS 33%
-
Critical 9.6
CVE-2021-37973 Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sa…EPSS 12%
- Critical 9.8 EPSS 2.4%
- Critical 9.6 EPSS 2.3%
- Critical 9.8 EPSS 2.3%
-
Critical 9.1
CVE-2021-29908 The IBM TS7700 Management Interface is vulnerable to unauthenticated access. By accessing a specially-crafted URL, an attacker may gain administrative access t…EPSS 2.1%
IBM · Virtualization Engine TS7700 3957-VEC · Virtualization Engine TS7700 3957-VED
- Critical 9.8 EPSS 2%
- Critical 9.1 EPSS 1.3%
- Critical 9.1 EPSS 1.3%
-
Critical 10.0
CVE-2021-23857 Login with hashEPSS 1.2%
Rexroth · IndraMotion MLC L20, L40 · IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion XLC
- Critical 9.8 EPSS 1.1%
- Critical 10.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 100%
-
Unscored
CVE-2021-37926 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.EPSS 74%
-
Unscored
CVE-2021-37918 Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.EPSS 74%
-
Unscored
CVE-2021-42071 In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py Use…EPSS 70%
- High 7.5 EPSS 69%
-
Unscored
CVE-2021-32172 Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.EPSS 66%
-
High 8.8
CVE-2021-30632 Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 63%
-
Unscored
CVE-2021-22930 Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to chang…EPSS 36%
Advisories
- SUSE / openSUSE Security Updates 314 critical
- Ubuntu Security Notices (USN) 122 critical
- CISA ICS & IT advisories 116 critical
- BSI CERT-Bund (WID) 51 critical
- Debian Security (DSA / DLA) 51 critical
- Amazon Linux Security Center (ALAS) 5
- CERT@VDE 22 critical
- Oracle Linux Security Advisories (ELSA) 1
- ICSA-21-280-05 InHand Networks IR615 Router (Update A) 13 CVEs
- ICSA-21-280-02 Mobile Industrial Robots Vehicles and MiR Fleet Software 10 CVEs
- openSUSE-SU-2021:1330-1 Security update for opera 9 CVEs
- USN-5107-1 firefox vulnerabilities 7 CVEs
- ICSA-21-278-03 Moxa MXview Network Management Software 5 CVEs
- DSA-4982-1 apache2 - security update 4 CVEs
- SUSE-SU-2021:3299-1 Security update for apache2 3 CVEs
- ICSA-21-278-04 Honeywell Experion PKS and ACE Controllers 3 CVEs
- VDE-2021-048 Lenze: Multiple Vulnerabilities in CODESYS Control V2 communication 3 CVEs
- SUSE-SU-2021:3289-1 Security update for glibc 2 CVEs