# CVEs published 2021-03-04

67 CVEs were published on March 4, 2021: 5 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-27314](https://cve.now/CVE-2021-27314.md): SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username (no CVSS)
- [CVE-2019-18630](https://cve.now/CVE-2019-18630.md): On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.0 (no CVSS)
- [CVE-2020-25639](https://cve.now/CVE-2020-25639.md): A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way th (no CVSS, kernel)
- [CVE-2021-3404](https://cve.now/CVE-2021-3404.md): In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) d (no CVSS, ytnef)
- [CVE-2021-3403](https://cve.now/CVE-2021-3403.md): In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code ex (no CVSS, ytnef)
- [CVE-2021-25348](https://cve.now/CVE-2021-25348.md): Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized (CVSS 2.1, Samsung Mobile Samsung Internet)
- [CVE-2021-25346](https://cve.now/CVE-2021-25346.md): A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code executio (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2021-25347](https://cve.now/CVE-2021-25347.md): Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2021-25345](https://cve.now/CVE-2021-25345.md): Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupport (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25344](https://cve.now/CVE-2021-25344.md): Missing permission check in knox\_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number wi (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2021-25343](https://cve.now/CVE-2021-25343.md): Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0 (CVSS 4.0, Samsung Mobile Samsung Members)
- [CVE-2021-25342](https://cve.now/CVE-2021-25342.md): Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacki (CVSS 4.0, Samsung Mobile SMP sdk)
- [CVE-2021-25341](https://cve.now/CVE-2021-25341.md): Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by (CVSS 4.0, Samsung Mobile S Assistant)
- [CVE-2021-25340](https://cve.now/CVE-2021-25340.md): Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to c (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2021-25339](https://cve.now/CVE-2021-25339.md): Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2021-25338](https://cve.now/CVE-2021-25338.md): Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kern (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2021-25337](https://cve.now/CVE-2021-25337.md): Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read (CVSS 4.4, KEV, Samsung Mobile Devices)
- [CVE-2021-25336](https://cve.now/CVE-2021-25336.md): Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted application (CVSS 2.8, Samsung Mobile Devices)
- [CVE-2021-25335](https://cve.now/CVE-2021-25335.md): Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated use (CVSS 2.5, Samsung Mobile Devices)
- [CVE-2021-25334](https://cve.now/CVE-2021-25334.md): Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause pe (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2021-25333](https://cve.now/CVE-2021-25333.md): Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscre (CVSS 3.2, Samsung Mobile Samsung Pay Mini)
- [CVE-2021-25332](https://cve.now/CVE-2021-25332.md): Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscr (CVSS 3.2, Samsung Mobile Samsung Pay Mini)
- [CVE-2021-25331](https://cve.now/CVE-2021-25331.md): Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscre (CVSS 3.2, Samsung Mobile Samsung Pay Mini)
- [CVE-2021-26989](https://cve.now/CVE-2021-26989.md): Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote a (no CVSS, Clustered Data ONTAP)
- [CVE-2021-26988](https://cve.now/CVE-2021-26988.md): Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthoriz (no CVSS, Clustered Data ONTAP)
- [CVE-2021-26293](https://cve.now/CVE-2021-26293.md): An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. (no CVSS)
- [CVE-2021-24031](https://cve.now/CVE-2021-24031.md): In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. (no CVSS, Facebook Zstandard)
- [CVE-2021-24032](https://cve.now/CVE-2021-24032.md): Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output file (no CVSS, Facebook Zstandard)
- [CVE-2020-8298](https://cve.now/CVE-2020-8298.md): fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the \`copy\`, \`copySync\`, \`remove\`, an (no CVSS, fs-path)
- [CVE-2021-20351](https://cve.now/CVE-2021-20351.md): IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert · IBM Engineering Workflow Man… +4)
- [CVE-2021-20350](https://cve.now/CVE-2021-20350.md): IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Team Concert +4)
- [CVE-2021-20340](https://cve.now/CVE-2021-20340.md): IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational DOORS Next Generation · IBM Engineering Lif… +4)
- [CVE-2020-4975](https://cve.now/CVE-2020-4975.md): IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert · IBM Engineering Workflow Man… +4)
- [CVE-2020-4866](https://cve.now/CVE-2020-4866.md): IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Rational Team… +4)
