# CVEs published 2021-03-30

78 CVEs were published on March 30, 2021: 0 critical, 9 high. Days are UTC.

- [CVE-2021-21413](https://cve.now/CVE-2021-21413.md): Misuse of \`Reference\` and other transferable APIs may lead to access to nodejs isolate (CVSS 8.0, laverdet isolated-vm · isolated-vm)
- [CVE-2020-24995](https://cve.now/CVE-2020-24995.md): Buffer overflow vulnerability in sniff\_channel\_order function in aacdec\_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary… (no CVSS)
- [CVE-2020-24391](https://cve.now/CVE-2020-24391.md): mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. (no CVSS, mongodb-query-parser)
- [CVE-2021-29646](https://cve.now/CVE-2021-29646.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29647](https://cve.now/CVE-2021-29647.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29648](https://cve.now/CVE-2021-29648.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29649](https://cve.now/CVE-2021-29649.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29650](https://cve.now/CVE-2021-29650.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29642](https://cve.now/CVE-2021-29642.md): GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens. (no CVSS)
- [CVE-2021-21412](https://cve.now/CVE-2021-21412.md): \[thi.ng/egf\] Potential arbitrary code execution of \`#gpg\`-tagged property values (CVSS 6.4, thi-ng egf · @thi.ng/egf)
- [CVE-2021-26579](https://cve.now/CVE-2021-26579.md): A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of… (no CVSS, HPE Unified Data Management)
- [CVE-2021-20520](https://cve.now/CVE-2021-20520.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Engineering Li… +2)
- [CVE-2021-20518](https://cve.now/CVE-2021-20518.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Lifecycle Optimization · IBM Engineering… +2)
- [CVE-2021-20506](https://cve.now/CVE-2021-20506.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Lifecycle Optimization · IBM Engineering… +2)
- [CVE-2021-20504](https://cve.now/CVE-2021-20504.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert · IBM Rational Engineering Lif… +2)
- [CVE-2021-20503](https://cve.now/CVE-2021-20503.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Engineering Li… +2)
- [CVE-2021-20502](https://cve.now/CVE-2021-20502.md): IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Engineering Lifecycle Optimization · IBM Engineering… +2)
- [CVE-2021-20447](https://cve.now/CVE-2021-20447.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Engineering Lifecycle Manager · IBM Rationa… +2)
- [CVE-2021-20352](https://cve.now/CVE-2021-20352.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Engineering Li… +2)
- [CVE-2021-20482](https://cve.now/CVE-2021-20482.md): IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML… (CVSS 7.1, IBM Cloud Pak for Automation)
- [CVE-2020-4944](https://cve.now/CVE-2020-4944.md): IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain… (CVSS 5.1, IBM UrbanCode Deploy)
- [CVE-2020-4884](https://cve.now/CVE-2020-4884.md): IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user. (CVSS 6.2, IBM UrbanCode Deploy)
- [CVE-2020-4848](https://cve.now/CVE-2020-4848.md): IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or compare process… (CVSS 5.4, IBM UrbanCode Deploy)
- [CVE-2021-21398](https://cve.now/CVE-2021-21398.md): Possible XSS injection through DataColumn Grid class (CVSS 5.4, PrestaShop)
- [CVE-2021-21409](https://cve.now/CVE-2021-21409.md): Possible request smuggling in HTTP/2 due missing validation of content-length (CVSS 5.9, netty · io.netty:netty-codec-http2 +2)
- [CVE-2021-23363](https://cve.now/CVE-2021-23363.md): Arbitrary Command Injection (CVSS 6.3, kill-by-port)
- [CVE-2021-27271](https://cve.now/CVE-2021-27271.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27269](https://cve.now/CVE-2021-27269.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27270](https://cve.now/CVE-2021-27270.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27268](https://cve.now/CVE-2021-27268.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27266](https://cve.now/CVE-2021-27266.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27267](https://cve.now/CVE-2021-27267.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27265](https://cve.now/CVE-2021-27265.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27263](https://cve.now/CVE-2021-27263.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27264](https://cve.now/CVE-2021-27264.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27262](https://cve.now/CVE-2021-27262.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27261](https://cve.now/CVE-2021-27261.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2020-15075](https://cve.now/CVE-2020-15075.md): OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in… (no CVSS, OpenVPN Connect)
- [CVE-2021-26810](https://cve.now/CVE-2021-26810.md): D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. (no CVSS)
- [CVE-2021-28935](https://cve.now/CVE-2021-28935.md): CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin \> My Preferences \>… (no CVSS)
- [CVE-2021-29343](https://cve.now/CVE-2021-29343.md): Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php. (no CVSS)
