Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2021

116 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2021-25157
    22Monitor

    A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4

    MediumCVSS 4.9Proof of conceptEPSS 10%

    arubanetworks · instantMar 29, 2021

  • CVE-2021-25158
    32Monitor

    A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5

    MediumCVSS 5.9Proof of conceptEPSS 30%

    arubanetworks · instantMar 29, 2021

  • CVE-2021-25159
    30Monitor

    A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Ins

    MediumCVSS 6.5Proof of conceptEPSS 12%

    arubanetworks · instantMar 29, 2021

  • CVE-2021-25161
    29Monitor

    A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Inst

    MediumCVSS 6.1Proof of conceptEPSS 16%

    arubanetworks · instantMar 29, 2021

  • CVE-2021-25162
    40Plan

    A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba

    HighCVSS 8.1Proof of conceptEPSS 25%

    arubanetworks · instantMar 29, 2021

  • CVE-2021-26919
    46Plan

    Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.

    HighCVSS 8.8No exploitEPSS 35%

    apache · druidMar 30, 2021

  • CVE-2021-21628
    45Plan

    Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scri

    MediumCVSS 5.4No exploitEPSS 81%

    jenkins · build with parametersMar 30, 2021

  • CVE-2021-21630
    43Plan

    Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-s

    MediumCVSS 5.4No exploitEPSS 72%

    jenkins · extra columnsMar 30, 2021

  • CVE-2020-24391
    61This week

    mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way.

    CriticalCVSS 9.8Proof of conceptEPSS 74%

    mongo-express project · mongo-expressMar 30, 2021

  • CVE-2021-22986
    99Now

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    f5 · big-ip access policy managerMar 31, 2021

  • CVE-2021-22988
    38Monitor

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and

    HighCVSS 8.8No exploitEPSS 10%

    f5 · big-ip access policy managerMar 31, 2021

  • CVE-2021-22987
    43Plan

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and

    CriticalCVSS 9.9No exploitEPSS 13%

    f5 · big-ip access policy managerMar 31, 2021

  • CVE-2021-22992
    59Plan

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and

    CriticalCVSS 9.8No exploitEPSS 67%

    f5 · big-ip access policy managerMar 31, 2021

  • CVE-2021-21983
    47Plan

    Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious act

    MediumCVSS 6.5WeaponizedEPSS 68%

    vmware · cloud foundationMar 31, 2021

  • CVE-2021-22991
    88Now

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3,

    CriticalCVSS 9.8KEVWeaponizedEPSS 62%

    f5 · big-ip access policy managerMar 31, 2021

  • CVE-2021-21975
    83Now

    Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access

    HighCVSS 7.5KEVWeaponizedEPSS 78%

    vmware · cloud foundationMar 31, 2021