# CVEs published 2021-03-03

56 CVEs were published on March 3, 2021: 3 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-21331](https://cve.now/CVE-2021-21331.md): DataDog API Client contains a Local Information Disclosure Vulnerability (CVSS 3.0, datadog-api-client-java · com.datadoghq:datadog-api-client)
- [CVE-2021-27940](https://cve.now/CVE-2021-27940.md): resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter. (no CVSS, github.com/openark/orchestrator)
- [CVE-2021-27931](https://cve.now/CVE-2021-27931.md): LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. (no CVSS)
- [CVE-2021-27935](https://cve.now/CVE-2021-27935.md): An issue was discovered in AdGuard before 0.105.2. (no CVSS)
- [CVE-2021-21314](https://cve.now/CVE-2021-21314.md): XSS injection on ticket update (CVSS 5.4, glpi-project glpi)
- [CVE-2021-21312](https://cve.now/CVE-2021-21312.md): Stored XSS on documents (CVSS 5.4, glpi-project glpi)
- [CVE-2021-21313](https://cve.now/CVE-2021-21313.md): XSS on tabs (CVSS 4.9, glpi-project glpi)
- [CVE-2021-27839](https://cve.now/CVE-2021-27839.md): A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions su (no CVSS)
- [CVE-2021-22681](https://cve.now/CVE-2021-22681.md): Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix cont (CVSS 9.8, KEV, Rockwell Automation Studio 5000 Logix Designer, RSLogix 500…)
- [CVE-2021-22182](https://cve.now/CVE-2021-22182.md): An issue has been discovered in GitLab affecting all versions starting with 13.7. (CVSS 3.5, GitLab)
- [CVE-2021-22188](https://cve.now/CVE-2021-22188.md): An issue has been discovered in GitLab affecting all versions starting with 13.0. (CVSS 5.3, GitLab)
- [CVE-2020-13558](https://cve.now/CVE-2020-13558.md): A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. (CVSS 8.8, Webkit)
- [CVE-2020-28591](https://cve.now/CVE-2020-28591.md): An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master (CVSS 8.6, Slic3r)
- [CVE-2020-28597](https://cve.now/CVE-2020-28597.md): A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. (CVSS 9.8, Epignosis)
- [CVE-2021-21978](https://cve.now/CVE-2021-21978.md): VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. (no CVSS, VMware View Planner)
- [CVE-2020-8296](https://cve.now/CVE-2020-8296.md): Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. (no CVSS, Nextcloud Server)
- [CVE-2021-22878](https://cve.now/CVE-2021-22878.md): Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in \`OC.Notification.show\` (no CVSS, Nextcloud Server)
- [CVE-2021-22877](https://cve.now/CVE-2021-22877.md): A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configur (no CVSS, Nextcloud Server)
- [CVE-2021-22883](https://cve.now/CVE-2021-22883.md): Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an (no CVSS, NodeJS Node)
- [CVE-2021-22884](https://cve.now/CVE-2021-22884.md): Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. (no CVSS, NodeJS Node)
- [CVE-2020-29047](https://cve.now/CVE-2020-29047.md): The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operati (no CVSS)
- [CVE-2021-20442](https://cve.now/CVE-2021-20442.md): IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe (CVSS 5.9, IBM Security Verify Bridge)
- [CVE-2021-20441](https://cve.now/CVE-2021-20441.md): IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor (CVSS 5.9, IBM Security Verify Bridge)
- [CVE-2021-20233](https://cve.now/CVE-2021-20233.md): A flaw was found in grub2 in versions prior to 2.06. (no CVSS, grub2)
- [CVE-2021-20225](https://cve.now/CVE-2021-20225.md): A flaw was found in grub2 in versions prior to 2.06. (no CVSS, grub2)
- [CVE-2020-25632](https://cve.now/CVE-2020-25632.md): A flaw was found in grub2 in versions prior to 2.06. (no CVSS, grub2)
- [CVE-2020-25647](https://cve.now/CVE-2020-25647.md): A flaw was found in grub2 in versions prior to 2.06. (no CVSS, grub2)
- [CVE-2020-14372](https://cve.now/CVE-2020-14372.md): A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. (no CVSS, grub2)
