Week 51, 2021

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.9
  CVE-2021-21881 An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra…
  EPSS 37%
• Critical 9.9
  CVE-2021-21892 A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially cr…
  EPSS 30%
• Critical 9.8
  CVE-2021-40418 When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an objec…
  EPSS 18%
• Critical 9.8
  CVE-2021-40417 When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with t…
  EPSS 16%
• Critical 9.9
  CVE-2021-21883 An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HT…
  EPSS 6.1%
• Critical 9.9
  CVE-2021-21882 An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque…
  EPSS 6.1%
• Critical 9.9
  CVE-2021-21872 An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-craf…
  EPSS 6.1%
• Critical 9.1
  CVE-2021-21884 An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP …
  EPSS 5.3%
• Critical 9.8
  CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler

  Apache Software Foundation · Apache Solr

  EPSS 5.2%
• Critical 9.8
  CVE-2021-45459 Command Injection in node-windows
  EPSS 4.1%
• Critical 9.1
  CVE-2021-21888 An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speci…
  EPSS 3.9%
• Critical 9.9
  CVE-2021-21879 A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque…
  EPSS 3.8%
• Critical 9.8
  CVE-2021-44159 4MOSAn GCB Doctor - Unrestricted Upload of File

  4MOSAn · GCB Doctor

  EPSS 3.5%
• Critical 9.9
  CVE-2021-27449 Mesa Labs AmegaView Command Injection

  Mesa Labs · AmegaView

  EPSS 3.2%
• Critical 10.0
  CVE-2021-40393 An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the for…
  EPSS 3.1%

All 110 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2021-44790 Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

  Apache Software Foundation · Apache HTTP Server

  EPSS 97%
• Unscored
  CVE-2021-44224 Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

  Apache Software Foundation · Apache HTTP Server

  EPSS 82%
• Unscored
  CVE-2021-24750 WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
  EPSS 38%
• Unscored
  CVE-2021-45461 FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code,…
  EPSS 21%
• High 7.7
  CVE-2021-21924 A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done…
  EPSS 20%
• Medium 6.8
  CVE-2021-45511 Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 2021-08-27, AC2600 before 2021-08-27, D7000…
  EPSS 19%
• High 8.1
  CVE-2021-44207 Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
  EPSS 17%
• Unscored
  CVE-2021-36750 ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across US…
  EPSS 14%