Het CSIRT-DSP maakt op wekelijkse basis een selectie van kwetsbaarheden, waarbij het CSIRT-DSP de inschatting heeft gemaakt dat deze relevant zijn voor digitale dienstverleners. Deze selectie wordt gezamenlijk met relevant nieuws verspreid in de Mid of Week.
De inschatting van low/medium/high wordt gemaakt op basis van de CVSS 3.1 base score van de kwetsbaarheid. 0.0-3.9 is low, 4.0-6.9 is medium, 7.0-10.0 is high.
Kwetsbaarheden die als low worden geclassificeerd komen niet in dit overzicht terug.
High
Nextcloud Server
https://nvd.nist.gov/vuln/detail/CVE-2021-41178 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-41177 (8.1)
Nextcloud Deck
https://nvd.nist.gov/vuln/detail/CVE-2021-39225 (8.1)
TeamViewer
https://nvd.nist.gov/vuln/detail/CVE-2021-34859 (7.8)
Cisco IOS XE SD-WAN Software
https://nvd.nist.gov/vuln/detail/CVE-2021-1529 (7.8)
Huawei FusionCube
https://nvd.nist.gov/vuln/detail/CVE-2021-37130 (7.2)
Zoho ManageEngine Applications Manager
https://nvd.nist.gov/vuln/detail/CVE-2021-35512 (n/a)
Kubernetes Ingress-nginx
https://github.com/kubernetes/ingress-nginx/issues/7837 (n/a)
Medium
Huawei ManageOne
https://nvd.nist.gov/vuln/detail/CVE-2021-37131 (6.8)
Solarwinds Kiwi Cattools
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35230 (6.7)
Solarwinds Kiwi Syslog Server
https://nvd.nist.gov/vuln/detail/CVE-2021-35231 (6.7)
https://nvd.nist.gov/vuln/detail/CVE-2021-35233 (5.3)
https://nvd.nist.gov/vuln/detail/CVE-2021-35235 (5.3)
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35237 (5.0)
Cisco Identity Services Engine
https://nvd.nist.gov/vuln/detail/CVE-2021-34738 (6.5)
https://nvd.nist.gov/vuln/detail/CVE-2021-34738 (6.1)
https://nvd.nist.gov/vuln/detail/CVE-2021-40121 (4.8)
Nextcloud Server
https://nvd.nist.gov/vuln/detail/CVE-2021-41179 (6.5)
Nextcloud Contacts
https://nvd.nist.gov/vuln/detail/CVE-2021-39221 (6.4)
Pulse Connect Secure
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44899 (5.9)
Arista EOS / CloudEOS
https://nvd.nist.gov/vuln/detail/CVE-2021-28496 (5.7)
Cisco Integrated Management Controller
https://nvd.nist.gov/vuln/detail/CVE-2021-34736 (5.3)
Solarwinds Orion
https://nvd.nist.gov/vuln/detail/CVE-2021-35225 (5.0)
Nextcloud Richdocuments
https://nvd.nist.gov/vuln/detail/CVE-2021-39223 (4.8)