February 2021
1,557 CVEs published, −21% on January 2021 and +4% on February 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 23115% of the 1,497 with a CVSS score
- Added to CISA KEV
- 019 of this month's CVEs are in KEV, listed a median 268 days after publication
- Vendors
- 6023,211 products
- Top weakness
- XSSCWE-79 · 142 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libmysofa115172new
- 2MicrosoftMicrosoft Edge, Windows Server 2019, Windows Server Version 2004103142new
- 3Ао "нппкт"Осон Основа Оnyx102181new
- 4GoogleAndroid, Google Chrome, Chrome101121new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition9271new
- 6FedoraprojectFedora, Extra Packages For Enterprise Linux82171new
- 7CiscoCisco Small Business RV Series Router Firmware, RV325 Dual Gigabit Wan VPN Router Firmware, Cisco Small Business RV0167511nonenew
- 8Ао «концерн Вниинс»Ос Он «стрелец»68101new
- 9Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт 8 Сп Рабочая Станция64121new
- 10npmMarked, Lodash, Lodash-es63131new
- 11DebianDebian Linux62102new
- 12IntelGraphics Drivers, Intel Graphics Driver, Ethernet Network Adapter E810 Firmware620nonenew
- 13AdobeAdobe Acrobat Reader 2020, Acrobat, Acrobat Dc5361new
- 14Novell Inc.Opensuse Leap, Suse Package Hub For Suse Linux Enterprise, Suse Linux Enterprise Server4541new
- 15MavenOrg.jenkins-ci.plugins:claim, Com.adobe.acs:acs-aem-commons, Io.undertow:undertow-core443nonenew
- 16FiberhomeHG6245D Firmware, AN5506-04-FA Firmware4132nonenew
- 17IBMSecurity Verify Information Queue, Security Identity Governance and Intelligence, API Connect400nonenew
- 18Fedora ProjectFedora33101new
- 19PackagistMagento/community-edition, Magento/project-community-edition, Vrana/adminer3191new
- 20SiemensJT2GO, Teamcenter Visualization, Solid Edge SE2020 Firmware311nonenew
- 21PyPISalt, Matrix-synapse, Apache-airflow308nonenew
- 22QualcommSMB1390 Firmware, QET4101 Firmware, SMR526 Firmware296nonenew
- 23Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking296nonenew
- 24Ооо «ред Софт»Ред Ос272nonenew
- 25JetbrainsYoutrack, Teamcity, Ktor261nonenew
Severity
How this month's CVEs score on CVSS; 60 have no score yet. Severity is not exploitation.
- Critical231
- High625
- Medium597
- Low44
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS142
- CWE-787Out-of-bounds Write138
- CWE-78OS Command Injection61
- CWE-20Improper Input Validation49
- CWE-89SQL Injection46
- CWE-12144
- CWE-798Hard-coded Credentials43
- CWE-125Out-of-bounds Read42
- CWE-22Path Traversal41
- CWE-416Use After Free40
- CWE-120Buffer Overflow29
- CWE-352CSRF29
- CWE-400Resource Consumption29
- CWE-119Memory Buffer Bounds26
- CWE-269Improper Privilege Mgmt24
- CWE-918SSRF22
- CWE-190Integer Overflow21
- CWE-312Cleartext Storage20
- CWE-476NULL Pointer Dereference20
- CWE-200Information Exposure19
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems34216% of sector-tagged CVEs
- OSS Libraries32015% of sector-tagged CVEs
- Enterprise Software25112% of sector-tagged CVEs
- Hardware Firmware1879% of sector-tagged CVEs
- Networking Infrastructure1698% of sector-tagged CVEs
- Consumer Software1457% of sector-tagged CVEs
- Mobile Apps1186% of sector-tagged CVEs
- Security Products1125% of sector-tagged CVEs
- Web & CMS Plugins904% of sector-tagged CVEs
- ICS / OT / IoT874% of sector-tagged CVEs
- Not yet classified87
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 78OS Command Injection | 20Improper Input Validation | 89SQL Injection | 121 | 798Hard-coded Credentials | 125Out-of-bounds Read | 22Path Traversal | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 2 | 16 | 1 | 6 | 1 | 1 | 3 | 12 | ||
| Ао «нппкт» | 15 | 5 | 3 | 14 | ||||||
| 26 | 5 | 2 | 19 | |||||||
| Microsoft Corp | 1 | 14 | 3 | 13 | ||||||
| Ооо «русбитех-астра» | 18 | 5 | 1 | 2 | 11 | |||||
| Microsoft | 1 | 5 | 2 | 8 | ||||||
| Fedoraproject | 1 | 14 | 1 | 3 | 1 | 2 | 4 | 6 | ||
| Cisco | 1 | 4 | 6 | 8 | 30 | 2 | ||||
| Cisco Systems Inc. | 1 | 4 | 6 | 8 | 30 | 2 | ||||
| Ао «концерн Вниинс» | 14 | 2 | 1 | 13 | ||||||
| Ао «ивк» | 8 | 2 | 1 | 10 | ||||||
| npm | 3 | 1 | 12 | 1 | 2 |
CVEs published in February 2021
22 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2020-25506D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.KEV9.8
- CVE-2021-20016A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information....KEV9.8
- CVE-2021-21972The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands wi...KEV9.8
- CVE-2021-22502Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR s...KEV9.8
- CVE-2021-27101Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.KEV9.8
- CVE-2021-27103Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.KEV9.8
- CVE-2021-27104Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.KEV9.8
- CVE-2021-21017Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionKEV8.8
- CVE-2021-21148Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2021-25296Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sa...KEV8.8
- CVE-2021-25297Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitizati...KEV8.8
- CVE-2021-25298Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper saniti...KEV8.8
- CVE-2021-23874McAfee Total Protection (MTP) privilege escalation vulnerabilityKEV8.2
- CVE-2021-1732Windows Win32k Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-27102Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.KEV7.8
- CVE-2020-2506improper access control vulnerability in HelpdeskKEV7.3
- CVE-2021-21311SSRF in adminerKEV7.2
- CVE-2021-21315Command Injection VulnerabilityKEV7.1
- CVE-2021-21973The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port ...KEV5.3
- CVE-2021-25275SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable ...7.8
- CVE-2021-3282HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.7.5
- CVE-2021-24084Windows Mobile Device Management Information Disclosure Vulnerability5.5