CVEs published March 4, 2021
67 CVEs were published on March 4, 2021: 5 critical, 2 high. 1 is now in CISA KEV.
- Published
- 67
- Critical
- 5
- High
- 2
- Medium
- 23
- Low
- 6
- Unrated
- 31
- Now in CISA KEV
- 1
- Fix available
- 27
Most affected products
- Samsung Mobile Devices
- 11
- Joomla! Project Joomla! CMS
- 9
- CGAL
- 3
- IBM Rational Team Concert · IBM Engineering Workflow Man… +4
- 3
- qcubed/qcubed
- 3
- Samsung Mobile Samsung Pay Mini
- 3
- Clustered Data ONTAP
- 2
- Facebook Zstandard
- 2
- GitLab
- 2
- IBM Rational Quality Manager · IBM Rational Team Concert +4
- 2
Critical 5
- CVE-2021-23344Remote Code Execution (RCE)total.js
- CVE-2020-28601A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.CGAL
- CVE-2020-28636A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.CGAL
- CVE-2020-35628A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.CGAL
- CVE-2020-35636A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_pCGAL Project
High 2
- CVE-2021-25346A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code executioSamsung Mobile Devices
- CVE-2021-22128An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attFortinet FortiProxy
Medium, low and unrated 60
- CVE-2021-27314SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username
- CVE-2019-18630On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.0
- CVE-2020-25639A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way thkernel
- CVE-2021-3404In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) dytnef
- CVE-2021-3403In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code exytnef
- CVE-2021-25348Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorizedSamsung Mobile Samsung Internet
- CVE-2021-25347Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the providerSamsung Mobile Devices
- CVE-2021-25345Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupportSamsung Mobile Devices
- CVE-2021-25344Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number wiSamsung Mobile Devices
- CVE-2021-25343Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0Samsung Mobile Samsung Members
- CVE-2021-25342Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijackiSamsung Mobile SMP sdk
- CVE-2021-25341Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack bySamsung Mobile S Assistant
- CVE-2021-25340Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to cSamsung Mobile Devices
- CVE-2021-25339Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernelSamsung Mobile Devices
- CVE-2021-25338Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernSamsung Mobile Devices
- CVE-2021-25337Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to readSamsung Mobile Devices
- CVE-2021-25336Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applicationSamsung Mobile Devices
- CVE-2021-25335Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated useSamsung Mobile Devices
- CVE-2021-25334Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause peSamsung Mobile Devices
- CVE-2021-25333Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreSamsung Mobile Samsung Pay Mini
- CVE-2021-25332Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscrSamsung Mobile Samsung Pay Mini
- CVE-2021-25331Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreSamsung Mobile Samsung Pay Mini
- CVE-2021-26989Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote aClustered Data ONTAP
- CVE-2021-26988Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorizClustered Data ONTAP
- CVE-2021-26293An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled.
- CVE-2021-24031In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions.Facebook Zstandard
- CVE-2021-24032Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output fileFacebook Zstandard
- CVE-2020-8298fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, anfs-path
- CVE-2021-20351IBM Engineering products are vulnerable to cross-site scripting.IBM Rational Team Concert · IBM Engineering Workflow Man… +4
- CVE-2021-20350IBM Engineering products are vulnerable to cross-site scripting.IBM Rational Quality Manager · IBM Rational Team Concert +4
- CVE-2021-20340IBM Engineering products are vulnerable to cross-site scripting.IBM Rational DOORS Next Generation · IBM Engineering Lif… +4
- CVE-2020-4975IBM Engineering products are vulnerable to cross-site scripting.IBM Rational Team Concert · IBM Engineering Workflow Man… +4
- CVE-2020-4866IBM Engineering products are vulnerable to cross-site scripting.IBM Engineering Workflow Management · IBM Rational Team… +4
- CVE-2020-4863IBM Engineering products are vulnerable to stored cross-site scripting.IBM Rational Quality Manager · IBM Engineering Workflow… +4
- CVE-2020-4857IBM Engineering products are vulnerable to stored cross-site scripting.IBM Rational Quality Manager · IBM Rational Team Concert +4
- CVE-2020-4856IBM Engineering products are vulnerable to stored cross-site scripting.IBM Rational Team Concert · IBM Engineering Workflow Man… +4
- CVE-2021-27217An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3.
- CVE-2021-26029[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author fieldJoomla! Project Joomla! CMS
- CVE-2021-26028[20210308] - Core - Path Traversal within joomla/archive zip classJoomla! Project Joomla! CMS · joomla/archive
- CVE-2021-26027[20210307] - Core - ACL violation within com_content frontend editingJoomla! Project Joomla! CMS
- CVE-2021-23132[20210306] - Core - com_media allowed paths that are not intended for image uploadsJoomla! Project Joomla! CMS
- CVE-2021-23131[20210305] - Core - Input validation within the template managerJoomla! Project Joomla! CMS
- CVE-2021-23130[20210304] - Core - XSS within the feed parser libraryJoomla! Project Joomla! CMS
- CVE-2021-23129[20210303] - Core - XSS within alert messages showed to usersJoomla! Project Joomla! CMS
- CVE-2021-23128[20210302] - Core - Potential Insecure FOFEncryptRandvalJoomla! Project Joomla! CMS
- CVE-2021-23127[20210301] - Core - Insecure randomness within 2FA secret generationJoomla! Project Joomla! CMS
- CVE-2021-23126[20210301] - Core - Insecure randomness within 2FA secret generationJoomla! Project Joomla! CMS
- CVE-2020-15938When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it iFortinet FortiOS
- CVE-2021-23346Regular Expression Denial of Service (ReDoS)html-parse-stringify · html-parse-stringify2
- CVE-2020-35329Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '.
- CVE-2020-35328Courier Management System 1.0 - 'First Name' Stored XSS
- CVE-2020-35327SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref_no (POST) parameter to admin
- CVE-2021-22183An issue has been discovered in GitLab affecting all versions starting with 11.8.GitLab
- CVE-2021-22189Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for theGitLab
- CVE-2020-24914A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strqcubed/qcubed
- CVE-2020-24913A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated aqcubed/qcubed
- CVE-2020-24912A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allowqcubed/qcubed
- CVE-2020-24036PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malic
- CVE-2019-18629Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.
- CVE-2019-18628Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.