Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2021

76 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-31813
    44Plan

    Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user

    MediumCVSS 5.4No exploitEPSS 78%

    zohocorp · manageengine applications managerJul 1, 2021

  • CVE-2021-35336
    42Plan

    Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control.

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    tieline · ip audtio gateway firmwareJul 1, 2021

  • CVE-2021-35042
    52Plan

    Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    djangoproject · djangoJul 2, 2021

  • CVE-2021-30554
    67This week

    Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craft

    HighCVSS 8.8KEVWeaponizedEPSS 7%

    google · chromeJul 2, 2021

  • CVE-2021-30557
    39Monitor

    Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extensio

    HighCVSS 8.8No exploitEPSS 11%

    google · chromeJul 2, 2021

  • CVE-2021-34527
    95Now

    Windows Print Spooler Remote Code Execution Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    microsoft · windows 10 1507Jul 2, 2021

  • CVE-2021-24405
    29Monitor

    Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting

    MediumCVSS 6.5Proof of conceptEPSS 10%

    izsoft · easy cookies policyJul 6, 2021

  • CVE-2021-34621
    60This week

    ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    properfraction · profilepressJul 7, 2021

  • CVE-2020-24148
    40Plan

    Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a

    CriticalCVSS 9.1Proof of conceptEPSS 14%

    mooveagency · import xml and rss feedsJul 7, 2021

  • CVE-2021-33216
    43Plan

    An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    commscope · ruckus iot controllerJul 7, 2021

  • CVE-2021-33221
    56Plan

    An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    commscope · ruckus iot controllerJul 7, 2021

  • CVE-2021-22555
    85Now

    Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

    HighCVSS 7.8KEVWeaponizedEPSS 78%

    linux · linux kernelJul 7, 2021

  • CVE-2021-28809
    44Plan

    Missing Authentication for Critical Function in RTRR Server in HBS3

    CriticalCVSS 9.8No exploitEPSS 16%

    qnap · hybrid backup syncJul 8, 2021

  • CVE-2021-1585
    38Monitor

    Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability

    HighCVSS 8.1Proof of conceptEPSS 19%

    cisco · adaptive security device managerJul 8, 2021

  • CVE-2021-30116
    95Now

    Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6

    CriticalCVSS 9.8KEVWeaponizedEPSS 85%

    kaseya · vsa agentJul 9, 2021

  • CVE-2021-30117
    57Plan

    Authenticated SQL injection in Kaseya VSA < v9.5.6

    HighCVSS 8.8No exploitEPSS 72%

    kaseya · vsaJul 9, 2021

  • CVE-2021-30118
    57Plan

    Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    kaseya · vsaJul 9, 2021

  • CVE-2021-30119
    37Monitor

    Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6

    MediumCVSS 5.4No exploitEPSS 53%

    kaseya · vsaJul 9, 2021

  • CVE-2021-30201
    38Monitor

    Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6

    HighCVSS 7.5No exploitEPSS 26%

    kaseya · vsaJul 9, 2021

  • CVE-2021-22918
    28Monitor

    Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII.

    MediumCVSS 5.3No exploitEPSS 23%

    nodejs · node.jsJul 12, 2021

  • CVE-2021-35064
    60This week

    KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo.

    CriticalCVSS 9.8Proof of conceptEPSS 70%

    kramerav · viawareJul 12, 2021

  • CVE-2021-33807
    35Monitor

    Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.

    HighCVSS 7.5Proof of conceptEPSS 16%

    gespage · gespageJul 12, 2021

  • CVE-2021-33037
    43Plan

    Incorrect Transfer-Encoding handling with HTTP/1.0

    MediumCVSS 5.3No exploitEPSS 74%

    apache · tomcatJul 12, 2021

  • CVE-2021-24442
    53Plan

    Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 45%

    wpdevart · poll\, survey\, questionnaire and voting systemJul 12, 2021

  • CVE-2021-35515
    33Monitor

    Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

    HighCVSS 7.5No exploitEPSS 11%

    apache · commons compressJul 13, 2021

  • CVE-2021-35516
    34Monitor

    Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

    HighCVSS 7.5No exploitEPSS 12%

    apache · commons compressJul 13, 2021

  • CVE-2021-35517
    33Monitor

    Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

    HighCVSS 7.5No exploitEPSS 10%

    apache · commons compressJul 13, 2021

  • CVE-2021-36090
    34Monitor

    Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

    HighCVSS 7.5No exploitEPSS 12%

    apache · commons compressJul 13, 2021

  • CVE-2021-31196
    74This week

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 7.2KEVWeaponizedEPSS 54%

    microsoft · exchange serverJul 14, 2021

  • CVE-2021-31206
    34Monitor

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 7.6Proof of conceptEPSS 13%

