Het CSIRT-DSP maakt op wekelijkse basis een selectie van kwetsbaarheden, waarbij het CSIRT-DSP de inschatting heeft gemaakt dat deze relevant zijn voor digitale dienstverleners. Deze selectie wordt gezamenlijk met relevant nieuws verspreid in de Mid of Week.
De inschatting van low/medium/high wordt gemaakt op basis van de CVSS 3.1 base score van de kwetsbaarheid. 0.0-3.9 is low, 4.0-6.9 is medium, 7.0-10.0 is high.
Kwetsbaarheden die als low worden geclassificeerd komen niet in dit overzicht terug.
High
Microsoft Exchange Server
https://nvd.nist.gov/vuln/detail/CVE-2021-26427 (9.0)
https://nvd.nist.gov/vuln/detail/CVE-2021-41348 (8.0)
https://nvd.nist.gov/vuln/detail/CVE-2021-34453 (7.5)
Cisco Intersight Virtual Appliance
https://nvd.nist.gov/vuln/detail/CVE-2021-34748 (8.8)
Cisco Web Security Appliance
https://nvd.nist.gov/vuln/detail/CVE-2021-34698 (8.6)
Microsoft Office
https://advisories.ncsc.nl/advisory?id=NCSC-2021-0883 (8.1-5.3)
IBM PowerVM Hypervisor
https://nvd.nist.gov/vuln/detail/CVE-2021-38923 (8.0)
Microsoft Windows
https://advisories.ncsc.nl/advisory?id=NCSC-2021-0880 (8.0-4.9)
NetApp Cloud Manager
https://nvd.nist.gov/vuln/detail/CVE-2021-27002 (7.5)
Cisco Identity Services Engine (ISE)
https://nvd.nist.gov/vuln/detail/CVE-2021-1594 (7.5)
Apache HTTP Server
https://nvd.nist.gov/vuln/detail/CVE-2021-42013 (7.5)
Microsoft System Center Operations Manager
https://nvd.nist.gov/vuln/detail/CVE-2021-41352 (7.5)
Huawei FusionCompute
https://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210922-01-cmd-en (7.2)
Cisco AnyConnect
https://nvd.nist.gov/vuln/detail/CVE-2021-34788 (7.0)
Zoho ManageEngine ADManager Plus
https://nvd.nist.gov/vuln/detail/CVE-2021-37931 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37930 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37929 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37928 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37926 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37924 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37923 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37921 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37920 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37762 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37918 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37919 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-37922 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-38298 (n/a)
Medium
Kubernetes – Java Client library
https://nvd.nist.gov/vuln/detail/CVE-2021-25738 (6.7)
Microsoft Exchange Server
https://nvd.nist.gov/vuln/detail/CVE-2021-41350 (6.5)
Huawei CloudEngine
https://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20211008-01-cloudengine-en (6.5)
VMWare vRealize Log Insight / Cloud Foundation
https://www.vmware.com/security/advisories/VMSA-2021-0022.html (6.5)
VMWare vRealize Orchestrator
https://www.vmware.com/security/advisories/VMSA-2021-0023.html (6.5)
Cisco Identity Services Engine (ISE)
https://nvd.nist.gov/vuln/detail/CVE-2021-34706 (6.4)
https://nvd.nist.gov/vuln/detail/CVE-2021-34702 (4.3)
Cisco Email Security Appliance
https://nvd.nist.gov/vuln/detail/CVE-2021-1534 (5.8)
Gitlab
https://nvd.nist.gov/vuln/detail/CVE-2021-22263 (5.5)
Cisco DNA Center
https://nvd.nist.gov/vuln/detail/CVE-2021-34782 (4.3)