# CVEs published 2021-03-09

90 CVEs were published on March 9, 2021: 3 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-28119](https://cve.now/CVE-2021-28119.md): Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. (no CVSS)
- [CVE-2021-28116](https://cve.now/CVE-2021-28116.md): Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP… (CVSS 3.7)
- [CVE-2021-28115](https://cve.now/CVE-2021-28115.md): The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation. (no CVSS)
- [CVE-2021-23273](https://cve.now/CVE-2021-23273.md): TIBCO Spotfire Cross Site Scripting Vulnerability (CVSS 8.0, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2020-28952](https://cve.now/CVE-2020-28952.md): An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. (no CVSS)
- [CVE-2020-35524](https://cve.now/CVE-2020-35524.md): A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. (no CVSS, libtiff)
- [CVE-2020-35523](https://cve.now/CVE-2020-35523.md): An integer overflow flaw was found in libtiff that exists in the tif\_getimage.c file. (no CVSS, libtiff)
- [CVE-2020-35522](https://cve.now/CVE-2020-35522.md): In LibTIFF, there is a memory malloc failure in tif\_pixarlog.c. (no CVSS, libtiff)
- [CVE-2020-35521](https://cve.now/CVE-2020-35521.md): A flaw was found in libtiff. (no CVSS, libtiff)
- [CVE-2021-20255](https://cve.now/CVE-2021-20255.md): A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. (no CVSS, QEMU)
- [CVE-2021-3411](https://cve.now/CVE-2021-3411.md): A flaw was found in the Linux kernel in versions prior to 5.10. (no CVSS, Linux kernel)
- [CVE-2021-21295](https://cve.now/CVE-2021-21295.md): Possible request smuggling in HTTP/2 due missing validation (CVSS 5.9, io.netty:netty-codec-http2 · zookeeper +2)
- [CVE-2021-23352](https://cve.now/CVE-2021-23352.md): Command Injection (CVSS 8.6, madge)
- [CVE-2021-23353](https://cve.now/CVE-2021-23353.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.9, jspdf)
- [CVE-2020-27225](https://cve.now/CVE-2020-27225.md): In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web… (no CVSS, The Eclipse Foundation Eclipse Platform)
- [CVE-2021-21369](https://cve.now/CVE-2021-21369.md): Potential DoS in Besu HTTP JSON-RPC API (CVSS 6.5, hyperledger besu)
- [CVE-2020-28150](https://cve.now/CVE-2020-28150.md): I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses… (no CVSS)
- [CVE-2021-21190](https://cve.now/CVE-2021-21190.md): Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information… (no CVSS, Google Chrome)
- [CVE-2021-21188](https://cve.now/CVE-2021-21188.md): Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2021-21189](https://cve.now/CVE-2021-21189.md): Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation… (no CVSS, Google Chrome)
- [CVE-2021-21187](https://cve.now/CVE-2021-21187.md): Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing… (no CVSS, Google Chrome)
- [CVE-2021-21185](https://cve.now/CVE-2021-21185.md): Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a… (no CVSS, Google Chrome)
- [CVE-2021-21186](https://cve.now/CVE-2021-21186.md): Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to… (no CVSS, Google Chrome)
- [CVE-2021-21184](https://cve.now/CVE-2021-21184.md): Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin… (no CVSS, Google Chrome)
- [CVE-2021-21183](https://cve.now/CVE-2021-21183.md): Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin… (no CVSS, Google Chrome)
- [CVE-2021-21181](https://cve.now/CVE-2021-21181.md): Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially… (no CVSS, Google Chrome)
- [CVE-2021-21182](https://cve.now/CVE-2021-21182.md): Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the… (no CVSS, Google Chrome)
- [CVE-2021-21180](https://cve.now/CVE-2021-21180.md): Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2021-21178](https://cve.now/CVE-2021-21178.md): Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof… (no CVSS, Google Chrome)
- [CVE-2021-21179](https://cve.now/CVE-2021-21179.md): Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap… (no CVSS, Google Chrome)
- [CVE-2021-21177](https://cve.now/CVE-2021-21177.md): Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially… (no CVSS, Google Chrome)
- [CVE-2021-21175](https://cve.now/CVE-2021-21175.md): Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data… (no CVSS, Google Chrome)
- [CVE-2021-21176](https://cve.now/CVE-2021-21176.md): Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of… (no CVSS, Google Chrome)
- [CVE-2021-21174](https://cve.now/CVE-2021-21174.md): Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation… (no CVSS, Google Chrome)
- [CVE-2021-21172](https://cve.now/CVE-2021-21172.md): Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass… (no CVSS, Google Chrome)
- [CVE-2021-21173](https://cve.now/CVE-2021-21173.md): Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak… (no CVSS, Google Chrome)
- [CVE-2021-21171](https://cve.now/CVE-2021-21171.md): Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the… (no CVSS, Google Chrome)
- [CVE-2021-21170](https://cve.now/CVE-2021-21170.md): Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process… (no CVSS, Google Chrome)
- [CVE-2021-21168](https://cve.now/CVE-2021-21168.md): Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially… (no CVSS, Google Chrome)
- [CVE-2021-21169](https://cve.now/CVE-2021-21169.md): Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds… (no CVSS, Google Chrome)
- [CVE-2021-21167](https://cve.now/CVE-2021-21167.md): Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2021-21165](https://cve.now/CVE-2021-21165.md): Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted… (no CVSS, Google Chrome)
- [CVE-2021-21166](https://cve.now/CVE-2021-21166.md): Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-21164](https://cve.now/CVE-2021-21164.md): Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin… (no CVSS, Google Chrome)
