CVEs published March 10, 2021
102 CVEs were published on March 10, 2021: 0 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 102
- Critical
- 0
- High
- 2
- Medium
- 9
- Low
- 0
- Unrated
- 91
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Android
- 48
- WESEEK GROWI
- 7
- Facebook HHVM
- 6
- pjsip pjproject
- 2
- 3MF
- 1
- Apache Software Foundation Apache Velocity Engine · org.… +1
- 1
- Apache Software Foundation Apache Velocity Tools · org.a… +1
- 1
- containerd · github.com/containerd/containerd
- 1
- Facebook Gameroom
- 1
- IBM SPSS Modeler
- 1
High 2
Medium, low and unrated 100
- CVE-2021-27918encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns…stdlib
- CVE-2021-21375Crash in receiving updated SDP answer after initial SDP negotiation failedpjsip pjproject
- CVE-2020-15260Existing TLS connections can be reused without checking remote hostnamepjsip pjproject
- CVE-2021-21371Execution of untrusted code through config filetenable integration-jira-cloud · tenable-jira-cloud
- CVE-2021-21334environment variable leakcontainerd · github.com/containerd/containerd
- CVE-2021-21265October CMS vulnerable to Potential Host Header Poisoning on misconfigured serversoctobercms october · october/backend
- CVE-2020-35233The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to…
- CVE-2020-35231The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an…
- CVE-2020-35230Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices.
- CVE-2020-35229The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly…
- CVE-2021-3034Cortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logsPalo Alto Networks Cortex XSOAR
- CVE-2020-35228A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote…
- CVE-2020-35227A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web…
- CVE-2020-35226NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the…
- CVE-2020-35225The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was not properly validating the length of string…
- CVE-2020-35224A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote…
- CVE-2020-35223The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed…
- CVE-2020-35221The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was found to be…
- CVE-2020-19419Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from…
- CVE-2020-19417Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative…
- CVE-2021-20205Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a…Libjpeg-turbo
- CVE-2021-0465In GenerateFaceMask of face.cc, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-0464In sound_trigger_event_alloc of platform.h, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0463In convertToHidl of convert.cpp, there is a possible out of bounds read due to uninitialized data from ReturnFrameworkMessage.Android
- CVE-2021-0462In the NXP NFC firmware, there is a possible insecure firmware update due to a logic error.Android
Show all 100 entriesShow fewer entries
- CVE-2021-0461In iaxxx_core_sensor_change_state of iaxxx-module.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0460In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2021-0459In fts_driver_test_write of fts_proc.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0458In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2021-0457In the FingerTipS touch screen driver, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0456In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0455In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0454In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0453In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0452In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0451In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0450In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0449In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0389In setNightModeActivated of UiModeManagerService.java, there is a missing permission check.Android
- CVE-2021-0388In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler.Android
- CVE-2021-0387In FindQuotaDeviceForUuid of QuotaUtils.cpp, there is a possible use-after-free due to a race condition.Android
- CVE-2021-0386In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value.Android
- CVE-2021-0385In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted…Android
- CVE-2021-0383In done of CaptivePortalLoginActivity.java, there is a confused deputy.Android
- CVE-2021-0382In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check.Android
- CVE-2021-0381In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0380In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing…Android
- CVE-2021-0379In getUpTo17bits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0378In getNbits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0377In DeltaPerformer::Write of delta_performer.cc, there is a possible use of untrusted input due to improper input validation.Android
- CVE-2021-0376In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions…Android
- CVE-2021-0375In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default…Android
- CVE-2021-0374In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0372In getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0371In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0370In Write of NxpMfcReader.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0369In CrossProfileAppsServiceImpl.java, there is the possibility of an application's INTERACT_ACROSS_PROFILES grant state not displaying…Android
- CVE-2021-0368In oggpack_look of bitwise.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0025In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass.Android
- CVE-2021-24030The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable.Facebook Gameroom
- CVE-2020-1921In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within…Facebook HHVM
- CVE-2021-24025Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an…Facebook HHVM
- CVE-2020-1919Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer…Facebook HHVM
- CVE-2020-1917xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not…Facebook HHVM
- CVE-2020-1918In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory…Facebook HHVM
- CVE-2020-1916An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an…Facebook HHVM
- CVE-2021-0399In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free.Android
- CVE-2021-0392In main of main.cpp, there is a possible memory corruption due to a double free.Android
- CVE-2021-0390In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing…Android
- CVE-2021-0397In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free.Android
- CVE-2021-0398In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy.Android
- CVE-2021-0391In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due…Android
- CVE-2021-0394In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0395In StopServicesAndLogViolations of reboot.cpp, there is possible memory corruption due to a use after free.Android
- CVE-2021-0393In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0396In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an…Android
- CVE-2021-20265A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending.kernel
- CVE-2020-5016IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system.IBM WebSphere Application Server
- CVE-2020-4717A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write…IBM SPSS Modeler
- CVE-2021-28122A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1.
- CVE-2020-35752Baby Care System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the Edit Page tab through the Post title parameter.
- CVE-2021-21491SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50…SAP SE SAP NetWeaver Application Server Java
- CVE-2021-3224A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.
- CVE-2020-28705FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
- CVE-2020-24791FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1.
- CVE-2020-23722An issue was discovered in FUEL CMS 1.4.7.
- CVE-2020-23721An issue was discovered in FUEL CMS V1.4.7.
- CVE-2021-28007Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.
- CVE-2021-20673Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated…WESEEK GROWI
- CVE-2021-20671Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite…WESEEK GROWI
- CVE-2021-20672Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from…WESEEK GROWI
- CVE-2021-20670Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's…WESEEK GROWI
- CVE-2021-20669Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an…WESEEK GROWI
- CVE-2021-20667Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and…WESEEK GROWI
- CVE-2021-20668Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path…WESEEK GROWI
- CVE-2020-13936Velocity Sandbox BypassApache Software Foundation Apache Velocity Engine · org.… +1
- CVE-2020-13959Velocity Tools XSS VulnerabilityApache Software Foundation Apache Velocity Tools · org.a… +1
- CVE-2021-3310Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares.
- CVE-2020-29238An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information…
- CVE-2020-27632In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments.