Het CSIRT-DSP maakt op wekelijkse basis een selectie van kwetsbaarheden, waarbij het CSIRT-DSP de inschatting heeft gemaakt dat deze relevant zijn voor digitale dienstverleners. Deze selectie wordt gezamenlijk met relevant nieuws verspreid in de Mid of Week.
De inschatting van low/medium/high wordt gemaakt op basis van de CVSS 3.1 base score van de kwetsbaarheid. 0.0-3.9 is low, 4.0-6.9 is medium, 7.0-10.0 is high.
Kwetsbaarheden die als low worden geclassificeerd komen niet in dit overzicht terug.
High
Kaseya Unitrends Backup Appliance
https://nvd.nist.gov/vuln/detail/CVE-2021-43033 (9.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43035 (9.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43036 (9.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43042 (9.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43044 (9.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43038 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43040 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43041 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43034 (7.8)
https://nvd.nist.gov/vuln/detail/CVE-2021-43037 (7.8)
Solarwinds Serv-U
https://nvd.nist.gov/vuln/detail/CVE-2021-35242 (8.8)
Fortinet FortiWLM
https://www.fortiguard.com/psirt/FG-IR-21-129 (8.3)
Fortinet FortiOS
https://www.fortiguard.com/psirt/FG-IR-21-049 (7.7)
https://www.fortiguard.com/psirt/FG-IR-20-131 (7.4)
https://www.fortiguard.com/psirt/FG-IR-21-051 (7.3)
https://www.fortiguard.com/psirt/FG-IR-21-181 (7.3)
Fortinet FortiNAC
https://www.fortiguard.com/psirt/FG-IR-21-178 (7.6)
Grafana
https://nvd.nist.gov/vuln/detail/CVE-2021-43798 (7.5)
Fortinet FortiProxy
https://www.fortiguard.com/psirt/FG-IR-20-131 (7.4)
https://www.fortiguard.com/psirt/FG-IR-21-181 (7.3)
Gitlab CE / EE
https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/ (7.1-4.3)
Zoho ManageEngine Desktop Central
https://www.manageengine.com/desktop-management-msp/cve-2021-44515-security-advisory.html (n/a)
Eltima SDK (USB over Ethernet)
Amazon Workspaces Agent
https://nvd.nist.gov/vuln/detail/CVE-2021-43637 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-43638 (n/a)
Accops HyWorks DVM Tools / Windows Client
https://nvd.nist.gov/vuln/detail/CVE-2021-42688 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42687 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42686 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42685 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42683 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42682 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42681 (n/a)
AmZetta Amzetta zPortal
https://nvd.nist.gov/vuln/detail/CVE-2021-43003 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-43002 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-43000 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-43006 (n/a)
Donglify
https://nvd.nist.gov/vuln/detail/CVE-2021-42994 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42996 (n/a)
Eltima USB Network Gate
https://nvd.nist.gov/vuln/detail/CVE-2021-42988 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42987 (n/a)
FlexiHub
https://nvd.nist.gov/vuln/detail/CVE-2021-42993 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42990 (n/a)
NoMachine (Cloud) Server / Desktop / Enterprise Client
https://nvd.nist.gov/vuln/detail/CVE-2021-42972 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42986 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42983 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42980 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42979 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42977 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42976 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42973 (n/a)
https://nvd.nist.gov/vuln/detail/CVE-2021-42972 (n/a)
Medium
Solarwinds Serv-U
https://nvd.nist.gov/vuln/detail/CVE-2021-35245 (6.8)
Kaseya Unitrends Backup Appliance
https://nvd.nist.gov/vuln/detail/CVE-2021-43039 (6.5)
https://nvd.nist.gov/vuln/detail/CVE-2021-43043 (6.5)
Huawei eCNS280_TD
https://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20211208-01-informationleak-en (6.5)
Fortinet FortiOS / FortiProxy
https://www.fortiguard.com/psirt/FG-IR-20-158 (6.2)
Fortinet FortiWLM
https://www.fortiguard.com/psirt/FG-IR-21-114 (6.1)
https://www.fortiguard.com/psirt/FG-IR-21-111 (5.1)
Dell Wyse Device Agent
https://www.dell.com/support/kbdoc/nl-nl/000193151/dsa-2021-232 (5.5)
F5 NGINX ModSecurity WAF
https://nvd.nist.gov/vuln/detail/CVE-2021-42717 (5.3)
Huawei CloudEngine
https://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20211208-01-memleak-en (5.3)
Fortinet FortiSandbox / FortiWeb / FortiADC / FortiMail
https://www.fortiguard.com/psirt/FG-IR-20-222 (5.0)