Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2021

92 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-24472
    56Plan

    Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    qantumthemes · kentharadioAug 2, 2021

  • CVE-2021-24488
    27Monitor

    Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 11%

    pickplugins · post gridAug 2, 2021

  • CVE-2021-26085
    81Now

    Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File

    MediumCVSS 5.3KEVWeaponizedEPSS 99%

    atlassian · confluence data centerAug 2, 2021

  • CVE-2021-31630
    43Plan

    Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on

    HighCVSS 8.8Proof of conceptEPSS 27%

    openplcproject · openplc v3 firmwareAug 3, 2021

  • CVE-2021-37556
    43Plan

    A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-pri

    HighCVSS 8.8No exploitEPSS 27%

    centreon · centreonAug 3, 2021

  • CVE-2021-37557
    43Plan

    A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-pri

    HighCVSS 8.8No exploitEPSS 27%

    centreon · centreonAug 3, 2021

  • CVE-2021-30560
    40Plan

    Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a

    HighCVSS 8.8No exploitEPSS 17%

    google · chromeAug 3, 2021

  • CVE-2021-30563
    68This week

    Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8KEVWeaponizedEPSS 9%

    google · chromeAug 3, 2021

  • CVE-2021-32804
    37Monitor

    Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

    HighCVSS 8.1Proof of conceptEPSS 15%

    tar project · tarAug 3, 2021

  • CVE-2020-19302
    40Plan

    An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing upl

    CriticalCVSS 9.8No exploitEPSS 1%

    vaethink · vaethinkAug 3, 2021

  • CVE-2021-34833
    60This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893.

    HighCVSS 7.8No exploitEPSS 95%

    foxit · pdf readerAug 4, 2021

  • CVE-2021-34842
    35Monitor

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893.

    HighCVSS 7.8No exploitEPSS 13%

    foxit · pdf readerAug 4, 2021

  • CVE-2021-34847
    49Plan

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893.

    HighCVSS 7.8No exploitEPSS 61%

    foxit · pdf readerAug 4, 2021

  • CVE-2021-34850
    42Plan

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893.

    HighCVSS 7.8No exploitEPSS 38%

    foxit · pdf readerAug 4, 2021

  • CVE-2021-32706
    53Plan

    (Authenticated) Remote Code Execution Possible in Web Interface 5.5

    HighCVSS 8.8WeaponizedEPSS 60%

    pi-hole · pi-holeAug 4, 2021

  • CVE-2021-20028
    78This week

    Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, s

    CriticalCVSS 9.8KEVWeaponizedEPSS 30%

    sonicwall · sma 210 firmwareAug 4, 2021

  • CVE-2021-34371
    43Plan

    Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSes

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    neo4j · neo4jAug 5, 2021

  • CVE-2021-21805
    60This week

    An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

    CriticalCVSS 9.8Proof of conceptEPSS 69%

    advantech · r-seenetAug 5, 2021

  • CVE-2021-35324
    42Plan

    A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication

    CriticalCVSS 9.8No exploitEPSS 10%

    totolink · a720r firmwareAug 5, 2021

  • CVE-2021-35325
    34Monitor

    A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial o

    HighCVSS 7.5No exploitEPSS 13%

    totolink · a720r firmwareAug 5, 2021

  • CVE-2021-22926
    35Monitor

    libcurl-using applications can ask for a specific client certificate to be used in a transfer.

    HighCVSS 7.5No exploitEPSS 15%

    haxx · curlAug 5, 2021

  • CVE-2021-24499
    57Plan

    Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    amentotech · workreapAug 9, 2021

  • CVE-2021-24507
    42Plan

    Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    brainstormforce · astraAug 9, 2021

  • CVE-2021-33256
    59Plan

    A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unaut

    HighCVSS 8.8No exploitEPSS 79%

    zohocorp · manageengine adselfservice plusAug 9, 2021

  • CVE-2021-37152
    28Monitor

    Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0.

