Vulnerability Trends January 2021

Vulnerability Trends Summary

As part of our monthly vulnerability trends, this report shows the monthly top 10 trends on security vulnerabilities and how hackers, malware, and exploit kits are exploiting those vulnerabilities. To demonstrate, we assign vulnerability trends value as a percentage of how each vulnerability is significantly gaining the attention of cybersecurity communities, attackers, together with malware. In either case, companies can benefit from the report to have more cyber threat insights and relatively anticipate attacks wave that might target their public assets in the following months.

Subscribe to the monthly vulnerability digest report by clicking here.

Download the full vulnerability digest report by clicking here.

The following chart shows the trends.

Starting of 2021, we see a smaller number of vulnerabilities. However, still many remote code execution vulnerabilities in Jan 2021 were discovered and disclosed. The vulnerability with most interaction is SUDO remote code execution that is installed on most Linux environments.
The majority of Jan2021 vulnerabilities affect web technologies and frameworks like Laravel, WebLogic, TomCat, and ZendFramework.

The following table shows the details of the trends.

Subscribe to the monthly vulnerability digest report by clicking here.

Download the full vulnerability digest report by clicking here.

1. CVE-2021-3156 Remote Code Execution in SUDO

A heap overflow vulnerability exists in the common command sudo of Linux systems. That allows any local users to execute commands with root privilege.

2. CVE-2021-1647 Remote Code Execution in Windows Defender

A remote code execution exists in Malware Protection Engine component (mpengine.dll) of Windows Defender. This is a zero-day vulnerability as it is exploited in the wild. However, no technical analysis nor PoC is available yet.

3. CVE-2021-3011 Side Channel in Google Titan Security Key

An electromagnetic-wave side-channel issue was discovered on Google Titan Security Key (2FA token) that uses NXP security microcontrollers. It allows attackers to extract the ECDSA private key after extensive physical access and consequently produce a clone.

4. CVE-2021-23240 Remote Code Execution in SUDO

Links<linksA heap overflow vulnerability exists in the common command sudo of Linux systems. That allows any local users to execute commands with root privilege.

5. CVE-2021-3156 Privilege Escalation in SUDO

A vulnerability in sudoedit of Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target.

6. CVE-2021-2109 Remote Code Execution in Oracle WebLogic

A remote code execution vulnerability exists in console component of Oracle WebLogic Server. This vulnerability requires authentication.

7. CVE-2021-3007 Remote Code Execution in Zend Framework

Laminas and Zend Framework (Stream.php) has a deserialization vulnerability that can lead to remote code execution if the content is controllable by an attacker. NOTE: Zend Framework is no longer supported by the maintainer.

8. CVE-2021-3115 Command Execution in GoLang

Go language on Windows is vulnerable to Command Injection and remote code execution when using the “go get” command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

9. CVE-2021-24122 JSP Source code disclosure in Apache TomCat

Apache Tomcat has JSP source code disclosure in some configurations when it serves resources from network location using NTFS file system.

10. CVE-2021-3129 Remote Code Execution in Laravel

Remote code execution vulnerability exists in Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.