- [CVE-2021-21163](https://cve.now/CVE-2021-21163.md): Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin… (no CVSS, Google Chrome)
- [CVE-2021-21161](https://cve.now/CVE-2021-21161.md): Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2021-21162](https://cve.now/CVE-2021-21162.md): Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2021-21160](https://cve.now/CVE-2021-21160.md): Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2021-21159](https://cve.now/CVE-2021-21159.md): Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2021-20262](https://cve.now/CVE-2021-20262.md): A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-20263](https://cve.now/CVE-2021-20263.md): A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. (no CVSS, QEMU)
- [CVE-2021-20268](https://cve.now/CVE-2021-20268.md): An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF… (no CVSS, kernel)
- [CVE-2021-20253](https://cve.now/CVE-2021-20253.md): A flaw was found in ansible-tower. (no CVSS, ansible-tower)
- [CVE-2021-3417](https://cve.now/CVE-2021-3417.md): An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA)… (CVSS 4.9, Lenovo XClarity Orchestrator)
- [CVE-2020-8357](https://cve.now/CVE-2020-8357.md): A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to… (CVSS 5.5, Lenovo PCManager)
- [CVE-2020-8356](https://cve.now/CVE-2020-8356.md): An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and… (CVSS 4.9, Lenovo XClarity Orchestrator)
- [CVE-2020-35451](https://cve.now/CVE-2020-35451.md): Oozie local privilege escalation (no CVSS, Apache Software Foundation Apache Oozie)
- [CVE-2021-20341](https://cve.now/CVE-2021-20341.md): IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further… (CVSS 5.3, IBM Cloud Pak for Multicloud Management Monitoring)
- [CVE-2021-25915](https://cve.now/CVE-2021-25915.md): Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead… (CVSS 9.8, changeset)
- [CVE-2021-27592](https://cve.now/CVE-2021-27592.md): When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27590](https://cve.now/CVE-2021-27590.md): When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27584](https://cve.now/CVE-2021-27584.md): When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27588](https://cve.now/CVE-2021-27588.md): When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27586](https://cve.now/CVE-2021-27586.md): When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27587](https://cve.now/CVE-2021-27587.md): When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27591](https://cve.now/CVE-2021-27591.md): When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27589](https://cve.now/CVE-2021-27589.md): When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27585](https://cve.now/CVE-2021-27585.md): When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D Visual Enterprise… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21484](https://cve.now/CVE-2021-21484.md): LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable… (CVSS 7.7, SAP SE SAP HANA)
- [CVE-2021-21487](https://cve.now/CVE-2021-21487.md): SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of… (CVSS 6.8, SAP SE SAP Payment Engine)
- [CVE-2021-21480](https://cve.now/CVE-2021-21480.md): SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). (CVSS 9.9, SAP SE SAP Manufacturing Integration and Intelligence)
- [CVE-2021-21493](https://cve.now/CVE-2021-21493.md): When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21486](https://cve.now/CVE-2021-21486.md): SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform… (CVSS 6.8, SAP SE SAP Enterprise Financial Services)
- [CVE-2021-21488](https://cve.now/CVE-2021-21488.md): Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize… (CVSS 6.5, SAP SE SAP NetWeaver Knowledge Management)
- [CVE-2021-21481](https://cve.now/CVE-2021-21481.md): The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization… (CVSS 9.6, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2021-20276](https://cve.now/CVE-2021-20276.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20275](https://cve.now/CVE-2021-20275.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20274](https://cve.now/CVE-2021-20274.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20273](https://cve.now/CVE-2021-20273.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20272](https://cve.now/CVE-2021-20272.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-28006](https://cve.now/CVE-2021-28006.md): Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter. (no CVSS)
- [CVE-2021-21361](https://cve.now/CVE-2021-21361.md): Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin (CVSS 5.3, JLLeitschuh security-research · com.bmuschko:gradle-vagrant…)
- [CVE-2021-21360](https://cve.now/CVE-2021-21360.md): Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup (CVSS 5.3, zopefoundation Products.GenericSetup · products-genericsetup)
- [CVE-2021-24033](https://cve.now/CVE-2021-24033.md): react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to… (no CVSS, Facebook react-dev-utils · react-dev-utils)
- [CVE-2021-20241](https://cve.now/CVE-2021-20241.md): A flaw was found in ImageMagick in coders/jp2.c. (no CVSS, ImageMagick)
- [CVE-2021-20243](https://cve.now/CVE-2021-20243.md): A flaw was found in ImageMagick in MagickCore/resize.c. (no CVSS, ImageMagick)
- [CVE-2021-20244](https://cve.now/CVE-2021-20244.md): A flaw was found in ImageMagick in MagickCore/visual-effects.c. (no CVSS, ImageMagick)
- [CVE-2021-20245](https://cve.now/CVE-2021-20245.md): A flaw was found in ImageMagick in coders/webp.c. (no CVSS, ImageMagick)
- [CVE-2021-20246](https://cve.now/CVE-2021-20246.md): A flaw was found in ImageMagick in MagickCore/resample.c. (no CVSS, ImageMagick)
- [CVE-2021-21300](https://cve.now/CVE-2021-21300.md): malicious repositories can execute remote code while cloning (CVSS 8.0, git)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.