CVEs published February 26, 2021
74 CVEs were published on February 26, 2021: 4 critical, 8 high.
- Published
- 74
- Critical
- 4
- High
- 8
- Medium
- 12
- Low
- 4
- Unrated
- 46
- Now in CISA KEV
- 0
- Fix available
- 48
Most affected products
- Mozilla Firefox
- 17
- Android
- 8
- Mozilla Firefox · Mozilla Thunderbird
- 8
- Synology DiskStation Manager
- 7
- Micro Focus Solutions Business Manager
- 6
- matrix-org synapse · matrix-synapse
- 2
- node-red · @node-red/runtime
- 2
- PrestaShop
- 2
- ABB AC500 V2 products with onboard Ethernet
- 1
- aio-libs aiohttp · aiohttp
- 1
Critical 4
- CVE-2021-26562Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle Synology DiskStation Manager
- CVE-2021-26561Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-theSynology DiskStation Manager
- CVE-2021-26560Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426Synology DiskStation Manager
- CVE-2019-11684Improper Access Control in Bosch Video Recording Manager
High 8
- CVE-2021-27803A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests.
- CVE-2021-26566Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allSynology DiskStation Manager
- CVE-2021-26565Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allowSynology DiskStation Manager
- CVE-2021-26564Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allowSynology DiskStation Manager
- CVE-2021-26563Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to eSynology DiskStation Manager
- CVE-2021-21297Prototype Pollution in Node-Rednode-red · @node-red/runtime
- CVE-2020-24686AC500 V2 webserver denial of service vulnerabilityABB AC500 V2 products with onboard Ethernet
- CVE-2019-18945privilege escalationMicro Focus Solutions Business Manager
Medium, low and unrated 62
- CVE-2021-27198An issue was discovered in Visualware MyConnection Server before v11.1a.
- CVE-2020-36079Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution.
- CVE-2020-27223In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple AcceptThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2021-21309Integer overflow on 32-bit systemsredis
- CVE-2021-26567Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filgithub/knik0 faad2
- CVE-2021-27799ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API th
- CVE-2021-0366In vpu, there is a possible memory corruption due to a race condition.Android
- CVE-2021-0367In vpu, there is a possible memory corruption due to a race condition.Android
- CVE-2021-0401In vow, there is a possible memory corruption due to a race condition.Android
- CVE-2021-0402In jpeg, there is a possible out of bounds write due to improper input validation.Android
- CVE-2021-0403In netdiag, there is a possible information disclosure due to a missing permission check.Android
- CVE-2021-0404In mobile_log_d, there is a possible information disclosure due to improper input validation.Android
- CVE-2021-0405In performance driver, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0406In cameraisp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-21308Improper session management for soft logoutPrestaShop
- CVE-2021-21302CSV Injection via csv exportPrestaShop
- CVE-2021-21273Open redirects on some federation and push requestsmatrix-org synapse · matrix-synapse
- CVE-2021-21274Denial of service attack via .well-known lookupsmatrix-org synapse · matrix-synapse
- CVE-2021-23345Server-side Request Forgery (SSRF)github.com/thecodingmachine/gotenberg
- CVE-2021-21298Path traversal in Node-Rednode-red · @node-red/runtime
- CVE-2021-23964Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6.Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-23965Mozilla developers reported memory safety bugs present in Firefox 84.Mozilla Firefox
- CVE-2021-23979Mozilla developers reported memory safety bugs present in Firefox 85.Mozilla Firefox
- CVE-2021-23978Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-28199best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor.
- CVE-2020-28646ownCloud owncloud/client before 2.7 allows DLL Injection.
- CVE-2021-22661Changing the password on the module webpage does not require the user to type in the current password first.ICX35-HWC-A, ICX35-HWC-E
- CVE-2021-26903LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text'].
- CVE-2021-26904LMA ISIDA Retriever 5.2 allows SQL Injection.
- CVE-2021-3010There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3.
- CVE-2020-26200A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity.Kaspersky Rescue Disk Version · Kaspersky Endpoint Security…
- CVE-2019-18943XML External Entity processingMicro Focus Solutions Business Manager
- CVE-2019-18942Stored cross site scriptingMicro Focus Solutions Business Manager
- CVE-2019-18944Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.Micro Focus Solutions Business Manager
- CVE-2019-18947information disclosureMicro Focus Solutions Business Manager
- CVE-2019-18946Session fixationMicro Focus Solutions Business Manager
- CVE-2020-24455Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via locTPM2 source
- CVE-2021-21724A ZTE product has a memory leak vulnerability.ZXR10
- CVE-2021-21330Open redirect vulnerability in aiohttpaio-libs aiohttp · aiohttp
- CVE-2021-23977Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data fromMozilla Firefox
- CVE-2021-23963When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to Mozilla Firefox
- CVE-2021-23953If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said informaMozilla Firefox · Mozilla Thunderbird
- CVE-2021-23954Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruptiMozilla Firefox · Mozilla Thunderbird
- CVE-2021-23955The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks.Mozilla Firefox
- CVE-2021-23956An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory.Mozilla Firefox
- CVE-2021-23957Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox.Mozilla Firefox
- CVE-2021-23958The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information.Mozilla Firefox
- CVE-2021-23959An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar.Mozilla Firefox
- CVE-2021-23960Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-23961Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosMozilla Firefox
- CVE-2021-23962Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash.Mozilla Firefox
- CVE-2021-23968If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation reMozilla Firefox · Mozilla Thunderbird
- CVE-2021-23969As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file isMozilla Firefox · Mozilla Thunderbird
- CVE-2021-23970Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code.Mozilla Firefox
- CVE-2021-23971When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy.Mozilla Firefox
- CVE-2021-23972One phishing tactic on the web is to provide a link with HTTP Auth.Mozilla Firefox
- CVE-2021-23973When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-23974The DOMParser API did not properly process '<noscript>' elements for escaping.Mozilla Firefox
- CVE-2021-23975The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes.Mozilla Firefox
- CVE-2021-23976When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed deMozilla Firefox
- CVE-2021-21328Denial of Servicevapor
- CVE-2020-27618The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364