# CVEs published 2021-03-12 43 CVEs were published on March 12, 2021: 4 critical, 14 high. Days are UTC. - [CVE-2021-27290](https://cve.now/CVE-2021-27290.md): ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. (no CVSS, ssri) - [CVE-2021-28162](https://cve.now/CVE-2021-28162.md): In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run. (no CVSS, The Eclipse Foundation Eclipse Theia · @theia/messages) - [CVE-2021-28161](https://cve.now/CVE-2021-28161.md): In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be… (no CVSS, The Eclipse Foundation Eclipse Theia · @theia/console) - [CVE-2021-28092](https://cve.now/CVE-2021-28092.md): The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service… (no CVSS, is-svg) - [CVE-2021-21518](https://cve.now/CVE-2021-21518.md): Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versions 2.0.x… (CVSS 7.8, Dell SupportAssist Client) - [CVE-2021-20232](https://cve.now/CVE-2021-20232.md): A flaw was found in gnutls. (CVSS 9.8, gnutls) - [CVE-2021-20231](https://cve.now/CVE-2021-20231.md): A flaw was found in gnutls. (no CVSS, gnutls) - [CVE-2021-21082](https://cve.now/CVE-2021-21082.md): Adobe Photoshop Memory Corruption (CVSS 7.8, Adobe Photoshop) - [CVE-2021-21078](https://cve.now/CVE-2021-21078.md): Adobe Creative Cloud Unquoted Service Path in CCXProcess (CVSS 6.5, Adobe Creative Cloud) - [CVE-2021-21074](https://cve.now/CVE-2021-21074.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21056](https://cve.now/CVE-2021-21056.md): Adobe FrameMaker Out-of-Bounds Read Vulnerability Could Lead To Remote Code Execution (CVSS 7.8, Adobe FrameMaker) - [CVE-2021-21085](https://cve.now/CVE-2021-21085.md): Adobe Connect CSV injection via export feature could lead to code execution (CVSS 7.8, Adobe Connect) - [CVE-2021-21071](https://cve.now/CVE-2021-21071.md): Adobe Animate memory corruption vulnerability (CVSS 7.8, Adobe Animate) - [CVE-2021-21067](https://cve.now/CVE-2021-21067.md): Adobe Photoshop CoolType arbitrary stack manipulation in Type 1/Multiple Master (CVSS 7.8, Adobe Photoshop) - [CVE-2021-21075](https://cve.now/CVE-2021-21075.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21080](https://cve.now/CVE-2021-21080.md): Adobe Connect Reflected Cross-site Scripting via query parameter (CVSS 6.1, Adobe Connect) - [CVE-2021-21076](https://cve.now/CVE-2021-21076.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21068](https://cve.now/CVE-2021-21068.md): Adobe Creative Cloud installer arbitrary file overwrite vulnerability (CVSS 6.1, Adobe Creative Cloud) - [CVE-2021-21077](https://cve.now/CVE-2021-21077.md): Adobe Animate heap-based overflow vulnerability (CVSS 7.8, Adobe Animate) - [CVE-2021-21069](https://cve.now/CVE-2021-21069.md): Adobe Creative Cloud Privilege Escalation Vulnerability (CVSS 7.8, Adobe Creative Cloud) - [CVE-2021-21073](https://cve.now/CVE-2021-21073.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21072](https://cve.now/CVE-2021-21072.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21079](https://cve.now/CVE-2021-21079.md): Adobe Connect Reflected Cross-site Scripting via archiveOffset parameter (CVSS 6.1, Adobe Connect) - [CVE-2021-21726](https://cve.now/CVE-2021-21726.md): Some ZTE products have an input verification vulnerability in the diagnostic function interface. (no CVSS, \) - [CVE-2021-21379](https://cve.now/CVE-2021-21379.md): It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro (CVSS 7.7, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…) - [CVE-2021-21368](https://cve.now/CVE-2021-21368.md): Prototype poisoning (CVSS 6.7, mcollina msgpack5 · msgpack5) - [CVE-2020-4831](https://cve.now/CVE-2020-4831.md): IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… (CVSS 5.9, IBM DataPower Gateway) - [CVE-2021-21367](https://cve.now/CVE-2021-21367.md): Incorrect Authorization in switchboard-plug-bluetooth (CVSS 6.1, elementary switchboard-plug-bluetooth) - [CVE-2021-23354](https://cve.now/CVE-2021-23354.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, printf) - [CVE-2021-28302](https://cve.now/CVE-2021-28302.md): A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser\_parseDocument() function. (no CVSS) - [CVE-2021-28305](https://cve.now/CVE-2021-28305.md): An issue was discovered in the diesel crate before 1.4.6 for Rust. (no CVSS, diesel) - [CVE-2021-28306](https://cve.now/CVE-2021-28306.md): An issue was discovered in the fltk crate before 0.15.3 for Rust. (no CVSS, fltk) - [CVE-2021-28307](https://cve.now/CVE-2021-28307.md): An issue was discovered in the fltk crate before 0.15.3 for Rust. (no CVSS, fltk) - [CVE-2021-28308](https://cve.now/CVE-2021-28308.md): An issue was discovered in the fltk crate before 0.15.3 for Rust. (no CVSS, fltk) - [CVE-2021-27646](https://cve.now/CVE-2021-27646.md): Use After Free vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote… (CVSS 9.8, Synology DiskStation Manager) - [CVE-2021-26569](https://cve.now/CVE-2021-26569.md): Race Condition within a Thread vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… (CVSS 9.8, Synology DiskStation Manager) - [CVE-2021-27647](https://cve.now/CVE-2021-27647.md): Out-of-bounds Read vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote… (CVSS 9.8, Synology DiskStation Manager) - [CVE-2021-20674](https://cve.now/CVE-2021-20674.md): Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain… (no CVSS, NTT TechnoCross Installer of MagicConnect Client program) - [CVE-2020-36282](https://cve.now/CVE-2020-36282.md): JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution… (no CVSS, com.rabbitmq.jms:rabbitmq-jms) - [CVE-2020-36281](https://cve.now/CVE-2020-36281.md): Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c. (no CVSS) - [CVE-2020-36280](https://cve.now/CVE-2020-36280.md): Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c. (no CVSS) - [CVE-2020-36279](https://cve.now/CVE-2020-36279.md): Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap\_reg.c and adaptmap.c. (no CVSS) - [CVE-2021-21366](https://cve.now/CVE-2021-21366.md): Misinterpretation of malicious XML input (CVSS 4.3, xmldom) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2021-03-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.