# CVEs published 2021-02-25

74 CVEs were published on February 25, 2021: 4 critical, 36 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-26700](https://cve.now/CVE-2021-26700.md): Visual Studio Code npm-script Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code - npm-script Extension · vscod…)
- [CVE-2021-26701](https://cve.now/CVE-2021-26701.md): .NET Core Remote Code Execution Vulnerability (CVSS 8.1, Microsoft .NET Core · Microsoft .NET +3)
- [CVE-2021-25195](https://cve.now/CVE-2021-25195.md): Windows PKU2U Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-24113](https://cve.now/CVE-2021-24113.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2021-24114](https://cve.now/CVE-2021-24114.md): Microsoft Teams iOS Information Disclosure Vulnerability (CVSS 5.7, Microsoft Teams for iOS)
- [CVE-2021-24111](https://cve.now/CVE-2021-24111.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 ·…)
- [CVE-2021-24112](https://cve.now/CVE-2021-24112.md): .NET Core Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Visual Studio 2019 for Mac · Microsoft Mono +5)
- [CVE-2021-24109](https://cve.now/CVE-2021-24109.md): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Azure Kubernetes Service)
- [CVE-2021-24105](https://cve.now/CVE-2021-24105.md): Package Managers Configurations Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Package Manager Configurations)
- [CVE-2021-24106](https://cve.now/CVE-2021-24106.md): Windows DirectX Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-24103](https://cve.now/CVE-2021-24103.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-24101](https://cve.now/CVE-2021-24101.md): Microsoft Dataverse Information Disclosure Vulnerability (CVSS 6.5, Microsoft Dynamics 365 (on-premises))
- [CVE-2021-24102](https://cve.now/CVE-2021-24102.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-24100](https://cve.now/CVE-2021-24100.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 5.0, Microsoft Edge for Android)
- [CVE-2021-24098](https://cve.now/CVE-2021-24098.md): Windows Console Driver Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-24099](https://cve.now/CVE-2021-24099.md): Skype for Business and Lync Denial of Service Vulnerability (CVSS 6.5, Microsoft Skype for Business Server 2019 CU2 · Microsof… +1)
- [CVE-2021-24094](https://cve.now/CVE-2021-24094.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2021-24096](https://cve.now/CVE-2021-24096.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-24093](https://cve.now/CVE-2021-24093.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-24092](https://cve.now/CVE-2021-24092.md): Microsoft Defender Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Endpoint Protection · Microsoft System Center… +4)
- [CVE-2021-24088](https://cve.now/CVE-2021-24088.md): Windows Local Spooler Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2021-24091](https://cve.now/CVE-2021-24091.md): Windows Camera Codec Pack Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-24086](https://cve.now/CVE-2021-24086.md): Windows TCP/IP Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-24087](https://cve.now/CVE-2021-24087.md): Azure IoT CLI extension Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft azure-iot-cli-extension)
- [CVE-2021-24085](https://cve.now/CVE-2021-24085.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 6.5, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2021-24083](https://cve.now/CVE-2021-24083.md): Windows Address Book Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-24084](https://cve.now/CVE-2021-24084.md): Windows Mobile Device Management Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-24082](https://cve.now/CVE-2021-24082.md): Microsoft.PowerShell.Utility Module WDAC Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2021-24080](https://cve.now/CVE-2021-24080.md): Windows Trust Verification API Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-24081](https://cve.now/CVE-2021-24081.md): Microsoft Windows Codecs Library Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-24079](https://cve.now/CVE-2021-24079.md): Windows Backup Engine Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-24077](https://cve.now/CVE-2021-24077.md): Windows Fax Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2021-24078](https://cve.now/CVE-2021-24078.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server · Microsoft Windows Server,)
- [CVE-2021-24076](https://cve.now/CVE-2021-24076.md): Microsoft Windows VMSwitch Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-24074](https://cve.now/CVE-2021-24074.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2021-24075](https://cve.now/CVE-2021-24075.md): Microsoft Windows VMSwitch Denial of Service Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-24072](https://cve.now/CVE-2021-24072.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-24073](https://cve.now/CVE-2021-24073.md): Skype for Business and Lync Spoofing Vulnerability (CVSS 6.5, Microsoft Skype for Business Server 2015 CU · Microsoft Lyn…)
