CVEs published February 24, 2021
41 CVEs were published on February 24, 2021: 5 critical, 9 high. 2 are now in CISA KEV.
- Published
- 41
- Critical
- 5
- High
- 9
- Medium
- 6
- Low
- 1
- Unrated
- 20
- Now in CISA KEV
- 2
- Fix available
- 11
Most affected products
- Contec Co. SolarView Compact
- 7
- Cisco NX-OS Software
- 6
- Cisco NX-OS System Software in ACI Mode
- 3
- Cisco Application Services Engine Software
- 2
- Jenkins project Jenkins Claim Plugin · org.jenkins-ci.plugi…
- 2
- VMware vCenter Server · VMware Cloud Foundation
- 2
- Apache Batik · org.apache.xmlgraphics:batik-svgbrowser
- 1
- Apache XmlGraphics Commons · org.apache.xmlgraphics:xmlgrap…
- 1
- BB-ESWGP506-2SFP-T
- 1
- Cisco ACI Multi-Site Orchestrator Software
- 1
Critical 5
- CVE-2021-1396Cisco Application Services Engine Unauthorized Access VulnerabilitiesCisco Application Services Engine Software
- CVE-2021-1393Cisco Application Services Engine Unauthorized Access VulnerabilitiesCisco Application Services Engine Software
- CVE-2021-1388Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass VulnerabilityCisco ACI Multi-Site Orchestrator Software
- CVE-2021-1361Cisco NX-OS Software Unauthenticated Arbitrary File Actions VulnerabilityCisco NX-OS Software
- CVE-2021-21972The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.VMware vCenter Server · VMware Cloud Foundation
High 9
- CVE-2021-1387Cisco NX-OS Software IPv6 Netstack Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2021-1368Cisco FXOS and NX-OS Software Unidirectional Link Detection Denial of Service and Arbitrary Code Execution VulnerabilityCisco NX-OS Software
- CVE-2021-1230Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2021-1228Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2021-1227Cisco NX-OS Software NX-API Cross-Site Request Forgery VulnerabilityCisco NX-OS Software
- CVE-2021-21974OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overfloVMware ESXi · VMware Cloud Foundation
- CVE-2020-7836VOICEYE WSActiveBridgeES versions prior to 2.1.0.3 contains a stack-based buffer overflow vulnerability caused by improper bound checking paVOICEYE WSActiveBridgeES
- CVE-2020-28599A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2.Openscad
- CVE-2020-7846Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key.Cnesty Helpcom
Medium, low and unrated 27
- CVE-2021-1450Cisco AnyConnect Secure Mobility Client Denial of Service VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2021-1367Cisco NX-OS Software Protocol Independent Multicast Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2021-1231Cisco Nexus 9000 Series Fabric Switches ACI Mode Link Layer Discovery Protocol Port Denial of Service VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2021-1229Cisco NX-OS Software ICMP Version 6 Memory Leak Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2020-4931IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing IBM MQ Appliance
- CVE-2020-11988Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParseApache XmlGraphics Commons · org.apache.xmlgraphics:xmlgrap…
- CVE-2021-21973The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter ServVMware vCenter Server · VMware Cloud Foundation
- CVE-2020-27224In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.The Eclipse Foundation Eclipse Theia · @theia/preview
- CVE-2021-22667BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unBB-ESWGP506-2SFP-T
- CVE-2021-21622Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored crossJenkins project Jenkins Artifact Repository Parameter Plugi…
- CVE-2021-21620A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims.Jenkins project Jenkins Claim Plugin · org.jenkins-ci.plugi…
- CVE-2021-21621Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication deJenkins project Jenkins Support Core Plugin · org.jenkins-c…
- CVE-2021-21619Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerabilitJenkins project Jenkins Claim Plugin · org.jenkins-ci.plugi…
- CVE-2021-21617A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply differeJenkins project Jenkins Configuration Slicing Plugin · org.…
- CVE-2021-21618Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a storeJenkins project Jenkins Repository Connector Plugin · org.j…
- CVE-2021-21616Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS)Jenkins project Jenkins Active Choices Plugin · org.biouno:…
- CVE-2021-3355A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/S
- CVE-2020-12702Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1
- CVE-2021-20662Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting infoContec Co. SolarView Compact
- CVE-2021-20661Directory traversal vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows authenticated attackers to delete arbitrary fileContec Co. SolarView Compact
- CVE-2021-20659SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload arbitrary files via unspecified vectors.Contec Co. SolarView Compact
- CVE-2021-20660Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via uContec Co. SolarView Compact
- CVE-2021-20658SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecContec Co. SolarView Compact
- CVE-2021-20656Exposure of information through directory listing in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtContec Co. SolarView Compact
- CVE-2021-20657Improper access control vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain and/or aContec Co. SolarView Compact
- CVE-2020-11987Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel.Apache Batik · org.apache.xmlgraphics:batik-svgbrowser
- CVE-2021-27645The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup loo