    microsoft · exchange serverJul 14, 2021

  • CVE-2021-31979
    62This week

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    microsoft · windows 10 1507Jul 14, 2021

  • CVE-2021-33766
    88Now

    Microsoft Exchange Server Information Disclosure Vulnerability

    HighCVSS 7.3KEVWeaponizedEPSS 98%

    microsoft · exchange serverJul 14, 2021

  • CVE-2021-33771
    64This week

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 10%

    microsoft · windows 10 1507Jul 14, 2021

  • CVE-2021-34473
    96Now

    Microsoft Exchange Server Remote Code Execution Vulnerability

    CriticalCVSS 9.1KEVWeaponizedEPSS 99%

    microsoft · exchange serverJul 14, 2021

  • CVE-2021-34501
    47Plan

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 51%

    microsoft · 365 appsJul 14, 2021

  • CVE-2021-34523
    96Now

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    CriticalCVSS 9.0KEVWeaponizedEPSS 99%

    microsoft · exchange serverJul 14, 2021

  • CVE-2021-35211
    97Now

    Serv-U Remote Memory Escape Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 91%

    solarwinds · serv-uJul 14, 2021

  • CVE-2020-25736
    40Plan

    Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configurati

    HighCVSS 7.8WeaponizedEPSS 2%

    acronis · true imageJul 15, 2021

  • CVE-2021-34429
    60This week

    For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con

    MediumCVSS 5.3WeaponizedEPSS 99%

    eclipse · jettyJul 15, 2021

  • CVE-2021-21799
    28Monitor

    Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

    MediumCVSS 6.1Proof of conceptEPSS 12%

    advantech · r-seenetJul 16, 2021

  • CVE-2021-21800
    28Monitor

    Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

    MediumCVSS 6.1Proof of conceptEPSS 14%

    advantech · r-seenetJul 16, 2021

  • CVE-2021-21801
    43Plan

    This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.

    MediumCVSS 6.1Proof of conceptEPSS 63%

    advantech · r-seenetJul 16, 2021

  • CVE-2021-21816
    27Monitor

    An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03.

    MediumCVSS 4.3Proof of conceptEPSS 32%

    dlink · dir-3040 firmwareJul 16, 2021

  • CVE-2021-28114
    37Monitor

    Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

    MediumCVSS 5.4No exploitEPSS 52%

    froala · froala editorJul 16, 2021

  • CVE-2021-34448
    69This week

    Scripting Engine Memory Corruption Vulnerability

    MediumCVSS 6.8KEVWeaponizedEPSS 40%

    microsoft · windows 10 1507Jul 16, 2021

  • CVE-2021-34481
    49Plan

    Windows Print Spooler Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 47%

    microsoft · windows 10Jul 16, 2021

  • CVE-2021-35449
    40Plan

    The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1

    HighCVSS 7.8WeaponizedEPSS 1%

    lexmark · g2 driverJul 19, 2021

  • CVE-2021-2456
    63This week

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).

    CriticalCVSS 9.8Proof of conceptEPSS 81%

    oracle · business intelligenceJul 20, 2021

  • CVE-2021-22145
    49Plan

    A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting.

    MediumCVSS 6.5WeaponizedEPSS 76%

    elastic · elasticsearchJul 21, 2021

  • CVE-2021-22146
    41Plan

    All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.

    HighCVSS 7.5Proof of conceptEPSS 35%

    elastic · elasticsearchJul 21, 2021

  • CVE-2021-22707
    58Plan

    A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlin

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    schneider-electric · evlink city evc1s22p4 firmwareJul 21, 2021

  • CVE-2021-22784
    26Monitor

    A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker

    MediumCVSS 5.7No exploitEPSS 12%

    schneider-electric · c-bus toolkitJul 21, 2021

  • CVE-2021-2391
    45Plan

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Scheduler).