- [CVE-2020-27749](https://cve.now/CVE-2020-27749.md): A flaw was found in grub2 in versions prior to 2.06. (no CVSS, grub2)
- [CVE-2020-27779](https://cve.now/CVE-2020-27779.md): A flaw was found in grub2 in versions prior to 2.06. (no CVSS, grub2)
- [CVE-2021-20076](https://cve.now/CVE-2021-20076.md): Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unpri (no CVSS, Tenable.sc)
- [CVE-2021-21979](https://cve.now/CVE-2021-21979.md): In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and (no CVSS, Bitnami Containers)
- [CVE-2020-13554](https://cve.now/CVE-2020-13554.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation (CVSS 8.8, Advantech)
- [CVE-2021-22638](https://cve.now/CVE-2021-22638.md): Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to cra (no CVSS, Fatek FvDesigner)
- [CVE-2021-22683](https://cve.now/CVE-2021-22683.md): Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to cr (no CVSS, Fatek FvDesigner)
- [CVE-2021-22666](https://cve.now/CVE-2021-22666.md): Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing a (no CVSS, Fatek FvDesigner)
- [CVE-2021-22670](https://cve.now/CVE-2021-22670.md): An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, al (no CVSS, Fatek FvDesigner)
- [CVE-2021-22662](https://cve.now/CVE-2021-22662.md): A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, (no CVSS, Fatek FvDesigner)
- [CVE-2020-15937](https://cve.now/CVE-2020-15937.md): An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker t (CVSS 4.7, Fortinet FortiOS)
- [CVE-2021-27215](https://cve.now/CVE-2021-27215.md): An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. (no CVSS)
- [CVE-2021-25252](https://cve.now/CVE-2021-25252.md): Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may l (no CVSS, Trend Micro Virus Scan API (VSAPI) Engine)
- [CVE-2021-26813](https://cve.now/CVE-2021-26813.md): markdown2 \>=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. (no CVSS, markdown2)
- [CVE-2020-35296](https://cve.now/CVE-2020-35296.md): ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access. (no CVSS, zoujingli/thinkadmin)
- [CVE-2021-23347](https://cve.now/CVE-2021-23347.md): Cross-site Scripting (XSS) (CVSS 4.7, github.com/argoproj/argo-cd/cmd · github.com/argoproj/ar… +1)
- [CVE-2021-25315](https://cve.now/CVE-2021-25315.md): salt-api unauthenticated remote code execution (CVSS 9.8, SUSE Linux Enterprise Server 15 SP · openSUSE Tumbleweed +1)
- [CVE-2021-27921](https://cve.now/CVE-2021-27921.md): Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not (no CVSS, pillow)
- [CVE-2021-27922](https://cve.now/CVE-2021-27922.md): Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not (no CVSS, pillow)
- [CVE-2021-27923](https://cve.now/CVE-2021-27923.md): Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not (no CVSS, pillow)
- [CVE-2021-2138](https://cve.now/CVE-2021-2138.md): Vulnerability in the Oracle Cloud Infrastructure Data Science Notebook Sessions. (CVSS 4.6, Oracle Cloud Infrastructure Data Science Notebook Sessions)
- [CVE-2021-22863](https://cve.now/CVE-2021-22863.md): Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests (no CVSS, GitHub Enterprise Server)
- [CVE-2021-22862](https://cve.now/CVE-2021-22862.md): Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks (no CVSS, GitHub Enterprise Server)
- [CVE-2020-10519](https://cve.now/CVE-2020-10519.md): Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server (no CVSS, GitHub Enterprise Server)
- [CVE-2021-22861](https://cve.now/CVE-2021-22861.md): Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories (no CVSS, GitHub Enterprise Server)
- [CVE-2021-21353](https://cve.now/CVE-2021-21353.md): Remote code execution in pug (CVSS 6.8, pugjs pug · pug +1)
- [CVE-2021-21352](https://cve.now/CVE-2021-21352.md): Predictable tokens used for password resets (CVSS 6.8, anuko timetracker)
- [CVE-2021-27927](https://cve.now/CVE-2021-27927.md): In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControll (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.