Week 49, 2021
6–12 December 2021
Newly exploited 13
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Critical 10.0
CVE-2021-44228 KEV Dec 10, 2021 · ransomware Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsEPSS 100%
- Critical 9.9 EPSS 85%
-
Critical 9.8
CVE-2017-12149 KEV Dec 10, 2021 · ransomware In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of t…EPSS 91%
-
Critical 9.8
CVE-2019-7238 KEV Dec 10, 2021 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.EPSS 77%
-
Critical 9.8
CVE-2020-17463 KEV Dec 10, 2021 FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.EPSS 90%
-
Critical 9.8
CVE-2021-44515 KEV Dec 10, 2021 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December …EPSS 100%
-
Critical 9.8
CVE-2021-35394 KEV Dec 10, 2021 Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affe…EPSS 100%
-
Critical 9.1
CVE-2020-8816 KEV Dec 10, 2021 Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.EPSS 78%
-
High 8.8
CVE-2010-1871 KEV Dec 10, 2021 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression La…EPSS 83%
-
High 8.1
CVE-2017-17562 KEV Dec 10, 2021 Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the env…EPSS 97%
-
High 7.8
CVE-2019-13272 KEV Dec 10, 2021 In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relati…EPSS 52%
- High 7.2 EPSS 84%
- Low 3.3
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsEPSS 100%
-
Critical 9.8
CVE-2021-20038 A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to po…EPSS 100%
-
Critical 9.8
CVE-2021-44515 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December …EPSS 100%
-
Critical 9.8
CVE-2021-44529 A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissio…EPSS 99%
- Critical 9.8 EPSS 40%
- Critical 9.8 EPSS 38%
- Critical 10.0 EPSS 36%
- Critical 9.8 EPSS 5.4%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 2.6%
-
Critical 9.9
CVE-2021-21954 A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A special…EPSS 2.5%
- Critical 9.8 EPSS 2.5%
-
Critical 10.0
CVE-2021-21950 An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.…EPSS 2.5%
-
Critical 10.0
CVE-2021-21951 An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.…EPSS 2.5%
- Critical 9.8 EPSS 2.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 89%
-
Unscored
CVE-2021-42125 An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous fil…EPSS 82%
-
Unscored
CVE-2021-24931 Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL InjectionEPSS 79%
-
High 8.8
CVE-2021-20039 Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to i…EPSS 79%
-
Unscored
CVE-2021-42129 A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command e…EPSS 77%
- Unscored EPSS 72%
-
Unscored
CVE-2021-40859 Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full admin…EPSS 72%
-
Unscored
CVE-2021-42132 A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command e…EPSS 70%
Advisories
- SUSE / openSUSE Security Updates 723 critical
- Ubuntu Security Notices (USN) 17
- BSI CERT-Bund (WID) 102 critical
- Debian Security (DSA / DLA) 83 critical
- Amazon Linux Security Center (ALAS) 7
- Oracle Linux Security Advisories (ELSA) 6
- CISA ICS & IT advisories 51 critical
- Rocky Linux Security Advisories 2
- AlmaLinux Security Advisories 2
- CERT@VDE 1
- WID-SEC-2026-0292 GitLab: Mehrere Schwachstellen 19 CVEs
- SUSE-SU-2021:3291-1 Security update for glibc 2 CVEs
- openSUSE-SU-2021:3291-1 Security update for glibc 2 CVEs
- ICSA-21-341-02 Hitachi Energy XMC20 and FOX61x 2 CVEs
- DLA-2840-1 roundcube - security update 2 CVEs
- openSUSE-SU-2021:3999-1 Security update for log4j 1 CVEs
- DLA-2842-1 apache-log4j2 - security update 1 CVEs
- DSA-5020-1 apache-log4j2 - security update 1 CVEs
- WID-SEC-2022-0351 Apache log4j: Schwachstelle ermöglicht Codeausführung 1 CVEs