Skip to content
OpenAdvisories

Archive

9 July 2021

Vulnerabilities first published on this day (UTC), newest first.

← June 2021 2021 / July /9 August 2021 →
  1. 157
  2. 263
  3. 3 
  4. 4 
  5. 56
  6. 626
  7. 7108
  8. 866
  9. 961
  10. 102
  11. 115
  12. 1288
  13. 13139
  14. 14172
  15. 1583
  16. 1657
  17. 175
  18. 181
  19. 1961
  20. 20174
  21. 2185
  22. 2290
  23. 2320
  24. 241
  25. 2534
  26. 2662
  27. 2740
  28. 2828
  29. 2928
  30. 3016
  31. 316
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-24007

    Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allo…

    Fortinet Fortinet FortiMail Network devices
  • Critical 9.9
    CVE-2021-30120

    2FA bypass in Kaseya VSA <= v9.5.6

    Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During t…

  • Critical 9.8
    CVE-2021-30118 Scanner template EPSS 60%

    Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5

    An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unau…

  • Critical 9.8
    CVE-2021-30117 EPSS 72%

    Authenticated SQL injection in Kaseya VSA < v9.5.6

    The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: ``` GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.…

  • Critical 10.0
    CVE-2021-30116 Exploited · Ransomware Scanner template EPSS 86%

    Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6

    Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.…

    KEV Nov 3, 2021