Week 44, 2021
1–7 November 2021
Newly exploited 60
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Critical 10.0
CVE-2020-1350 KEV Nov 3, 2021 A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote C…EPSS 97%
Microsoft · Windows Server, version 1903 (Server Core installation) · Windows Server, version 1909 (Server Core installation) · Windows Server
-
Critical 10.0
CVE-2020-6207 KEV Nov 3, 2021 SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin…EPSS 98%
-
Critical 10.0
CVE-2020-12271 KEV Nov 3, 2021 · ransomware A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. Thi…EPSS 43%
-
Critical 10.0
CVE-2021-22893 KEV Nov 3, 2021 · ransomware Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure …EPSS 48%
-
Critical 10.0
CVE-2020-14871 KEV Nov 3, 2021 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11.…EPSS 80%
-
Critical 10.0
CVE-2021-22205 KEV Nov 3, 2021 · ransomware An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a fi…EPSS 100%
-
Critical 10.0
CVE-2020-25213 KEV Nov 3, 2021 The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsaf…EPSS 97%
-
Critical 10.0
CVE-2010-5326 KEV Nov 3, 2021 The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to …EPSS 18%
-
Critical 10.0
CVE-2021-30116 KEV Nov 3, 2021 · ransomware Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6EPSS 86%
-
Critical 10.0
CVE-2020-6287 KEV Nov 3, 2021 SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without p…EPSS 95%
-
Critical 10.0
CVE-2019-4716 KEV Nov 3, 2021 IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute…EPSS 86%
-
Critical 9.9
CVE-2019-11510 KEV Nov 3, 2021 · ransomware In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a speci…EPSS 100%
-
Critical 9.8
CVE-2020-14750 KEV Nov 3, 2021 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1…EPSS 99%
-
Critical 9.8
CVE-2019-11634 KEV Nov 3, 2021 · ransomware Citrix Workspace App before 1904 for Windows has Incorrect Access Control.EPSS 8.1%
-
Critical 9.8
CVE-2019-3396 KEV Nov 3, 2021 · ransomware The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed vers…EPSS 100%
-
Critical 9.8
CVE-2021-27103 KEV Nov 3, 2021 · ransomware Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.EPSS 8.2%
-
Critical 9.8
CVE-2018-20062 KEV Nov 3, 2021 An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter par…EPSS 100%
- Critical 9.8 EPSS 100%
-
Critical 9.8
CVE-2017-7269 KEV Nov 3, 2021 Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allow…EPSS 100%
-
Critical 9.8
CVE-2021-20021 KEV Nov 3, 2021 · ransomware A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to th…EPSS 89%
-
Critical 9.8
CVE-2021-20090 KEV Nov 3, 2021 A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow un…EPSS 100%
-
Critical 9.8
CVE-2021-26084 KEV Nov 3, 2021 · ransomware In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit…EPSS 100%
-
Critical 9.8
CVE-2021-22005 KEV Nov 3, 2021 · ransomware The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Serve…EPSS 100%
- Critical 9.8 EPSS 93%
-
Critical 9.8
CVE-2019-16759 KEV Nov 3, 2021 vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.EPSS 100%
-
Critical 9.8
CVE-2021-20016 KEV Nov 3, 2021 · ransomware A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password …EPSS 40%
-
Critical 9.8
CVE-2020-29557 KEV Nov 3, 2021 An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-au…EPSS 56%
-
Critical 9.8
CVE-2021-1871 KEV Nov 3, 2021 A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 …EPSS 7%
Apple · macOS · iOS and iPadOS
-
Critical 9.8
CVE-2015-4852 KEV Nov 3, 2021 The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a cra…EPSS 95%
-
Critical 9.8
CVE-2021-31755 KEV Nov 3, 2021 An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers t…EPSS 87%
-
Critical 9.8
CVE-2017-5638 KEV Nov 3, 2021 · ransomware Apache Struts vulnerable to remote arbitrary command execution due to improper input validationEPSS 100%
-
Critical 9.8
CVE-2020-17496 KEV Nov 3, 2021 vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: thi…EPSS 87%
-
Critical 9.8
CVE-2021-35464 KEV Nov 3, 2021 · ransomware ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require …EPSS 100%
- Critical 9.8 EPSS 100%
-
Critical 9.8
CVE-2019-5544 KEV Nov 3, 2021 · ransomware OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical sever…EPSS 98%
-
Critical 9.8
CVE-2020-8644 KEV Nov 3, 2021 PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.EPSS 86%
-
Critical 9.8
CVE-2020-15505 KEV Nov 3, 2021 A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 …EPSS 100%
-
Critical 9.8
CVE-2020-3992 KEV Nov 3, 2021 · ransomware OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issu…EPSS 83%
-
Critical 9.8
CVE-2020-3952 KEV Nov 3, 2021 Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctl…EPSS 90%