- [CVE-2021-21638](https://cve.now/CVE-2021-21638.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect… (no CVSS, Jenkins project Jenkins Team Foundation Server Plugin · org…)
- [CVE-2021-21637](https://cve.now/CVE-2021-21637.md): A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins project Jenkins Team Foundation Server Plugin · org…)
- [CVE-2021-21636](https://cve.now/CVE-2021-21636.md): A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins project Jenkins Team Foundation Server Plugin · org…)
- [CVE-2021-21635](https://cve.now/CVE-2021-21635.md): Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a… (no CVSS, Jenkins project Jenkins REST List Parameter Plugin · io.jen…)
- [CVE-2021-21634](https://cve.now/CVE-2021-21634.md): Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the… (no CVSS, Jenkins project Jenkins Jabber (XMPP) notifier and control…)
- [CVE-2021-21633](https://cve.now/CVE-2021-21633.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect… (no CVSS, Jenkins project Jenkins OWASP Dependency-Track Plugin · org…)
- [CVE-2021-21632](https://cve.now/CVE-2021-21632.md): A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins project Jenkins OWASP Dependency-Track Plugin · org…)
- [CVE-2021-21631](https://cve.now/CVE-2021-21631.md): Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with… (no CVSS, Jenkins project Jenkins Cloud Statistics Plugin · org.jenki…)
- [CVE-2021-21630](https://cve.now/CVE-2021-21630.md): Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored… (no CVSS, Jenkins project Jenkins Extra Columns Plugin · org.jenkins-…)
- [CVE-2021-21629](https://cve.now/CVE-2021-21629.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a… (no CVSS, Jenkins project Jenkins Build With Parameters Plugin · org.…)
- [CVE-2021-21628](https://cve.now/CVE-2021-21628.md): Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site… (no CVSS, Jenkins project Jenkins Build With Parameters Plugin · org.…)
- [CVE-2021-26919](https://cve.now/CVE-2021-26919.md): Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. (no CVSS, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2021-29376](https://cve.now/CVE-2021-29376.md): ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim… (no CVSS)
- [CVE-2021-29418](https://cve.now/CVE-2021-29418.md): The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. (no CVSS, netmask)
- [CVE-2020-19643](https://cve.now/CVE-2020-19643.md): Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings… (no CVSS)
- [CVE-2020-19642](https://cve.now/CVE-2020-19642.md): An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. (no CVSS)
- [CVE-2020-19641](https://cve.now/CVE-2020-19641.md): An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. (no CVSS)
- [CVE-2020-19640](https://cve.now/CVE-2020-19640.md): An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. (no CVSS)
- [CVE-2020-19639](https://cve.now/CVE-2020-19639.md): Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI. (no CVSS)
- [CVE-2020-20545](https://cve.now/CVE-2020-20545.md): Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to… (no CVSS)
- [CVE-2018-1110](https://cve.now/CVE-2018-1110.md): A flaw was found in knot-resolver before version 2.3.0. (no CVSS, knot-resolver)
- [CVE-2018-1109](https://cve.now/CVE-2018-1109.md): A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. (no CVSS, nodejs-braces · braces)
- [CVE-2018-1107](https://cve.now/CVE-2018-1107.md): It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to… (no CVSS, nodejs-is-my-json-valid · is-my-json-valid)
- [CVE-2019-5319](https://cve.now/CVE-2019-5319.md): A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25161](https://cve.now/CVE-2021-25161.md): A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25162](https://cve.now/CVE-2021-25162.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s)… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25160](https://cve.now/CVE-2021-25160.md): A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25159](https://cve.now/CVE-2021-25159.md): A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25157](https://cve.now/CVE-2021-25157.md): A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25158](https://cve.now/CVE-2021-25158.md): A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25156](https://cve.now/CVE-2021-25156.md): A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25155](https://cve.now/CVE-2021-25155.md): A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25150](https://cve.now/CVE-2021-25150.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s)… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25146](https://cve.now/CVE-2021-25146.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s)… (no CVSS, Aruba Instant Access Points)
- [CVE-2021-3474](https://cve.now/CVE-2021-3474.md): There's a flaw in OpenEXR in versions before 3.0.0-beta. (no CVSS, OpenEXR)
- [CVE-2021-3475](https://cve.now/CVE-2021-3475.md): There is a flaw in OpenEXR in versions before 3.0.0-beta. (no CVSS, OpenEXR)
- [CVE-2021-3476](https://cve.now/CVE-2021-3476.md): A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. (no CVSS, OpenEXR)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.