Week 50, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.0
  CVE-2021-45046 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

  Apache Software Foundation · Apache Log4j

  EPSS 100%
• Critical 9.8
  CVE-2021-4073 RegistrationMagic <= 5.0.1.7 Authentication Bypass

  RegistrationMagic · RegistrationMagic

  EPSS 6.8%
• Critical 9.8
  CVE-2021-36888 WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise

  oxilab · Image Hover Effects Ultimate (WordPress plugin)

  EPSS 6.5%
• Critical 9.8
  CVE-2021-27856 FatPipe software administrative account with no password

  FatPipe · WARP · MPVPN · IPVPN

  EPSS 5.5%
• Critical 9.8
  CVE-2021-43113 Command injection in itext7-core
  EPSS 5.4%
• Critical 10.0
  CVE-2021-42311 Microsoft Defender for IoT Remote Code Execution Vulnerability

  Microsoft · Microsoft Defender for IoT

  EPSS 4.4%
• Critical 10.0
  CVE-2021-42313 Microsoft Defender for IoT Remote Code Execution Vulnerability

  Microsoft · Microsoft Defender for IoT

  EPSS 4.1%
• Critical 9.8
  CVE-2021-43907 Visual Studio Code WSL Extension Remote Code Execution Vulnerability

  Microsoft · Visual Studio Code WSL Extension

  EPSS 4%
• Critical 9.6
  CVE-2021-43905 Microsoft Office app Remote Code Execution Vulnerability

  Microsoft · Office app

  EPSS 3.1%
• Critical 9.8
  CVE-2021-43215 iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 2.9%
• Critical 9.8
  CVE-2021-43899 Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability

  Microsoft · Microsoft 4K Wireless Display Adapter

  EPSS 2.6%
• Critical 9.0
  CVE-2021-43882 Microsoft Defender for IoT Remote Code Execution Vulnerability

  Microsoft · Microsoft Defender for IoT

  EPSS 2.6%
• Critical 9.9
  CVE-2021-43821 Files Accessible to External Parties in Opencast

  opencast · opencast

  EPSS 2%
• Critical 9.1
  CVE-2021-4110 NULL Pointer Dereference in mruby/mruby

  mruby · mruby/mruby

  EPSS 1.7%
• Critical 9.8
  CVE-2021-23803 Access Control Bypass
  EPSS 1.6%

All 24 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.9
  CVE-2021-45105 Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

  Apache Software Foundation · Apache Log4j2

  EPSS 100%
• High 7.5
  CVE-2021-22054 VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SS…
  EPSS 100%
• High 7.5
  CVE-2021-4104 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

  Apache Software Foundation · Apache Log4j 1.x

  EPSS 81%
• High 7.5
  CVE-2021-39312 True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

  True Ranker · True Ranker

  EPSS 78%
• Unscored
  CVE-2021-24946 Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
  EPSS 73%
• Unscored
  CVE-2021-36450 Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.
  EPSS 64%
• High 7.4
  CVE-2021-43829 Unrestricted Upload of Files in Patrowl

  Patrowl · PatrowlManager

  EPSS 59%
• Unscored
  CVE-2021-44152 An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user c…
  EPSS 59%