- Critical 9.8 EPSS 97%
-
Critical 9.8
CVE-2020-10181 KEV Nov 3, 2021 goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a devic…EPSS 15%
-
Critical 9.8
CVE-2020-2555 KEV Nov 3, 2021 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are …EPSS 97%
-
Critical 9.8
CVE-2021-27561 KEV Nov 3, 2021 Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.EPSS 84%
-
Critical 9.8
CVE-2017-9248 KEV Nov 3, 2021 Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.Dialog…EPSS 75%
-
Critical 9.8
CVE-2020-10148 KEV Nov 3, 2021 SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commandsEPSS 92%
-
Critical 9.8
CVE-2021-35395 KEV Nov 3, 2021 Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two …EPSS 98%
-
Critical 9.8
CVE-2021-40539 KEV Nov 3, 2021 · ransomware Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.EPSS 99%
-
Critical 9.8
CVE-2018-15961 KEV Nov 3, 2021 Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Su…EPSS 100%
-
Critical 9.8
CVE-2020-10987 KEV Nov 3, 2021 The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST …EPSS 80%
-
Critical 9.8
CVE-2021-22986 KEV Nov 3, 2021 · ransomware On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x …EPSS 100%
-
Critical 9.8
CVE-2018-4939 KEV Nov 3, 2021 Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerabilit…EPSS 62%
-
Critical 9.8
CVE-2019-0604 KEV Nov 3, 2021 · ransomware A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso…EPSS 100%
Microsoft · Microsoft SharePoint Server · Microsoft SharePoint Enterprise Server · Microsoft SharePoint Foundation
- Critical 9.8 EPSS 100%
-
Critical 9.8
CVE-2020-14882 KEV Nov 3, 2021 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1…EPSS 100%
-
Critical 9.8
CVE-2020-25506 KEV Nov 3, 2021 D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.EPSS 100%
-
Critical 9.8
CVE-2020-8599 KEV Nov 3, 2021 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary p…EPSS 12%
-
Critical 9.8
CVE-2020-26919 KEV Nov 3, 2021 NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.EPSS 57%
-
Critical 9.8
CVE-2020-3161 KEV Nov 3, 2021 Cisco IP Phones Web Server Remote Code Execution and Denial of Service VulnerabilityEPSS 84%
-
Critical 9.8
CVE-2021-27101 KEV Nov 3, 2021 · ransomware Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380…EPSS 4.3%
-
Critical 9.8
CVE-2021-21972 KEV Nov 3, 2021 · ransomware The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exp…EPSS 100%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-42237 Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command …EPSS 97%
- Critical 10.0 EPSS 4.6%
-
Critical 9.0
CVE-2021-21690 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 2.5%
- Critical 9.8 EPSS 2.5%
-
Critical 9.0
CVE-2021-21695 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 2.1%
-
Critical 9.0
CVE-2021-21692 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 2.1%
-
Critical 9.0
CVE-2021-21691 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 2.1%
-
Critical 9.0
CVE-2021-21686 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 2%
- Critical 10.0 EPSS 1.7%
-
Critical 9.1
CVE-2021-21697 Agent-to-controller access control allows reading/writing most content of build directories in JenkinsEPSS 1.6%
-
Critical 9.0
CVE-2021-21685 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 1.6%
-
Critical 9.0
CVE-2021-21694 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 1.6%
-
Critical 9.0
CVE-2021-21693 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 1.6%
-
Critical 9.0
CVE-2021-21689 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 1.5%
-
Critical 9.0
CVE-2021-21687 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in JenkinsEPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 6.9 EPSS 85%
-
High 8.7
CVE-2021-39906 Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.EPSS 61%
-
Unscored
CVE-2021-43267 An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote…EPSS 58%
- High 7.5 EPSS 36%
-
Unscored
CVE-2021-43405 An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric).EPSS 36%
-
Unscored
CVE-2021-42669 A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher…EPSS 23%
- High 8.2 EPSS 22%
-
Unscored
CVE-2021-42671 An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can…EPSS 20%
Advisories
- SUSE / openSUSE Security Updates 321 critical
- Oracle Linux Security Advisories (ELSA) 18
- AlmaLinux Security Advisories 13
- Debian Security (DSA / DLA) 101 critical
- Rocky Linux Security Advisories 9
- BSI CERT-Bund (WID) 8
- CISA ICS & IT advisories 6
- Ubuntu Security Notices (USN) 5
- CERT@VDE 2
- openSUSE-SU-2021:1438-1 Security update for apache2 4 CVEs
- DLA-2811-1 sqlalchemy - security update 2 CVEs