    MediumCVSS 5.4Proof of conceptEPSS 24%

    sonatype · nexus repository managerAug 10, 2021

  • CVE-2021-37425
    56Plan

    Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or rea

    CriticalCVSS 9.1Proof of conceptEPSS 66%

    altova · mobiletogether serverAug 10, 2021

  • CVE-2021-38085
    40Plan

    The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue.

    HighCVSS 7.8WeaponizedEPSS 0%

    canon · pixma tr150 firmwareAug 11, 2021

  • CVE-2021-26424
    57Plan

    Windows TCP/IP Remote Code Execution Vulnerability

    CriticalCVSS 9.9No exploitEPSS 61%

    microsoft · windows 10Aug 12, 2021

  • CVE-2021-26432
    42Plan

    Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 11%

    microsoft · windows 10Aug 12, 2021

  • CVE-2021-34478
    46Plan

    Microsoft Office Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 51%

    microsoft · 365 appsAug 12, 2021

  • CVE-2021-34480
    37Monitor

    Scripting Engine Memory Corruption Vulnerability

    MediumCVSS 6.8No exploitEPSS 34%

    microsoft · windows 10Aug 12, 2021

  • CVE-2021-34484
    68This week

    Windows User Profile Service Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 21%

    microsoft · windows 10 1507Aug 12, 2021

  • CVE-2021-34486
    64This week

    Windows Event Tracing Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 9%

    microsoft · windows 10 1809Aug 12, 2021

  • CVE-2021-34535
    42Plan

    Remote Desktop Client Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 21%

    microsoft · remote desktop clientAug 12, 2021

  • CVE-2021-36942
    80Now

    Windows LSA Spoofing Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 66%

    microsoft · windows server 2004Aug 12, 2021

  • CVE-2021-36948
    68This week

    Windows Update Medic Service Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 23%

    microsoft · windows 10 1809Aug 12, 2021

  • CVE-2021-36958
    40Plan

    Windows Print Spooler Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 30%

    microsoft · windowsAug 12, 2021

  • CVE-2021-37343
    42Plan

    A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE unde

    HighCVSS 8.8WeaponizedEPSS 23%

    nagios · nagios xiAug 13, 2021

  • CVE-2021-37344
    68This week

    Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used

    CriticalCVSS 9.8No exploitEPSS 96%

    nagios · nagios xi switch wizardAug 13, 2021

  • CVE-2021-37346
    61This week

    Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements

    CriticalCVSS 9.8No exploitEPSS 73%

    nagios · nagios xi watchguard wizardAug 13, 2021

  • CVE-2021-37350
    63This week

    Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.

    CriticalCVSS 9.8No exploitEPSS 79%

    nagios · nagios xiAug 13, 2021

  • CVE-2021-36380
    98Now

    Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDia

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    sunhillo · surelineAug 13, 2021

  • CVE-2021-26086
    81Now

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilit

    MediumCVSS 5.3KEVWeaponizedEPSS 99%

    atlassian · jira data centerAug 15, 2021

  • CVE-2021-3708
    38Monitor

    D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection.

    HighCVSS 7.8No exploitEPSS 24%

    dlink · dsl-2750u firmwareAug 16, 2021

  • CVE-2021-33193
    44Plan

    Request splitting via HTTP/2 method injection and mod_proxy

    HighCVSS 7.5No exploitEPSS 46%

    debian · debian linuxAug 16, 2021

  • CVE-2021-35392
    55Plan

    Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.

    HighCVSS 7.5Proof of conceptEPSS 83%

    realtek · rtl819x jungle software development kitAug 16, 2021

  • CVE-2021-35393
    59Plan

    Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.

