Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2021

152 records · 19 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2021-25297
    82Now

    Nagios XI version xi-5.7.5 is affected by OS command injection.

    HighCVSS 8.8KEVWeaponizedEPSS 56%

    nagios · nagios xiFeb 15, 2021

  • CVE-2021-25298
    87Now

    Nagios XI version xi-5.7.5 is affected by OS command injection.

    HighCVSS 8.8KEVWeaponizedEPSS 73%

    nagios · nagios xiFeb 15, 2021

  • CVE-2021-25299
    53Plan

    Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).

    MediumCVSS 6.1Proof of conceptEPSS 97%

    nagios · nagios xiFeb 15, 2021

  • CVE-2020-35775
    43Plan

    CITSmart before 9.1.2.23 allows LDAP Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    citsmart · citsmartFeb 15, 2021

  • CVE-2021-23336
    35Monitor

    The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2

    MediumCVSS 5.9No exploitEPSS 40%

    python · pythonFeb 15, 2021

  • CVE-2021-23337
    34Monitor

    Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

    HighCVSS 7.2Proof of conceptEPSS 21%

    lodash · lodashFeb 15, 2021

  • CVE-2020-22427
    32Monitor

    NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability.

    HighCVSS 7.2No exploitEPSS 14%

    nagios · nagios xiFeb 15, 2021

  • CVE-2020-24899
    40Plan

    Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability.

    HighCVSS 8.8No exploitEPSS 16%

    nagios · nagios xiFeb 15, 2021

  • CVE-2020-28337
    33Monitor

    A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code exec

    HighCVSS 7.2Proof of conceptEPSS 16%

    microweber · microweberFeb 15, 2021

  • CVE-2021-3239
    45Plan

    E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code o

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    e-learning system project · e-learning systemFeb 15, 2021

  • CVE-2021-21315
    88Now

    Command Injection Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 90%

    systeminformation · systeminformationFeb 16, 2021

  • CVE-2021-23840
    45Plan

    Integer overflow in CipherUpdate

    HighCVSS 7.5Proof of conceptEPSS 50%

    openssl · opensslFeb 16, 2021

  • CVE-2021-27101
    71This week

    Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html.

    CriticalCVSS 9.8KEVWeaponizedEPSS 5%

    accellion · ftaFeb 16, 2021

  • CVE-2021-27102
    62This week

    Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call.

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    accellion · ftaFeb 16, 2021

  • CVE-2021-27103
    72This week

    Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html.

    CriticalCVSS 9.8KEVWeaponizedEPSS 11%

    accellion · ftaFeb 16, 2021

  • CVE-2021-27104
    86Now

    Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints.

    CriticalCVSS 9.8KEVWeaponizedEPSS 56%

    accellion · ftaFeb 16, 2021

  • CVE-2021-27224
    41Plan

    The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x0000000000012ec6, which might allo

    HighCVSS 7.5No exploitEPSS 37%

    irfanview · wpgFeb 17, 2021

  • CVE-2020-8625
    51Plan

    A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

    HighCVSS 8.1No exploitEPSS 64%

    isc · bindFeb 17, 2021

  • CVE-2020-28463
    26Monitor

    Server-side Request Forgery (SSRF)

    MediumCVSS 6.5No exploitEPSS 1%

    reportlab · reportlabFeb 18, 2021

  • CVE-2021-26747
    55Plan

    Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execut

    CriticalCVSS 9.8No exploitEPSS 54%

    netis-systems · wf2780 firmwareFeb 18, 2021

  • CVE-2019-25024
    47Plan

    OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_servic

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    alleghenycreative · openrepeaterFeb 19, 2021

  • CVE-2021-27513
    44Plan

    The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le

    HighCVSS 8.8Proof of conceptEPSS 28%

    eyesofnetwork · eyesofnetworkFeb 21, 2021

  • CVE-2021-26120
    64This week

    Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.

    CriticalCVSS 9.8No exploitEPSS 82%

    smarty · smartyFeb 21, 2021

  • CVE-2020-21224
    51Plan

    A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0.

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    inspur · clusterengineFeb 22, 2021

  • CVE-2021-3120
    50Plan

    An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers

    CriticalCVSS 9.8No exploitEPSS 36%

    yithemes · yith woocommerce gift cardsFeb 22, 2021

  • CVE-2020-29453
    27Monitor

    The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8

    MediumCVSS 5.3Proof of conceptEPSS 20%

    atlassian · data centerFeb 22, 2021

  • CVE-2020-28429
    58Plan

    All versions of package geojson2kml are vulnerable to Command Injection via the index.js file.

