CVEs published March 2, 2021
39 CVEs were published on March 2, 2021: 5 critical, 4 high. 4 are now in CISA KEV.
- Published
- 39
- Critical
- 5
- High
- 4
- Medium
- 12
- Low
- 1
- Unrated
- 17
- Now in CISA KEV
- 4
- Fix available
- 13
Most affected products
- Microsoft Exchange Server 2013 Cumulative Update · Micro… +1
- 5
- IBM Cloud APM
- 3
- MB connect line mymbCONNECT24 · MB connect line mbCONNECT24
- 3
- Dell Open Manage Server Administrator
- 2
- glpi-project glpi
- 2
- HarmonyOS
- 2
- Apache Software Foundation Apache Ambari · org.apache.ambar…
- 1
- fastify-http-proxy
- 1
- fastify-reply-from
- 1
- GitLab
- 1
Critical 5
- CVE-2021-27078Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26412Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-21321Prefix escapefastify-reply-from
- CVE-2021-21322Prefix escapefastify-http-proxy
High 4
- CVE-2021-27065Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +2
- CVE-2021-26858Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26857Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2010 Service Pack · Microsoft… +3
- CVE-2021-21513Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server (DWS) enabled configDell Open Manage Server Administrator
Medium, low and unrated 30
- CVE-2021-26854Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2020-12530An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2.MB connect line mymbCONNECT24 · MB connect line mbCONNECT24
- CVE-2020-12529An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAPMB connect line mymbCONNECT24 · MB connect line mbCONNECT24
- CVE-2020-12528An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2.MB connect line mymbCONNECT24 · MB connect line mbCONNECT24
- CVE-2020-12527Improper Access Validation in products of MB connect line and HelmholzMB connect line mymbCONNECT24 · MB connect line mbCONNEC… +2
- CVE-2021-21258XSS injection in ajax/kanbanglpi-project glpi
- CVE-2021-21255entities switch IDORglpi-project glpi
- CVE-2021-27885usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
- CVE-2021-22187An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7.GitLab
- CVE-2021-22294A component API of the HarmonyOS 2.0 has a permission bypass vulnerability.HarmonyOS
- CVE-2020-28657In bPanel 2.0, the administrative ajax endpoints (aka ajax/aj_*.php) are accessible without authentication and allow SQL injections, which c
- CVE-2021-22296A component of HarmonyOS 2.0 has a DoS vulnerability.HarmonyOS
- CVE-2021-25330Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions including denial of sSamsung Mobile Devices
- CVE-2021-3384A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which
- CVE-2020-4726The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user IBM Cloud APM
- CVE-2020-4725IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request tIBM Cloud APM
- CVE-2020-4719The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configurIBM Cloud APM
- CVE-2020-23518Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows
- CVE-2021-21514Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability.Dell Open Manage Server Administrator
- CVE-2020-25902Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability.
- CVE-2020-1936Stored XSS in Apache AmbariApache Software Foundation Apache Ambari · org.apache.ambar…
- CVE-2021-27904An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139.
- CVE-2021-27901An issue was discovered on LG mobile devices with Android OS 11 software.
- CVE-2021-21320User content sandbox can be confused into opening arbitrary documentsmatrix-org matrix-react-sdk · matrix-react-sdk
- CVE-2021-27730Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint.
- CVE-2021-27731Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint.
- CVE-2021-25309The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling funct
- CVE-2021-25306A buffer overflow vulnerability in the AT command interface of Gigaset DX600A v41.00-175 devices allows remote attackers to force a device r
- CVE-2021-27804JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption.
- CVE-2021-27888ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.