Week 45, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-3064 PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces

  Palo Alto Networks · PAN-OS · Prisma Access

  EPSS 20%
• Critical 9.8
  CVE-2021-34684 Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retr…
  EPSS 5.9%
• Critical 9.8
  CVE-2021-43350 LDAP filter injection vulnerability in Traffic Ops

  Apache Software Foundation · Apache Traffic Control

  EPSS 4.8%
• Critical 9.8
  CVE-2021-43466 Template injection in thymeleaf-spring5
  EPSS 4%
• Critical 9.8
  CVE-2021-33816 Dolibarr remote PHP code execution
  EPSS 3.9%
• Critical 9.8
  CVE-2021-3918 Prototype Pollution in kriszyp/json-schema

  kriszyp · kriszyp/json-schema

  EPSS 3.8%
• Critical 9.6
  CVE-2021-43523 In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethost…
  EPSS 3.1%
• Critical 9.0
  CVE-2021-43616 The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json…
  EPSS 2.6%
• Critical 9.0
  CVE-2021-26443 Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 1.7%
• Critical 9.8
  CVE-2021-41170 Evaluation of closures can lead to execution of methods & functions in current program scope

  sroehrl · neoan3-template

  EPSS 1.6%
• Critical 9.8
  CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts

  OpenZeppelin · openzeppelin-contracts

  EPSS 1.5%
• Critical 9.9
  CVE-2021-40358 A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions <…

  Siemens · SIMATIC WinCC V7.5 · SIMATIC WinCC V7.4 · SIMATIC PCS 7 V9.0

  EPSS 1.3%
• Critical 9.8
  CVE-2021-43572 Improper Verification of Cryptographic Signature in starkbank-ecdsa
  EPSS 1.2%
• Critical 9.8
  CVE-2021-25979 Apostrophe - Insufficient Session Expiration

  Apostrophe · Apostrophe

  EPSS 1.1%
• Critical 9.8
  CVE-2021-43569 Improper Verification of Cryptographic Signature in starkbank-ecdsa
  EPSS 1.1%

All 21 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.5
  CVE-2021-41349 Microsoft Exchange Server Spoofing Vulnerability

  Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 11 · Microsoft Exchange Server 2016 Cumulative Update 22

  EPSS 93%
• High 8.8
  CVE-2021-42321 Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft · Microsoft Exchange Server 2019 Cumulative Update 11 · Microsoft Exchange Server 2016 Cumulative Update 22 · Microsoft Exchange Server 2019 Cumulative Update 10

  EPSS 92%
• Medium 5.4
  CVE-2021-21699 Stored XSS vulnerability in Jenkins Active Choices Plugin

  Jenkins Project · Jenkins Active Choices Plugin

  EPSS 88%
• Medium 6.1
  CVE-2021-33618 Dolibarr ERP and CRM contain XSS Vulnerability
  EPSS 79%
• High 7.5
  CVE-2021-42287 Active Directory Domain Services Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 77%
• Unscored
  CVE-2021-41653 The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payl…
  EPSS 76%
• High 7.5
  CVE-2021-42278 Active Directory Domain Services Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 73%
• Unscored
  CVE-2021-42847 Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
  EPSS 70%