Week 42, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-42258 BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2…
  EPSS 75%
• Critical 10.0
  CVE-2021-41163 RCE via malicious SNS subscription payload

  Discourse · Discourse

  EPSS 20%
• Critical 9.8
  CVE-2021-38389 Advantech WebAccess

  Advantech · WebAccess

  EPSS 10%
• Critical 9.8
  CVE-2021-42740 Improper Neutralization of Special Elements used in a Command in Shell-quote
  EPSS 4.2%
• Critical 9.8
  CVE-2021-23449 Sandbox Bypass
  EPSS 3.6%
• Critical 9.8
  CVE-2021-40719 Adobe Connect Deserialization of Untrusted Data Remote Code Execution

  Adobe · Connect

  EPSS 3.5%
• Critical 9.8
  CVE-2021-42575 Policies not properly enforced in OWASP Java HTML Sanitizer
  EPSS 3%
• Critical 9.1
  CVE-2021-38484 InHand Networks IR615 Router

  InHand Networks · IR615 Router

  EPSS 2.8%
• Critical 9.8
  CVE-2021-33023 Advantech WebAccess

  Advantech · WebAccess

  EPSS 2.3%
• Critical 9.8
  CVE-2021-35617 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.1…

  Oracle · WebLogic Server

  EPSS 2.1%
• Critical 10.0
  CVE-2021-35652 Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported versions that are affected are Prior to …

  Oracle · Hyperion Essbase Administration Services

  EPSS 1.9%
• Critical 9.8
  CVE-2021-31349 Session Smart Router: Authentication Bypass Vulnerability

  Juniper Networks · 128 Technology Session Smart Router

  EPSS 1.7%
• Critical 9.8
  CVE-2021-42576 Policies not properly enforced in bluemonday
  EPSS 1.6%
• Critical 9.8
  CVE-2021-41745 Showdoc File Upload Vulnerability
  EPSS 1.4%
• Critical 9.8
  CVE-2021-38457 AUVESY Versiondog

  AUVESY · Versiondog

  EPSS 1.3%

All 24 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.3
  CVE-2021-35590 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and…

  Oracle · MySQL Cluster

  EPSS 88%
• Unscored
  CVE-2021-42840 SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, …
  EPSS 59%
• High 7.2
  CVE-2021-39352 Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload

  Catch Themes Demo Import · Catch Themes Demo Import

  EPSS 56%
• Unscored
  CVE-2021-21745 ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal aut…
  EPSS 56%
• Medium 6.3
  CVE-2021-35592 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and…

  Oracle · MySQL Cluster

  EPSS 52%
• Medium 6.3
  CVE-2021-35593 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and…

  Oracle · MySQL Cluster

  EPSS 51%
• Medium 6.3
  CVE-2021-35594 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and…

  Oracle · MySQL Cluster

  EPSS 51%
• Medium 6.3
  CVE-2021-35598 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and…

  Oracle · MySQL Cluster

  EPSS 51%