CVEs published February 23, 2021
62 CVEs were published on February 23, 2021: 0 critical, 5 high.
- Published
- 62
- Critical
- 0
- High
- 5
- Medium
- 2
- Low
- 1
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Aruba ClearPass Policy Manager
- 11
- Luxion KeyShot · Luxion KeyVR
- 4
- jasper
- 2
- kernel
- 2
- 3scale/backend
- 1
- Adobe Acrobat Reader DC
- 1
- Advantech WebAccess/SCADA
- 1
- brave-browser
- 1
- Collabora Productivity Collabora Online · The Document Foun…
- 1
- EFM Networks ipTIME NAS
- 1
High 5
- CVE-2021-3407A flaw was found in mupdf 1.18.0.mupdf
- CVE-2020-28587A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an oSoftmaker
- CVE-2020-7847The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain EFM Networks ipTIME NAS
- CVE-2020-28429Command Injectiongeojson2kml
- CVE-2020-29075PDF Injection BlackHat TalkAdobe Acrobat Reader DC
Medium, low and unrated 57
- CVE-2021-21323Regression in DNS leakage from Tor windowsbrave-browser
- CVE-2021-20194There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_Bkernel
- CVE-2021-20256A flaw was found in Red Hat Satellite.Red Hat Satellite
- CVE-2021-20252A flaw was found in Red Hat 3scale API Management Platform 2.3scale/backend
- CVE-2021-3410A flaw was found in libcaca v0.99.beta19.libcaca
- CVE-2021-20182A privilege escalation flaw was found in openshift4/ose-docker-builder.openshift
- CVE-2021-3405A flaw was found in libebml before 1.4.2.libebml
- CVE-2021-26927A flaw was found in jasper before 2.0.25.jasper
- CVE-2021-26595In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site,
- CVE-2021-26594In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end.
- CVE-2021-26593In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}.
- CVE-2021-27583In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature.
- CVE-2021-22112Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail toSpring Security · org.springframework.security:spring-se… +1
- CVE-2021-20247A flaw was found in mbsync before v1.3.5 and v1.4.1.isync/mbsync
- CVE-2020-27782A flaw was found in the Undertow AJP connector.Undertow · io.undertow:undertow-core
- CVE-2020-8297Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user iNextcloud Deck
- CVE-2021-22882UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi ProtecUniFi Protect
- CVE-2020-7120A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, Aruba ClearPass Policy Manager
- CVE-2021-26677A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8Aruba ClearPass Policy Manager
- CVE-2021-26679A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HFAruba ClearPass Policy Manager
- CVE-2021-26680A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HFAruba ClearPass Policy Manager
- CVE-2021-27582org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 containsorg.mitre:openid-connect-parent
- CVE-2021-26678A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior Aruba ClearPass Policy Manager
- CVE-2021-22651When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot NLuxion KeyShot versions · Luxion KeyShot Viewer +2
- CVE-2021-20198A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0.openshift/installer
- CVE-2021-26926A flaw was found in jasper before 2.0.25.jasper
- CVE-2021-20229A flaw was found in PostgreSQL in versions before 13.2.PostgreSQL
- CVE-2021-26684A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HFAruba ClearPass Policy Manager
- CVE-2021-20220A flaw was found in Undertow.undertow · io.undertow:undertow-core
- CVE-2021-26682A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8Aruba ClearPass Policy Manager
- CVE-2021-26681A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HFAruba ClearPass Policy Manager
- CVE-2021-26683A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HFAruba ClearPass Policy Manager
- CVE-2021-26686A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, Aruba ClearPass Policy Manager
- CVE-2021-27579Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an
- CVE-2021-26685A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, Aruba ClearPass Policy Manager
- CVE-2020-26609fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain administrator crede
- CVE-2021-20226A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of servickernel
- CVE-2021-20230A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and vestunnel
- CVE-2020-16243Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files.LeviStudioU
- CVE-2020-25161The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operatioAdvantech WebAccess/SCADA
- CVE-2021-22113Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassingSpring Cloud Netflix Zuul · org.springframework.cloud:sprin…
- CVE-2021-25630"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user.Collabora Productivity Collabora Online · The Document Foun…
- CVE-2020-4953IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by eIBM Planning Analytics
- CVE-2021-27550Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a local denial of servi
- CVE-2021-3252KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control.
- CVE-2020-14359A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass okeycloak · github.com/keycloak/keycloak-gatekeeper
- CVE-2020-8902SSRF in RendertronGoogle Rendertron · rendertron
- CVE-2020-13697An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1.org.nanohttpd:nanohttpd-nanolets
- CVE-2020-25690An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens.fontforge
- CVE-2020-27819An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files.libxls
- CVE-2021-22647Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1Luxion KeyShot · Luxion KeyVR
- CVE-2021-22643Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1Luxion KeyShot · Luxion KeyVR
- CVE-2021-22645Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1Luxion KeyShot · Luxion KeyVR
- CVE-2021-22649Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1Luxion KeyShot · Luxion KeyVR
- CVE-2021-27568An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4.net.minidev:json-smart · net.minidev:json-smart-mini
- CVE-2020-35852Chatbox is affected by cross-site scripting (XSS).
- CVE-2020-27768In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h.ImageMagick