    CriticalCVSS 9.8No exploitEPSS 68%

    realtek · rtl819x jungle software development kitAug 16, 2021

  • CVE-2021-35394
    99Now

    Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    realtek · rtl819x jungle software development kitAug 16, 2021

  • CVE-2021-35395
    98Now

    Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    realtek · rtl819x jungle software development kitAug 16, 2021

  • CVE-2021-22931
    46Plan

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation

    CriticalCVSS 9.8No exploitEPSS 21%

    nodejs · node.jsAug 16, 2021

  • CVE-2021-22939
    25Monitor

    If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned an

    MediumCVSS 5.3No exploitEPSS 14%

    nodejs · node.jsAug 16, 2021

  • CVE-2021-22940
    34Monitor

    Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c

    HighCVSS 7.5No exploitEPSS 13%

    nodejs · node.jsAug 16, 2021

  • CVE-2021-34730
    45Plan

    Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    cisco · application extension platformAug 18, 2021

  • CVE-2021-34228
    33Monitor

    Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execut

    MediumCVSS 6.1No exploitEPSS 29%

    totolink · a3002r firmwareAug 20, 2021

  • CVE-2021-22238
    43Plan

    An issue has been discovered in GitLab affecting all versions starting with 13.3.

    MediumCVSS 5.4No exploitEPSS 71%

    gitlab · gitlabAug 20, 2021

  • CVE-2021-36748
    35Monitor

    A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote a

    HighCVSS 7.5Proof of conceptEPSS 15%

    prestahome · blogAug 20, 2021

  • CVE-2021-28635
    46Plan

    Adobe Acrobat Reader Use-After-Free Vulnerability

    HighCVSS 7.8No exploitEPSS 51%

    adobe · acrobat dcAug 20, 2021

  • CVE-2021-28639
    51Plan

    Adobe Acrobat Reader DC setAction Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 66%

    adobe · acrobat dcAug 20, 2021

  • CVE-2021-28640
    45Plan

    Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution Vulnerability

    HighCVSS 7.3No exploitEPSS 53%

    adobe · acrobat dcAug 20, 2021

  • CVE-2021-39144
    93Now

    XStream is vulnerable to a Remote Command Execution attack

    HighCVSS 8.5KEVWeaponizedEPSS 98%

    xstream · xstreamAug 23, 2021

  • CVE-2021-39608
    42Plan

    Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user e

    HighCVSS 7.2Proof of conceptEPSS 45%

    flatcore · flatcore-cmsAug 23, 2021

  • CVE-2021-39141
    39Monitor

    XStream is vulnerable to an Arbitrary Code Execution attack

    HighCVSS 8.5Proof of conceptEPSS 16%

    xstream · xstreamAug 23, 2021

  • CVE-2021-39146
    38Monitor

    XStream is vulnerable to an Arbitrary Code Execution attack

    HighCVSS 8.5Proof of conceptEPSS 14%

    xstream · xstreamAug 23, 2021

  • CVE-2021-39152
    37Monitor

    A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

    HighCVSS 8.5Proof of conceptEPSS 11%

    xstream · xstreamAug 23, 2021

  • CVE-2021-37538
    61This week

    Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to exec

    CriticalCVSS 9.8Proof of conceptEPSS 74%

    smartdatasoft · smartblogAug 24, 2021

  • CVE-2021-38556
    39Monitor

    includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

    HighCVSS 8.8No exploitEPSS 13%

    raspap · raspapAug 24, 2021

  • CVE-2021-3712
    44Plan

    Read buffer overruns processing ASN.1 strings

    HighCVSS 7.4Proof of conceptEPSS 50%

    openssl · opensslAug 24, 2021

  • CVE-2021-28554
    45Plan

    Adobe Acrobat Reader DC Path Parsing Out-Of-Bounds Read could lead to arbitrary code execution

    HighCVSS 7.8No exploitEPSS 46%

    adobe · acrobat dcAug 24, 2021

  • CVE-2021-3711
    65This week

    SM2 Decryption Buffer Overflow

    CriticalCVSS 9.8No exploitEPSS 87%

    openssl · opensslAug 24, 2021

  • CVE-2021-30858
    69This week

    A use after free issue was addressed with improved memory management.

    HighCVSS 8.8KEVWeaponizedEPSS 13%

    apple · ipadosAug 24, 2021

  • CVE-2021-30860
    84Now

    An integer overflow was addressed with improved input validation.

