CVEs published March 3, 2021
56 CVEs were published on March 3, 2021: 3 critical, 3 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 3
- High
- 3
- Medium
- 11
- Low
- 2
- Unrated
- 37
- Now in CISA KEV
- 1
- Fix available
- 21
Most affected products
- grub2
- 7
- Fatek FvDesigner
- 5
- GitHub Enterprise Server
- 4
- glpi-project glpi
- 3
- Nextcloud Server
- 3
- pillow
- 3
- GitLab
- 2
- IBM Security Verify Bridge
- 2
- NodeJS Node
- 2
- Advantech
- 1
Critical 3
- CVE-2021-22681Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix contRockwell Automation Studio 5000 Logix Designer, RSLogix 500…
- CVE-2020-28597A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21.Epignosis
- CVE-2021-25315salt-api unauthenticated remote code executionSUSE Linux Enterprise Server 15 SP · openSUSE Tumbleweed +1
High 3
- CVE-2020-13558A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1.Webkit
- CVE-2020-28591An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and MasterSlic3r
- CVE-2020-13554An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationAdvantech
Medium, low and unrated 50
- CVE-2021-21331DataDog API Client contains a Local Information Disclosure Vulnerabilitydatadog-api-client-java · com.datadoghq:datadog-api-client
- CVE-2021-27940resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.github.com/openark/orchestrator
- CVE-2021-27931LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp.
- CVE-2021-27935An issue was discovered in AdGuard before 0.105.2.
- CVE-2021-21314XSS injection on ticket updateglpi-project glpi
- CVE-2021-21312Stored XSS on documentsglpi-project glpi
- CVE-2021-21313XSS on tabsglpi-project glpi
- CVE-2021-27839A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions su
- CVE-2021-22182An issue has been discovered in GitLab affecting all versions starting with 13.7.GitLab
- CVE-2021-22188An issue has been discovered in GitLab affecting all versions starting with 13.0.GitLab
- CVE-2021-21978VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability.VMware View Planner
- CVE-2020-8296Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.Nextcloud Server
- CVE-2021-22878Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`Nextcloud Server
- CVE-2021-22877A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configurNextcloud Server
- CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an NodeJS Node
- CVE-2021-22884Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”.NodeJS Node
- CVE-2020-29047The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operati
- CVE-2021-20442IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound autheIBM Security Verify Bridge
- CVE-2021-20441IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inforIBM Security Verify Bridge
- CVE-2021-20233A flaw was found in grub2 in versions prior to 2.06.grub2
- CVE-2021-20225A flaw was found in grub2 in versions prior to 2.06.grub2
- CVE-2020-25632A flaw was found in grub2 in versions prior to 2.06.grub2
- CVE-2020-25647A flaw was found in grub2 in versions prior to 2.06.grub2
- CVE-2020-14372A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled.grub2
- CVE-2020-27749A flaw was found in grub2 in versions prior to 2.06.grub2
- CVE-2020-27779A flaw was found in grub2 in versions prior to 2.06.grub2
- CVE-2021-20076Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unpriTenable.sc
- CVE-2021-21979In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 andBitnami Containers
- CVE-2021-22638Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to craFatek FvDesigner
- CVE-2021-22683Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to crFatek FvDesigner
- CVE-2021-22666Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing aFatek FvDesigner
- CVE-2021-22670An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, alFatek FvDesigner
- CVE-2021-22662A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, Fatek FvDesigner
- CVE-2020-15937An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker tFortinet FortiOS
- CVE-2021-27215An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4.
- CVE-2021-25252Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lTrend Micro Virus Scan API (VSAPI) Engine
- CVE-2021-26813markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.markdown2
- CVE-2020-35296ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.zoujingli/thinkadmin
- CVE-2021-23347Cross-site Scripting (XSS)github.com/argoproj/argo-cd/cmd · github.com/argoproj/ar… +1
- CVE-2021-27921Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is notpillow
- CVE-2021-27922Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is notpillow
- CVE-2021-27923Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is notpillow
- CVE-2021-2138Vulnerability in the Oracle Cloud Infrastructure Data Science Notebook Sessions.Oracle Cloud Infrastructure Data Science Notebook Sessions
- CVE-2021-22863Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requestsGitHub Enterprise Server
- CVE-2021-22862Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forksGitHub Enterprise Server
- CVE-2020-10519Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise ServerGitHub Enterprise Server
- CVE-2021-22861Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositoriesGitHub Enterprise Server
- CVE-2021-21353Remote code execution in pugpugjs pug · pug +1
- CVE-2021-21352Predictable tokens used for password resetsanuko timetracker
- CVE-2021-27927In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControll