# CVEs published 2021-03-01

30 CVEs were published on March 1, 2021: 2 critical, 4 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-27886](https://cve.now/CVE-2021-27886.md): rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command (no CVSS)
- [CVE-2021-27884](https://cve.now/CVE-2021-27884.md): Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. (no CVSS, yapi-vendor)
- [CVE-2021-27877](https://cve.now/CVE-2021-27877.md): An issue was discovered in Veritas Backup Exec before 21.2. (CVSS 8.2, KEV)
- [CVE-2021-27878](https://cve.now/CVE-2021-27878.md): An issue was discovered in Veritas Backup Exec before 21.2. (CVSS 8.8, KEV)
- [CVE-2021-27876](https://cve.now/CVE-2021-27876.md): An issue was discovered in Veritas Backup Exec before 21.2. (CVSS 8.1, KEV)
- [CVE-2021-26704](https://cve.now/CVE-2021-26704.md): EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI. (no CVSS)
- [CVE-2021-26703](https://cve.now/CVE-2021-26703.md): EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase (no CVSS)
- [CVE-2021-3342](https://cve.now/CVE-2021-3342.md): EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex (no CVSS)
- [CVE-2021-26475](https://cve.now/CVE-2021-26475.md): EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. (no CVSS)
- [CVE-2021-26476](https://cve.now/CVE-2021-26476.md): EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI. (no CVSS)
- [CVE-2021-26702](https://cve.now/CVE-2021-26702.md): EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset\_dictionary URI. (no CVSS)
- [CVE-2021-21517](https://cve.now/CVE-2021-21517.md): SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes (CVSS 7.2, Dell SRS Policy Manager)
- [CVE-2021-21515](https://cve.now/CVE-2021-21515.md): Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. (CVSS 9.0, Dell SourceOne)
- [CVE-2021-3332](https://cve.now/CVE-2021-3332.md): WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post\_password. (no CVSS)
- [CVE-2021-27317](https://cve.now/CVE-2021-27317.md): Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2021-27318](https://cve.now/CVE-2021-27318.md): Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2021-22114](https://cve.now/CVE-2021-22114.md): Addresses partial fix in CVE-2018-1263. (no CVSS, Spring Integration Zip extension · org.springframework.inte…)
- [CVE-2021-25914](https://cve.now/CVE-2021-25914.md): Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lea (CVSS 9.8, object-collider)
- [CVE-2020-36240](https://cve.now/CVE-2020-36240.md): The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote atta (no CVSS, Atlassian Crowd)
- [CVE-2018-25004](https://cve.now/CVE-2018-25004.md): Invariant failure when explaining a find with a UUID (CVSS 4.9, MongoDB Server)
- [CVE-2020-7929](https://cve.now/CVE-2020-7929.md): Specially crafted regex query can cause DoS (CVSS 6.5, MongoDB Server)
- [CVE-2020-9479](https://cve.now/CVE-2020-9479.md): unzip directory traversal (no CVSS, Apache Software Foundation Apache AsterixDB)
- [CVE-2021-25833](https://cve.now/CVE-2021-25833.md): A file extension handling issue was found in \[server\] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. (no CVSS)
- [CVE-2021-25832](https://cve.now/CVE-2021-25832.md): A heap buffer overflow vulnerability inside of BMP image processing was found at \[core\] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. (no CVSS)
- [CVE-2021-25831](https://cve.now/CVE-2021-25831.md): A file extension handling issue was found in \[core\] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. (no CVSS)
- [CVE-2021-25830](https://cve.now/CVE-2021-25830.md): A file extension handling issue was found in \[core\] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. (no CVSS)
- [CVE-2021-25829](https://cve.now/CVE-2021-25829.md): An improper binary stream data handling issue was found in the \[core\] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. (no CVSS)
- [CVE-2021-25122](https://cve.now/CVE-2021-25122.md): Apache Tomcat h2c request mix-up (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +2)
- [CVE-2021-25329](https://cve.now/CVE-2021-25329.md): Incomplete fix for CVE-2020-9484 (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +1)
- [CVE-2021-27225](https://cve.now/CVE-2021-27225.md): In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.