    HighCVSS 8.8No exploitEPSS 34%

    oracle · bi publisherJul 21, 2021

  • CVE-2021-2394
    62This week

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    CriticalCVSS 9.8Proof of conceptEPSS 76%

    oracle · weblogic serverJul 21, 2021

  • CVE-2021-2396
    46Plan

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

    HighCVSS 8.8No exploitEPSS 35%

    oracle · bi publisherJul 21, 2021

  • CVE-2021-2400
    55Plan

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

    HighCVSS 7.5No exploitEPSS 83%

    oracle · bi publisherJul 21, 2021

  • CVE-2021-2401
    46Plan

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).

    MediumCVSS 5.3No exploitEPSS 84%

    oracle · bi publisherJul 21, 2021

  • CVE-2021-2429
    35Monitor

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

    MediumCVSS 5.9No exploitEPSS 41%

    oracle · mysql serverJul 21, 2021

  • CVE-2021-32761
    41Plan

    Integer overflow issues with *BIT commands on 32-bit systems

    HighCVSS 7.5No exploitEPSS 36%

    redislabs · redisJul 21, 2021

  • CVE-2021-36934
    81Now

    Windows Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 67%

    microsoft · windows 10 1809Jul 22, 2021

  • CVE-2015-2098
    39Monitor

    Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to th

    HighCVSS 8.8Proof of conceptEPSS 13%

    webgateinc · edvr managerJul 22, 2021

  • CVE-2015-2099
    39Monitor

    Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetR

    HighCVSS 8.8Proof of conceptEPSS 14%

    webgateinc · control centerJul 22, 2021

  • CVE-2021-33032
    56Plan

    A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 an

    CriticalCVSS 10.0No exploitEPSS 52%

    eq-3 · homematic ccu2 firmwareJul 22, 2021

  • CVE-2021-35464
    99Now

    ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    forgerock · access managementJul 22, 2021

  • CVE-2020-7387
    60This week

    Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor

    MediumCVSS 5.3WeaponizedEPSS 34%

    sage · adxadminJul 22, 2021

  • CVE-2020-7388
    60This week

    Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing

    CriticalCVSS 9.8WeaponizedEPSS 69%

    sage · adxadminJul 22, 2021

  • CVE-2021-36222
    33Monitor

    ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 a

    HighCVSS 7.5No exploitEPSS 10%

    mit · kerberos 5Jul 22, 2021

  • CVE-2021-32789
    35Monitor

    Arbitrary SQL (SQL injection) possible via the Store API component.

    HighCVSS 7.5Proof of conceptEPSS 17%

    automattic · woocommerce blocksJul 26, 2021

  • CVE-2020-36239
    54Plan

    Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 b

    CriticalCVSS 9.8No exploitEPSS 49%

    atlassian · jira data centerJul 29, 2021

  • CVE-2021-36741
    66This week

    An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 1

    HighCVSS 8.8KEVWeaponizedEPSS 4%

    trendmicro · officescanJul 29, 2021

  • CVE-2021-36742
    61This week

    A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    trendmicro · officescanJul 29, 2021

  • CVE-2021-28966
    47Plan

    In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.

    HighCVSS 7.5No exploitEPSS 58%

    ruby-lang · rubyJul 30, 2021

  • CVE-2021-32610
    50Plan

    In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

    HighCVSS 7.1No exploitEPSS 73%

    php · archive tarJul 30, 2021

  • CVE-2021-35478
    44Plan

    Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.

    MediumCVSS 5.4No exploitEPSS 76%

    nagios · log serverJul 30, 2021

  • CVE-2021-35479
    25Monitor

    Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affect

    MediumCVSS 5.4No exploitEPSS 13%

    nagios · log serverJul 30, 2021

  • CVE-2021-36754
    49Plan

    PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a

    HighCVSS 7.5Proof of conceptEPSS 64%

    powerdns · authoritative serverJul 30, 2021