# CVEs published 2021-03-02

39 CVEs were published on March 2, 2021: 5 critical, 4 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2021-27065](https://cve.now/CVE-2021-27065.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +2)
- [CVE-2021-27078](https://cve.now/CVE-2021-27078.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.1, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-26858](https://cve.now/CVE-2021-26858.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-26855](https://cve.now/CVE-2021-26855.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.1, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-26857](https://cve.now/CVE-2021-26857.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft Exchange Server 2010 Service Pack · Microsoft… +3)
- [CVE-2021-26854](https://cve.now/CVE-2021-26854.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-26412](https://cve.now/CVE-2021-26412.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.1, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2020-12530](https://cve.now/CVE-2020-12530.md): An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. (CVSS 4.3, MB connect line mymbCONNECT24 · MB connect line mbCONNECT24)
- [CVE-2020-12529](https://cve.now/CVE-2020-12529.md): An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP (CVSS 5.8, MB connect line mymbCONNECT24 · MB connect line mbCONNECT24)
- [CVE-2020-12528](https://cve.now/CVE-2020-12528.md): An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. (CVSS 6.5, MB connect line mymbCONNECT24 · MB connect line mbCONNECT24)
- [CVE-2020-12527](https://cve.now/CVE-2020-12527.md): Improper Access Validation in products of MB connect line and Helmholz (CVSS 6.5, MB connect line mymbCONNECT24 · MB connect line mbCONNEC… +2)
- [CVE-2021-21258](https://cve.now/CVE-2021-21258.md): XSS injection in ajax/kanban (CVSS 6.8, glpi-project glpi)
- [CVE-2021-21255](https://cve.now/CVE-2021-21255.md): entities switch IDOR (CVSS 5.8, glpi-project glpi)
- [CVE-2021-27885](https://cve.now/CVE-2021-27885.md): usersettings.php in e107 through 2.3.0 lacks a certain e\_TOKEN protection mechanism. (no CVSS)
- [CVE-2021-22187](https://cve.now/CVE-2021-22187.md): An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. (CVSS 4.3, GitLab)
- [CVE-2021-22294](https://cve.now/CVE-2021-22294.md): A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. (no CVSS, HarmonyOS)
- [CVE-2020-28657](https://cve.now/CVE-2020-28657.md): In bPanel 2.0, the administrative ajax endpoints (aka ajax/aj\_\*.php) are accessible without authentication and allow SQL injections, which c (no CVSS)
- [CVE-2021-22296](https://cve.now/CVE-2021-22296.md): A component of HarmonyOS 2.0 has a DoS vulnerability. (no CVSS, HarmonyOS)
- [CVE-2021-25330](https://cve.now/CVE-2021-25330.md): Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions including denial of s (no CVSS, Samsung Mobile Devices)
- [CVE-2021-3384](https://cve.now/CVE-2021-3384.md): A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which (no CVSS)
- [CVE-2020-4726](https://cve.now/CVE-2020-4726.md): The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user (CVSS 4.0, IBM Cloud APM)
- [CVE-2020-4725](https://cve.now/CVE-2020-4725.md): IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request t (CVSS 4.3, IBM Cloud APM)
- [CVE-2020-4719](https://cve.now/CVE-2020-4719.md): The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configur (CVSS 4.9, IBM Cloud APM)
- [CVE-2020-23518](https://cve.now/CVE-2020-23518.md): Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows (no CVSS)
- [CVE-2021-21514](https://cve.now/CVE-2021-21514.md): Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. (CVSS 4.9, Dell Open Manage Server Administrator)
- [CVE-2021-21513](https://cve.now/CVE-2021-21513.md): Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server (DWS) enabled config (CVSS 8.6, Dell Open Manage Server Administrator)
- [CVE-2020-25902](https://cve.now/CVE-2020-25902.md): Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2020-1936](https://cve.now/CVE-2020-1936.md): Stored XSS in Apache Ambari (no CVSS, Apache Software Foundation Apache Ambari · org.apache.ambar…)
- [CVE-2021-27904](https://cve.now/CVE-2021-27904.md): An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139. (no CVSS)
- [CVE-2021-27901](https://cve.now/CVE-2021-27901.md): An issue was discovered on LG mobile devices with Android OS 11 software. (no CVSS)
- [CVE-2021-21321](https://cve.now/CVE-2021-21321.md): Prefix escape (CVSS 10.0, fastify-reply-from)
- [CVE-2021-21322](https://cve.now/CVE-2021-21322.md): Prefix escape (CVSS 10.0, fastify-http-proxy)
- [CVE-2021-21320](https://cve.now/CVE-2021-21320.md): User content sandbox can be confused into opening arbitrary documents (CVSS 2.6, matrix-org matrix-react-sdk · matrix-react-sdk)
- [CVE-2021-27730](https://cve.now/CVE-2021-27730.md): Accellion FTA 9\_12\_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. (no CVSS)
- [CVE-2021-27731](https://cve.now/CVE-2021-27731.md): Accellion FTA 9\_12\_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. (no CVSS)
- [CVE-2021-25309](https://cve.now/CVE-2021-25309.md): The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling funct (no CVSS)
- [CVE-2021-25306](https://cve.now/CVE-2021-25306.md): A buffer overflow vulnerability in the AT command interface of Gigaset DX600A v41.00-175 devices allows remote attackers to force a device r (no CVSS)
- [CVE-2021-27804](https://cve.now/CVE-2021-27804.md): JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption. (no CVSS)
- [CVE-2021-27888](https://cve.now/CVE-2021-27888.md): ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.