- [CVE-2021-24071](https://cve.now/CVE-2021-24071.md): Microsoft SharePoint Information Disclosure Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2021-24069](https://cve.now/CVE-2021-24069.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Web Apps Server 2013 Service Pack · Mic… +3)
- [CVE-2021-24070](https://cve.now/CVE-2021-24070.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Web Apps Server 2013 Service Pack · Mic… +3)
- [CVE-2021-24068](https://cve.now/CVE-2021-24068.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Web Apps Server 2013 Service Pack · Mic… +1)
- [CVE-2021-24066](https://cve.now/CVE-2021-24066.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2021-24067](https://cve.now/CVE-2021-24067.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Web Apps Server 2013 Service Pack · Mic… +3)
- [CVE-2021-1733](https://cve.now/CVE-2021-1733.md): Sysinternals PsExec Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft PsExec)
- [CVE-2021-1734](https://cve.now/CVE-2021-1734.md): Windows Remote Procedure Call Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-1732](https://cve.now/CVE-2021-1732.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-1730](https://cve.now/CVE-2021-1730.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 5.4, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2021-1731](https://cve.now/CVE-2021-1731.md): PFX Encryption Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1728](https://cve.now/CVE-2021-1728.md): System Center Operations Manager Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft System Center 2019 Operations Manager)
- [CVE-2021-1726](https://cve.now/CVE-2021-1726.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2021-1727](https://cve.now/CVE-2021-1727.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1724](https://cve.now/CVE-2021-1724.md): Microsoft Dynamics Business Central Cross-site Scripting Vulnerability (CVSS 6.1, Microsoft Dynamics NAV · Microsoft Dynamics 365 Business… +1)
- [CVE-2021-1721](https://cve.now/CVE-2021-1721.md): .NET Core and Visual Studio Denial of Service Vulnerability (CVSS 6.5, Microsoft Visual Studio · Microsoft PowerShell Core +47)
- [CVE-2021-1722](https://cve.now/CVE-2021-1722.md): Windows Fax Service Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-1698](https://cve.now/CVE-2021-1698.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-17162](https://cve.now/CVE-2020-17162.md): Microsoft Windows Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1639](https://cve.now/CVE-2021-1639.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Visual Studio)
- [CVE-2021-3406](https://cve.now/CVE-2021-3406.md): A flaw was found in keylime 5.8.1 and older. (no CVSS, keylime)
- [CVE-2021-20203](https://cve.now/CVE-2021-20203.md): An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. (no CVSS, qemu)
- [CVE-2021-20328](https://cve.now/CVE-2021-20328.md): MongoDB Java driver client-side field level encryption not verifying KMS host name (CVSS 6.4, MongoDB mongo-java-driver · mongodb-driver +6)
- [CVE-2021-20327](https://cve.now/CVE-2021-20327.md): MongoDB Node.js client side field level encryption library may not be validating KMS certificate (CVSS 6.4, MongoDB Node.js Driver mongodb-client-encryption module · m…)
- [CVE-2020-27543](https://cve.now/CVE-2020-27543.md): The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. (no CVSS, restify-paginate)
- [CVE-2020-23534](https://cve.now/CVE-2020-23534.md): A server-side request forgery (SSRF) vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter. (no CVSS)
- [CVE-2021-27330](https://cve.now/CVE-2021-27330.md): Triconsole Datepicker Calendar \<3.77 is affected by cross-site scripting (XSS) in calendar\_form.php. (no CVSS)
- [CVE-2021-3124](https://cve.now/CVE-2021-3124.md): Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject (no CVSS)
- [CVE-2021-3273](https://cve.now/CVE-2021-3273.md): Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. (no CVSS)
- [CVE-2021-21066](https://cve.now/CVE-2021-21066.md): Adobe Bridge Font Parsing Out-Of-Bounds Write Arbitrary Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-21065](https://cve.now/CVE-2021-21065.md): Adobe Bridge Font Parsing Out-Of-Bounds Write Arbitrary Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-21064](https://cve.now/CVE-2021-21064.md): Magento UPWARD-php Path traversal vulnerability via UPWARD Connector (CVSS 4.9, Adobe Magento Commerce)
- [CVE-2020-8032](https://cve.now/CVE-2020-8032.md): Local privilege escalation to root due to insecure tmp file usage (CVSS 6.7, openSUSE Factory)
- [CVE-2020-36254](https://cve.now/CVE-2020-36254.md): scp.c in Dropbear before 2020.79 mishandles the filename of . (CVSS 8.1)
- [CVE-2021-27671](https://cve.now/CVE-2021-27671.md): An issue was discovered in the comrak crate before 0.9.1 for Rust. (no CVSS, comrak)
- [CVE-2021-27670](https://cve.now/CVE-2021-27670.md): Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.