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    geojson2kml project · geojson2kmlFeb 23, 2021

  • CVE-2020-16243
    35Monitor

    Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files.

    HighCVSS 7.8No exploitEPSS 12%

    we-con · levistudiouFeb 23, 2021

  • CVE-2021-3407
    37Monitor

    A flaw was found in mupdf 1.18.0.

    MediumCVSS 5.5No exploitEPSS 50%

    artifex · mupdfFeb 23, 2021

  • CVE-2021-20660
    38Monitor

    Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via u

    MediumCVSS 6.1No exploitEPSS 47%

    contec · sv-cpt-mc310 firmwareFeb 24, 2021

  • CVE-2021-21616
    41Plan

    Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS)

    MediumCVSS 4.6No exploitEPSS 76%

    jenkins · active choicesFeb 24, 2021

  • CVE-2021-21618
    45Plan

    Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a store

    MediumCVSS 5.4No exploitEPSS 79%

    jenkins · repository connectorFeb 24, 2021

  • CVE-2021-21972
    99Now

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · cloud foundationFeb 24, 2021

  • CVE-2021-21973
    77This week

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Serv

    MediumCVSS 5.3KEVWeaponizedEPSS 88%

    vmware · cloud foundationFeb 24, 2021

  • CVE-2021-21974
    49Plan

    OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflo

    HighCVSS 8.8Proof of conceptEPSS 45%

    vmware · cloud foundationFeb 24, 2021

  • CVE-2021-1388
    44Plan

    Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability

    CriticalCVSS 10.0No exploitEPSS 14%

    cisco · aci multi-site orchestratorFeb 24, 2021

  • CVE-2020-11987
    36Monitor

    Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel.

    HighCVSS 8.2No exploitEPSS 13%

    apache · batikFeb 24, 2021

  • CVE-2021-27670
    57Plan

    Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 61%

    appspace · appspaceFeb 24, 2021

  • CVE-2021-1732
    85Now

    Windows Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 78%

    microsoft · windows 10 1803Feb 25, 2021

  • CVE-2021-24074
    47Plan

    Windows TCP/IP Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 26%

    microsoft · windows 10Feb 25, 2021

  • CVE-2021-24078
    43Plan

    Windows DNS Server Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 11%

    microsoft · windows server 2008Feb 25, 2021

  • CVE-2021-24086
    48Plan

    Windows TCP/IP Denial of Service Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 58%

    microsoft · windows 10Feb 25, 2021

  • CVE-2021-24093
    49Plan

    Windows Graphics Component Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 45%

    microsoft · windows 10Feb 25, 2021

  • CVE-2021-24094
    46Plan

    Windows TCP/IP Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 22%

    microsoft · windows 10Feb 25, 2021

  • CVE-2021-26701
    41Plan

    .NET Core Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 30%

    microsoft · .netFeb 25, 2021

  • CVE-2020-27223
    44Plan

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept

    MediumCVSS 5.3Proof of conceptEPSS 78%

    eclipse · jettyFeb 26, 2021

  • CVE-2021-27198
    43Plan

    An issue was discovered in Visualware MyConnection Server before v11.1a.

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    visualware · myconnection serverFeb 26, 2021

  • CVE-2021-25281
    61This week

    An issue was discovered in through SaltStack Salt before 3002.5.

    CriticalCVSS 9.8WeaponizedEPSS 72%

    saltstack · saltFeb 27, 2021

  • CVE-2021-25282
    64This week

    An issue was discovered in through SaltStack Salt before 3002.5.

    CriticalCVSS 9.1WeaponizedEPSS 92%

    saltstack · saltFeb 27, 2021

  • CVE-2021-25283
    42Plan

    An issue was discovered in through SaltStack Salt before 3002.5.

    CriticalCVSS 9.8No exploitEPSS 10%

    saltstack · saltFeb 27, 2021

  • CVE-2021-3197
    61This week

    An issue was discovered in SaltStack Salt before 3002.5.

    CriticalCVSS 9.8No exploitEPSS 71%

    saltstack · saltFeb 27, 2021

  • CVE-2021-27132
    44Plan

    SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposi

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    sercomm · agcombo vd625 firmwareFeb 27, 2021