CVEs published March 5, 2021
61 CVEs were published on March 5, 2021: 1 critical, 6 high.
- Published
- 61
- Critical
- 1
- High
- 6
- Medium
- 4
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Aruba AirWave Management Platform
- 12
- NETGEAR R7800
- 4
- Secomea GateManager
- 4
- Six Apart Movable Type
- 3
- stack_dst
- 2
- toodee
- 2
- activerecord-session_store
- 1
- ansi_up
- 1
- Apache Software Foundation Apache Superset · apache-superset
- 1
- bam
- 1
Critical 1
High 6
- CVE-2021-27256This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1NETGEAR R7800
- CVE-2020-29030Insufficient CSRF guardsSecomea GateManager
- CVE-2020-29029XSS issue due to insufficient sanitization of input fieldSecomea GateManager
- CVE-2020-28502Arbitrary Code Injectionxmlhttprequest · xmlhttprequest-ssl
- CVE-2020-29032Add integrity check of GateManager firmwareSecomea GateManager
- CVE-2021-25313Rancher: XSS on /v3/cluster/SUSE Rancher · github.com/rancher/rancher
Medium, low and unrated 54
- CVE-2021-27581The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
- CVE-2021-28042Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Conne
- CVE-2021-27257This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGNETGEAR R7800
- CVE-2021-27255This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76.NETGEAR R7800
- CVE-2021-27254This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800.NETGEAR R7800
- CVE-2021-3420A flaw was found in newlib in versions prior to 4.0.0.newlib
- CVE-2020-29028Reflected XSS issuesSecomea GateManager
- CVE-2021-28041ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket ac
- CVE-2021-3377The npm package ansi_up converts ANSI escape codes into HTML.ansi_up
- CVE-2021-26705An issue was discovered in SquareBox CatDV Server through 9.2.
- CVE-2021-28040An issue was discovered in OSSEC 3.6.0.
- CVE-2021-27099In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided throug
- CVE-2021-27098In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPgithub.com/spiffe/spire
- CVE-2021-21725A ZTE product has an information leak vulnerability.ZXHN H196Q
- CVE-2021-26971A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.Aruba AirWave Management Platform
- CVE-2021-26969A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s):Aruba AirWave Management Platform
- CVE-2021-26970A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.Aruba AirWave Management Platform
- CVE-2020-28050Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the s
- CVE-2021-26968A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): PriorAruba AirWave Management Platform
- CVE-2021-26967A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.Aruba AirWave Management Platform
- CVE-2021-26965A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.Aruba AirWave Management Platform
- CVE-2020-35594Zoho ManageEngine ADManager Plus before 7066 allows XSS.
- CVE-2021-26966A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.Aruba AirWave Management Platform
- CVE-2021-26963A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.Aruba AirWave Management Platform
- CVE-2021-26964A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.Aruba AirWave Management Platform
- CVE-2021-26960A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): PriAruba AirWave Management Platform
- CVE-2021-26962A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.Aruba AirWave Management Platform
- CVE-2021-26961A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): PriAruba AirWave Management Platform
- CVE-2020-29134The TOTVS Fluig platform allows path traversal through the parameter "file = ..
- CVE-2021-28026jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation.
- CVE-2021-27907Apache Superset stored XSS on Dashboard markdownApache Software Foundation Apache Superset · apache-superset
- CVE-2021-20665Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), MoSix Apart Movable Type
- CVE-2021-20663Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), MovableSix Apart Movable Type
- CVE-2021-20664Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable TypSix Apart Movable Type
- CVE-2020-29658Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalatio
- CVE-2021-28027An issue was discovered in the bam crate before 0.1.3 for Rust.bam
- CVE-2021-28028An issue was discovered in the toodee crate before 0.3.0 for Rust.toodee
- CVE-2021-28030An issue was discovered in the truetype crate before 0.30.1 for Rust.truetype
- CVE-2021-28031An issue was discovered in the scratchpad crate before 1.3.1 for Rust.scratchpad
- CVE-2021-28032An issue was discovered in the nano_arena crate before 0.5.2 for Rust.nano_arena
- CVE-2021-28034An issue was discovered in the stack_dst crate before 0.6.1 for Rust.stack_dst
- CVE-2021-28035An issue was discovered in the stack_dst crate before 0.6.1 for Rust.stack_dst
- CVE-2021-28036An issue was discovered in the quinn crate before 0.7.0 for Rust.quinn
- CVE-2021-28037An issue was discovered in the internment crate before 0.4.2 for Rust.internment
- CVE-2021-28033An issue was discovered in the byte_struct crate before 0.6.1 for Rust.byte_struct
- CVE-2021-28029An issue was discovered in the toodee crate before 0.3.0 for Rust.toodee
- CVE-2019-25025The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time appractiverecord-session_store
- CVE-2020-5148SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potenSonicWall Directory Services Connector
- CVE-2020-36255An issue was discovered in IdentityModel (aka ScottBrady.IdentityModel) before 1.3.0.
- CVE-2021-27965The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a c
- CVE-2021-27963SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin).
- CVE-2021-27964SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload.
- CVE-2021-28038An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV.
- CVE-2021-28039An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen.