Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2021

75 records · 15 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-27828
    42Plan

    SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content

    CriticalCVSS 9.1Proof of conceptEPSS 20%

    in4velocity · in4suite erpJun 1, 2021

  • CVE-2021-23017
    46Plan

    A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cau

    HighCVSS 7.7Proof of conceptEPSS 53%

    f5 · nginxJun 1, 2021

  • CVE-2021-24320
    27Monitor

    Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS

    MediumCVSS 6.1Proof of conceptEPSS 10%

    bold-themes · belloJun 1, 2021

  • CVE-2021-24321
    59Plan

    Bello < 1.6.0 - Unauthenticated Blind SQL Injection

    CriticalCVSS 9.8No exploitEPSS 66%

    bold-themes · belloJun 1, 2021

  • CVE-2021-25641
    45Plan

    Dubbo Zookeeper does not check serialization id

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    apache · dubboJun 1, 2021

  • CVE-2021-30180
    57Plan

    Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    apache · dubboJun 1, 2021

  • CVE-2021-30181
    57Plan

    Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    apache · dubboJun 1, 2021

  • CVE-2021-31642
    39Monitor

    A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, an

    MediumCVSS 6.5Proof of conceptEPSS 43%

    chiyu-tech · semac s2 firmwareJun 1, 2021

  • CVE-2021-31643
    48Plan

    An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a la

    MediumCVSS 5.4No exploitEPSS 88%

    chiyu-tech · bf-631 firmwareJun 1, 2021

  • CVE-2021-32924
    41Plan

    Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\fr

    HighCVSS 8.8No exploitEPSS 19%

    invisioncommunity · ips community suiteJun 1, 2021

  • CVE-2021-22123
    60This week

    An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a r

    HighCVSS 8.8Proof of conceptEPSS 84%

    fortinet · fortiwebJun 1, 2021

  • CVE-2021-3538
    40Plan

    A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7

    CriticalCVSS 9.8No exploitEPSS 2%

    satori · uuidJun 2, 2021

  • CVE-2020-6950
    29Monitor

    Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

    MediumCVSS 6.5Proof of conceptEPSS 10%

    eclipse · mojarraJun 2, 2021

  • CVE-2021-3490
    40Plan

    Linux kernel eBPF bitwise ops ALU32 bounds tracking

    HighCVSS 7.8WeaponizedEPSS 27%

    linux · linux kernelJun 3, 2021

  • CVE-2021-31249
    31Monitor

    A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of

    MediumCVSS 6.5Proof of conceptEPSS 18%

    chiyu-tech · bf-430 firmwareJun 4, 2021

  • CVE-2021-31250
    45Plan

    Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to

    MediumCVSS 5.4Proof of conceptEPSS 79%

    chiyu-tech · bf-430 firmwareJun 4, 2021

  • CVE-2021-31251
    50Plan

    An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows o

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    chiyu-tech · bf-430 firmwareJun 4, 2021

  • CVE-2021-31252
    33Monitor

    An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology

    MediumCVSS 6.1No exploitEPSS 28%

    chiyu-tech · bf-430 firmwareJun 4, 2021

  • CVE-2021-24340
    39Monitor

    WP Statistics < 13.0.8 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 29%

    veronalabs · wp statisticsJun 7, 2021

  • CVE-2021-30533
    61This week

    Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restri

    MediumCVSS 6.5KEVWeaponizedEPSS 16%

    google · chromeJun 7, 2021

  • CVE-2021-30538
    22Monitor

    Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten

    MediumCVSS 4.3No exploitEPSS 15%

    google · chromeJun 7, 2021

  • CVE-2021-32671
    52Plan

    XSS vulnerability with translator

    CriticalCVSS 10.0No exploitEPSS 39%

    flarum · flarumJun 7, 2021

  • CVE-2021-3277
    44Plan

    Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in

    HighCVSS 7.2No exploitEPSS 54%

    nagios · nagios xiJun 7, 2021

  • CVE-2021-30357
    28Monitor

    SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows p

    MediumCVSS 5.3Proof of conceptEPSS 22%

    checkpoint · ssl network extenderJun 8, 2021

  • CVE-2021-22214
    42Plan

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all ve

    HighCVSS 8.6Proof of conceptEPSS 27%

    gitlab · gitlabJun 8, 2021

  • CVE-2021-31807
    40Plan

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.

    MediumCVSS 6.5WeaponizedEPSS 15%

    squid-cache · squidJun 8, 2021

  • CVE-2021-1675
    87Now

    Windows Print Spooler Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 85%

    microsoft · windows 10 1507Jun 8, 2021

  • CVE-2021-26414
    34Monitor

    Windows DCOM Server Security Feature Bypass

    MediumCVSS 4.8Proof of conceptEPSS 49%

    microsoft · windows 10Jun 8, 2021

  • CVE-2021-31199
    51Plan

    Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

    MediumCVSS 5.2KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Jun 8, 2021

  • CVE-2021-31201
    51Plan

    Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

    MediumCVSS 5.2KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Jun 8, 2021

  • CVE-2021-31939
    35Monitor

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 13%

    microsoft · 365 appsJun 8, 2021

  • CVE-2021-31955
    76This week

    Windows Kernel Information Disclosure Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 81%

    microsoft · windows 10 1809Jun 8, 2021

  • CVE-2021-31956
    68This week

    Windows NTFS Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 22%

    microsoft · windows 10 1507Jun 8, 2021

  • CVE-2021-33739
    65This week

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    HighCVSS 8.4KEVWeaponizedEPSS 6%

    microsoft · windows 10 1909Jun 8, 2021

  • CVE-2021-33742
    78This week

    Windows MSHTML Platform Remote Code Execution Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 59%

    microsoft · windows 10 1507Jun 8, 2021

  • CVE-2021-28169
    45Plan

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to a

    MediumCVSS 5.3Proof of conceptEPSS 78%

    eclipse · jettyJun 8, 2021

  • CVE-2020-11261
    61This week

    Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto,

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    qualcomm · apq8009 firmwareJun 9, 2021

  • CVE-2021-33357
    44Plan

    A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter va

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    raspap · raspapJun 9, 2021

  • CVE-2021-33393
    53Plan

    lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account.

    HighCVSS 8.8WeaponizedEPSS 59%

    ipfire · ipfireJun 9, 2021

  • CVE-2019-17567
    39Monitor

    mod_proxy_wstunnel tunneling of non Upgraded connections

    MediumCVSS 5.3No exploitEPSS 60%

    apache · http serverJun 10, 2021

  • CVE-2020-13938
    26Monitor

    Improper Handling of Insufficient Privileges

    MediumCVSS 5.5No exploitEPSS 11%

    apache · http serverJun 10, 2021

  • CVE-2020-13950
    45Plan

    mod_proxy_http NULL pointer dereference

    HighCVSS 7.5No exploitEPSS 49%

    apache · http serverJun 10, 2021

  • CVE-2020-35452
    45Plan

    mod_auth_digest possible stack overflow by one nul byte

    HighCVSS 7.3No exploitEPSS 54%

    apache · http serverJun 10, 2021

  • CVE-2021-26690
    50Plan

    mod_session NULL pointer dereference

    HighCVSS 7.5Proof of conceptEPSS 65%

    apache · http serverJun 10, 2021

  • CVE-2021-26691
    59Plan

    Apache HTTP Server mod_session response handling heap overflow

    CriticalCVSS 9.8No exploitEPSS 68%

    apache · http serverJun 10, 2021

  • CVE-2021-30641
    37Monitor

    Unexpected URL matching with 'MergeSlashes OFF'

    MediumCVSS 5.3No exploitEPSS 52%

    apache · http serverJun 10, 2021

  • CVE-2021-20081
    44Plan

    Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execut

    HighCVSS 7.2No exploitEPSS 52%

    zohocorp · manageengine servicedesk plusJun 10, 2021

  • CVE-2021-26828
    77This week

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP f

    HighCVSS 8.8KEVWeaponizedEPSS 39%

    scadabr · scadabrJun 11, 2021

  • CVE-2021-26829
    65This week

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

    MediumCVSS 5.4KEVWeaponizedEPSS 48%

    scadabr · scadabrJun 11, 2021

  • CVE-2021-25394
    55Plan

    A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio

    MediumCVSS 6.4KEVWeaponizedEPSS 0%

    samsung · androidJun 11, 2021

  • CVE-2021-25395
    55Plan

    A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privil

    MediumCVSS 6.4KEVWeaponizedEPSS 0%

    samsung · androidJun 11, 2021

  • CVE-2021-22175
    85Now

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions

    CriticalCVSS 9.8KEVWeaponizedEPSS 53%

    gitlab · gitlabJun 11, 2021

  • CVE-2021-22901
    51Plan

    curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session t

    HighCVSS 8.1No exploitEPSS 63%

    haxx · curlJun 11, 2021

  • CVE-2021-23394
    45Plan

    Remote Code Execution (RCE)

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    std42 · elfinderJun 13, 2021

  • CVE-2021-24347
    51Plan

    SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

    HighCVSS 8.8WeaponizedEPSS 54%

    smartypantsplugins · sp project \& document managerJun 14, 2021

  • CVE-2021-32682
    60This week

    Multiple vulnerabilities leading to RCE

    CriticalCVSS 9.8WeaponizedEPSS 69%

    std42 · elfinderJun 14, 2021

  • CVE-2021-31618
    45Plan

    NULL pointer dereference on specially crafted HTTP/2 request

    HighCVSS 7.5No exploitEPSS 51%

    apache · http serverJun 15, 2021

  • CVE-2021-30551
    84Now

    Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8KEVWeaponizedEPSS 64%

    google · chromeJun 15, 2021

  • CVE-2021-20093
    46Plan

    A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a.

    CriticalCVSS 9.1No exploitEPSS 33%

    wibu · codemeterJun 16, 2021

  • CVE-2021-33813
    36Monitor

    An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

    HighCVSS 7.5No exploitEPSS 19%

    jdom · jdomJun 16, 2021

  • CVE-2021-31159
    26Monitor

    Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the

    MediumCVSS 5.3Proof of conceptEPSS 17%

    zohocorp · manageengine servicedesk plus mspJun 16, 2021

  • CVE-2021-21667
    44Plan

    Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site

    MediumCVSS 5.4No exploitEPSS 75%

    jenkins · scriptlerJun 16, 2021

  • CVE-2021-21668
    44Plan

    Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability expl

    MediumCVSS 5.4No exploitEPSS 76%

    jenkins · scriptlerJun 16, 2021

  • CVE-2020-22208
    42Plan

    SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    74cms · 74cmsJun 16, 2021

  • CVE-2021-21669
    47Plan

    Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    CriticalCVSS 9.8No exploitEPSS 25%

    jenkins · generic webhook triggerJun 18, 2021

  • CVE-2021-24370
    53Plan

    Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    radykal · fancy product designerJun 21, 2021

  • CVE-2021-21998
    42Plan

    VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass.

    CriticalCVSS 9.8No exploitEPSS 10%

    vmware · carbon black app controlJun 23, 2021

  • CVE-2021-31586
    48Plan

    Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.

    HighCVSS 8.8No exploitEPSS 44%

    accellion · kiteworksJun 23, 2021

  • CVE-2021-21809
    43Plan

    A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10.

    CriticalCVSS 9.1WeaponizedEPSS 24%

    moodle · moodleJun 23, 2021

  • CVE-2021-28958
    61This week

    Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

    CriticalCVSS 9.8No exploitEPSS 73%

    zohocorp · manageengine adselfservice plusJun 25, 2021

  • CVE-2021-34427
    56Plan

    In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curre

    CriticalCVSS 9.8Proof of conceptEPSS 57%

    eclipse · business intelligence and reporting toolsJun 25, 2021

  • CVE-2021-34187
    44Plan

    main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    chamilo · chamiloJun 28, 2021

  • CVE-2021-35941
    34Monitor

    Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system f

    HighCVSS 7.5No exploitEPSS 12%

    westerndigital · wd my book live firmwareJun 29, 2021

  • CVE-2021-21672
    30Monitor

    Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    MediumCVSS 4.3No exploitEPSS 42%

    jenkins · selenium html reportJun 30, 2021

  • CVE-2021-36088
    40Plan

    Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).

    CriticalCVSS 9.8No exploitEPSS 2%

    treasuredata · fluent bitJun 30, 2021