Week 48, 2021
29 November – 5 December 2021
Newly exploited 5
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Critical 9.8
CVE-2021-37415 KEV Dec 1, 2021 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.EPSS 100%
-
Critical 9.8
CVE-2021-44077 KEV Dec 1, 2021 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remot…EPSS 94%
-
Critical 9.1
CVE-2018-14847 KEV Dec 1, 2021 MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due …EPSS 96%
- Critical 9.0 EPSS 100%
-
High 7.8
CVE-2020-11261 KEV Dec 1, 2021 Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute,…EPSS 1.5%
Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-44077 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remot…EPSS 94%
- Critical 9.8 EPSS 51%
- Critical 9.8 EPSS 2.4%
- Critical 9.8 EPSS 1.5%
- Critical 9.8 EPSS 1.4%
- Critical 9.0 EPSS 1.3%
- Critical 9.1 EPSS 1%
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 83%
-
Unscored
CVE-2021-38147 Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, bec…EPSS 53%
- Medium 5.0 EPSS 26%
- Medium 5.3 EPSS 25%
-
Unscored
CVE-2021-43319 Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.EPSS 21%
-
Unscored
CVE-2021-33266 D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU…EPSS 17%
-
Unscored
CVE-2021-33265 D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FU…EPSS 14%
-
Unscored
CVE-2021-44352 A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in goform/SetIpMacBind.EPSS 13%
Advisories
- SUSE / openSUSE Security Updates 62
- CISA ICS & IT advisories 122 critical
- Debian Security (DSA / DLA) 111 critical
- Ubuntu Security Notices (USN) 9
- BSI CERT-Bund (WID) 6
- Oracle Linux Security Advisories (ELSA) 52 critical
- AlmaLinux Security Advisories 41 critical
- Rocky Linux Security Advisories 21 critical
- Amazon Linux Security Center (ALAS) 11 critical
- ICSA-21-336-06 Hitachi Energy APM Edge 29 CVEs
- ICSA-21-336-03 Distributed Data Systems WebHMI 2 CVEs
- DLA-2839-1 gerbv - security update 1 CVEs
- RLSA-2021:4903 Critical: nss security update 1 CVEs
- ALSA-2021:4903 Critical: nss security update 1 CVEs
- ALAS2-2021-1722 Critical: nss security update (Amazon Linux 2) 1 CVEs
- ELSA-2021-4904 Critical: nss security update (Oracle Linux 7) 1 CVEs
- ELSA-2021-4903 Critical: nss security update (Oracle Linux 8) 1 CVEs