    HighCVSS 7.8KEVWeaponizedEPSS 75%

    apple · ipadosAug 24, 2021

  • CVE-2021-30869
    62This week

    A type confusion issue was addressed with improved state handling.

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    apple · ipadosAug 24, 2021

  • CVE-2021-30883
    65This week

    A memory corruption issue was addressed with improved memory handling.

    HighCVSS 7.8KEVWeaponizedEPSS 14%

    apple · ipadosAug 24, 2021

  • CVE-2021-30892
    25Monitor

    An inherited permissions issue was addressed with additional restrictions.

    MediumCVSS 5.5No exploitEPSS 10%

    apple · mac os xAug 24, 2021

  • CVE-2021-30900
    63This week

    An out-of-bounds write issue was addressed with improved bounds checking.

    HighCVSS 7.8KEVWeaponizedEPSS 5%

    apple · ipadosAug 24, 2021

  • CVE-2021-30937
    36Monitor

    A memory corruption vulnerability was addressed with improved locking.

    HighCVSS 7.8Proof of conceptEPSS 17%

    apple · ipadosAug 24, 2021

  • CVE-2021-30952
    63This week

    An integer overflow was addressed with improved input validation.

    HighCVSS 7.8KEVWeaponizedEPSS 6%

    apple · safariAug 24, 2021

  • CVE-2021-30970
    26Monitor

    A logic issue was addressed with improved state management.

    MediumCVSS 5.5No exploitEPSS 14%

    apple · macosAug 24, 2021

  • CVE-2021-30983
    62This week

    A buffer overflow issue was addressed with improved memory handling.

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    apple · ipadosAug 24, 2021

  • CVE-2021-31010
    61This week

    A deserialization issue was addressed through improved validation.

    HighCVSS 7.5KEVWeaponizedEPSS 3%

    apple · ipadosAug 24, 2021

  • CVE-2021-22242
    40Plan

    Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site sc

    MediumCVSS 5.4No exploitEPSS 63%

    gitlab · gitlabAug 25, 2021

  • CVE-2021-32648
    93Now

    Account Takeover in Octobercms

    CriticalCVSS 9.1KEVWeaponizedEPSS 90%

    octobercms · octoberAug 26, 2021

  • CVE-2021-39172
    44Plan

    New line injection during configuration edition

    HighCVSS 8.8Proof of conceptEPSS 29%

    catchethq · catchetAug 27, 2021

  • CVE-2021-26084
    99Now

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    atlassian · confluence data centerAug 30, 2021

  • CVE-2021-32955
    50Plan

    Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.

    CriticalCVSS 9.8No exploitEPSS 37%

    deltaww · diaenergieAug 30, 2021

  • CVE-2021-38390
    45Plan

    A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5

    CriticalCVSS 9.8No exploitEPSS 19%

    deltaww · diaenergieAug 30, 2021

  • CVE-2021-38393
    45Plan

    A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5

    CriticalCVSS 9.8No exploitEPSS 18%

    deltaww · diaenergieAug 30, 2021

  • CVE-2021-33055
    44Plan

    Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.

    CriticalCVSS 9.8No exploitEPSS 18%

    zohocorp · manageengine adselfservice plusAug 30, 2021

  • CVE-2021-34646
    54Plan

    Booster for WooCommerce <= 5.4.3 Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 50%

    booster · booster for woocommerceAug 30, 2021

  • CVE-2021-36356
    55Plan

    KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts a

    CriticalCVSS 9.8Proof of conceptEPSS 54%

    kramerav · viawareAug 31, 2021

  • CVE-2021-39316
    50Plan

    ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure

    HighCVSS 7.5Proof of conceptEPSS 65%

    digitalzoomstudio · zoomsoundsAug 31, 2021

  • CVE-2020-20495
    36Monitor

    bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.

    CriticalCVSS 9.1No exploitEPSS 1%

    bludit · bluditAug 31, 2021