CVEs published March 1, 2021
30 CVEs were published on March 1, 2021: 2 critical, 4 high. 3 are now in CISA KEV.
- Published
- 30
- Critical
- 2
- High
- 4
- Medium
- 3
- Low
- 0
- Unrated
- 21
- Now in CISA KEV
- 3
- Fix available
- 10
Most affected products
- MongoDB Server
- 2
- Apache Software Foundation Apache AsterixDB
- 1
- Apache Software Foundation Apache Tomcat · tomcat +1
- 1
- Apache Software Foundation Apache Tomcat · tomcat +2
- 1
- Atlassian Crowd
- 1
- Dell SourceOne
- 1
- Dell SRS Policy Manager
- 1
- object-collider
- 1
- Spring Integration Zip extension · org.springframework.inte…
- 1
- yapi-vendor
- 1
Critical 2
High 4
- CVE-2021-27877An issue was discovered in Veritas Backup Exec before 21.2.
- CVE-2021-27878An issue was discovered in Veritas Backup Exec before 21.2.
- CVE-2021-27876An issue was discovered in Veritas Backup Exec before 21.2.
- CVE-2021-21517SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes Dell SRS Policy Manager
Medium, low and unrated 24
- CVE-2021-27886rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command
- CVE-2021-27884Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens.yapi-vendor
- CVE-2021-26704EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI.
- CVE-2021-26703EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase
- CVE-2021-3342EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex
- CVE-2021-26475EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
- CVE-2021-26476EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI.
- CVE-2021-26702EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.
- CVE-2021-3332WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password.
- CVE-2021-27317Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web s
- CVE-2021-27318Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web s
- CVE-2021-22114Addresses partial fix in CVE-2018-1263.Spring Integration Zip extension · org.springframework.inte…
- CVE-2020-36240The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attaAtlassian Crowd
- CVE-2018-25004Invariant failure when explaining a find with a UUIDMongoDB Server
- CVE-2020-7929Specially crafted regex query can cause DoSMongoDB Server
- CVE-2020-9479unzip directory traversalApache Software Foundation Apache AsterixDB
- CVE-2021-25833A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21.
- CVE-2021-25832A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0.
- CVE-2021-25831A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3.
- CVE-2021-25830A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13.
- CVE-2021-25829An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3.
- CVE-2021-25122Apache Tomcat h2c request mix-upApache Software Foundation Apache Tomcat · tomcat +2
- CVE-2021-25329Incomplete fix for CVE-2020-9484Apache Software Foundation Apache Tomcat · tomcat +1
- CVE-2021-27225In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to