Week 41, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-27561 Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
  EPSS 84%
• Critical 10.0
  CVE-2021-38454 Moxa MXview Network Management Software

  Moxa · MXview Network Management Software

  EPSS 16%
• Critical 9.8
  CVE-2021-42325 Froxlor SQL injection vulnerability
  EPSS 12%
• Critical 9.8
  CVE-2021-40720 Ops CLI Deserialization of Untrusted Data leads to Abritrary Code Execution

  Adobe · Ops-CLI

  EPSS 9.5%
• Critical 9.8
  CVE-2021-3878 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

  Stanford NLP · stanfordnlp/corenlp

  EPSS 1.9%
• Critical 9.8
  CVE-2021-38432 FATEK Automation Communication Server

  FATEK Automation · Communication Server

  EPSS 1.9%
• Critical 9.8
  CVE-2021-38458 Moxa MXview Network Management Software

  Moxa · MXview Network Management Software

  EPSS 1.8%
• Critical 10.0
  CVE-2021-21941 A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network pac…
  EPSS 1.7%
• Critical 9.8
  CVE-2021-27664 exacqVision Web Service

  Johnson Controls · exacqVision Web Service

  EPSS 1.6%
• Critical 9.1
  CVE-2021-20599 Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCP…

  Mitsubishi Electric · MELSEC iQ-R series SIL2 Process CPU R16PSFCPU · MELSEC iQ-R series SIL2 Process CPU R120PSFCPU · MELSEC iQ-R Series Safety CPU R08SFCPU

  EPSS 1.4%
• Critical 10.0
  CVE-2021-21940 A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted network…
  EPSS 1.3%
• Critical 9.8
  CVE-2021-35498 TIBCO EBX Insecure Login Mechanism

  TIBCO Software · TIBCO EBX · TIBCO Product and Service Catalog powered by TIBCO EBX

  EPSS 1.3%
• Critical 9.8
  CVE-2021-38456 Moxa MXview Network Management Software

  Moxa · MXview Network Management Software

  EPSS 1.2%
• Critical 9.9
  CVE-2021-42369 Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to …
  EPSS 1.1%
• Critical 9.8
  CVE-2021-41132 Inconsistent input sanitisation leads to XSS vectors

  ome · omero-web

  EPSS 1%

All 17 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2021-20124 A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated …
  EPSS 96%
• High 7.5
  CVE-2021-20123 A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthe…
  EPSS 90%
• High 7.8
  CVE-2021-40449 Win32k Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 82%
• Unscored
  CVE-2021-42342 An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed…
  EPSS 59%
• High 7.8
  CVE-2021-40728 Adobe Acrobat Reader DC Use After Free Arbitrary Code Execution

  Adobe · Acrobat Reader

  EPSS 55%
• Unscored
  CVE-2021-40493 Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the …
  EPSS 50%
• High 8.1
  CVE-2021-40487 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Foundation 2013 Service Pack 1

  EPSS 48%
• Unscored
  CVE-2021-33731 A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in th…

  Siemens · SINEC NMS

  EPSS 47%