- [CVE-2020-4863](https://cve.now/CVE-2020-4863.md): IBM Engineering products are vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Rational Quality Manager · IBM Engineering Workflow… +4)
- [CVE-2020-4857](https://cve.now/CVE-2020-4857.md): IBM Engineering products are vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Rational Quality Manager · IBM Rational Team Concert +4)
- [CVE-2020-4856](https://cve.now/CVE-2020-4856.md): IBM Engineering products are vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Rational Team Concert · IBM Engineering Workflow Man… +4)
- [CVE-2021-27217](https://cve.now/CVE-2021-27217.md): An issue was discovered in the \_send\_secure\_msg() function of Yubico yubihsm-shell through 2.0.3. (no CVSS)
- [CVE-2021-26029](https://cve.now/CVE-2021-26029.md): \[20210309\] - Core - Inadequate filtering of form contents could allow to overwrite the author field (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26028](https://cve.now/CVE-2021-26028.md): \[20210308\] - Core - Path Traversal within joomla/archive zip class (no CVSS, Joomla! Project Joomla! CMS · joomla/archive)
- [CVE-2021-26027](https://cve.now/CVE-2021-26027.md): \[20210307\] - Core - ACL violation within com\_content frontend editing (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23132](https://cve.now/CVE-2021-23132.md): \[20210306\] - Core - com\_media allowed paths that are not intended for image uploads (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23131](https://cve.now/CVE-2021-23131.md): \[20210305\] - Core - Input validation within the template manager (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23130](https://cve.now/CVE-2021-23130.md): \[20210304\] - Core - XSS within the feed parser library (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23129](https://cve.now/CVE-2021-23129.md): \[20210303\] - Core - XSS within alert messages showed to users (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23128](https://cve.now/CVE-2021-23128.md): \[20210302\] - Core - Potential Insecure FOFEncryptRandval (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23127](https://cve.now/CVE-2021-23127.md): \[20210301\] - Core - Insecure randomness within 2FA secret generation (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23126](https://cve.now/CVE-2021-23126.md): \[20210301\] - Core - Insecure randomness within 2FA secret generation (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2020-15938](https://cve.now/CVE-2020-15938.md): When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it i (CVSS 4.0, Fortinet FortiOS)
- [CVE-2021-22128](https://cve.now/CVE-2021-22128.md): An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote att (CVSS 7.1, Fortinet FortiProxy)
- [CVE-2021-23346](https://cve.now/CVE-2021-23346.md): Regular Expression Denial of Service (ReDoS) (CVSS 4.8, html-parse-stringify · html-parse-stringify2)
- [CVE-2021-23344](https://cve.now/CVE-2021-23344.md): Remote Code Execution (RCE) (CVSS 9.8, total.js)
- [CVE-2020-35329](https://cve.now/CVE-2020-35329.md): Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '. (no CVSS)
- [CVE-2020-35328](https://cve.now/CVE-2020-35328.md): Courier Management System 1.0 - 'First Name' Stored XSS (no CVSS)
- [CVE-2020-35327](https://cve.now/CVE-2020-35327.md): SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref\_no (POST) parameter to admin (no CVSS)
- [CVE-2021-22183](https://cve.now/CVE-2021-22183.md): An issue has been discovered in GitLab affecting all versions starting with 11.8. (CVSS 4.1, GitLab)
- [CVE-2021-22189](https://cve.now/CVE-2021-22189.md): Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the (CVSS 5.9, GitLab)
- [CVE-2020-24914](https://cve.now/CVE-2020-24914.md): A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "str (no CVSS, qcubed/qcubed)
- [CVE-2020-24913](https://cve.now/CVE-2020-24913.md): A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated a (no CVSS, qcubed/qcubed)
- [CVE-2020-24912](https://cve.now/CVE-2020-24912.md): A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allow (no CVSS, qcubed/qcubed)
- [CVE-2020-24036](https://cve.now/CVE-2020-24036.md): PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malic (no CVSS)
- [CVE-2019-18629](https://cve.now/CVE-2019-18629.md): Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x. (no CVSS)
- [CVE-2019-18628](https://cve.now/CVE-2019-18628.md): Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x. (no CVSS)
- [CVE-2020-28601](https://cve.now/CVE-2020-28601.md): A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL)
- [CVE-2020-28636](https://cve.now/CVE-2020-28636.md): A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL)
- [CVE-2020-35628](https://cve.now/CVE-2020-35628.md): A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL)
- [CVE-2020-35636](https://cve.now/CVE-2020-35636.md): A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef\_S2/SNC\_io\_parser.h SNC\_io\_p (CVSS 10.0, CGAL Project)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.