# CVEs published 2021-03-05

61 CVEs were published on March 5, 2021: 1 critical, 6 high. Days are UTC.

- [CVE-2021-27581](https://cve.now/CVE-2021-27581.md): The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter. (no CVSS)
- [CVE-2021-28042](https://cve.now/CVE-2021-28042.md): Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Conne (no CVSS)
- [CVE-2021-27257](https://cve.now/CVE-2021-27257.md): This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETG (CVSS 6.5, NETGEAR R7800)
- [CVE-2021-27256](https://cve.now/CVE-2021-27256.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1 (CVSS 8.8, NETGEAR R7800)
- [CVE-2021-27255](https://cve.now/CVE-2021-27255.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. (CVSS 6.3, NETGEAR R7800)
- [CVE-2021-27254](https://cve.now/CVE-2021-27254.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. (CVSS 6.3, NETGEAR R7800)
- [CVE-2021-3420](https://cve.now/CVE-2021-3420.md): A flaw was found in newlib in versions prior to 4.0.0. (no CVSS, newlib)
- [CVE-2020-29030](https://cve.now/CVE-2020-29030.md): Insufficient CSRF guards (CVSS 8.1, Secomea GateManager)
- [CVE-2020-29020](https://cve.now/CVE-2020-29020.md): Reject Remote Management via Cellular UPLINK2 (CVSS 9.1, Secomea SiteManager)
- [CVE-2020-29028](https://cve.now/CVE-2020-29028.md): Reflected XSS issues (CVSS 6.3, Secomea GateManager)
- [CVE-2020-29029](https://cve.now/CVE-2020-29029.md): XSS issue due to insufficient sanitization of input field (CVSS 7.3, Secomea GateManager)
- [CVE-2021-28041](https://cve.now/CVE-2021-28041.md): ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket ac (no CVSS)
- [CVE-2021-3377](https://cve.now/CVE-2021-3377.md): The npm package ansi\_up converts ANSI escape codes into HTML. (no CVSS, ansi\_up)
- [CVE-2021-26705](https://cve.now/CVE-2021-26705.md): An issue was discovered in SquareBox CatDV Server through 9.2. (no CVSS)
- [CVE-2021-28040](https://cve.now/CVE-2021-28040.md): An issue was discovered in OSSEC 3.6.0. (no CVSS)
- [CVE-2020-28502](https://cve.now/CVE-2020-28502.md): Arbitrary Code Injection (CVSS 8.1, xmlhttprequest · xmlhttprequest-ssl)
- [CVE-2021-27099](https://cve.now/CVE-2021-27099.md): In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws\_iid" Node Attestor improperly normalizes the path provided throug (no CVSS)
- [CVE-2021-27098](https://cve.now/CVE-2021-27098.md): In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SP (no CVSS, github.com/spiffe/spire)
- [CVE-2020-29032](https://cve.now/CVE-2020-29032.md): Add integrity check of GateManager firmware (CVSS 8.4, Secomea GateManager)
- [CVE-2021-21725](https://cve.now/CVE-2021-21725.md): A ZTE product has an information leak vulnerability. (no CVSS, ZXHN H196Q)
- [CVE-2021-26971](https://cve.now/CVE-2021-26971.md): A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26969](https://cve.now/CVE-2021-26969.md): A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26970](https://cve.now/CVE-2021-26970.md): A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2020-28050](https://cve.now/CVE-2020-28050.md): Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the s (no CVSS)
- [CVE-2021-26968](https://cve.now/CVE-2021-26968.md): A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26967](https://cve.now/CVE-2021-26967.md): A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26965](https://cve.now/CVE-2021-26965.md): A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2020-35594](https://cve.now/CVE-2020-35594.md): Zoho ManageEngine ADManager Plus before 7066 allows XSS. (no CVSS)
- [CVE-2021-26966](https://cve.now/CVE-2021-26966.md): A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26963](https://cve.now/CVE-2021-26963.md): A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26964](https://cve.now/CVE-2021-26964.md): A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26960](https://cve.now/CVE-2021-26960.md): A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Pri (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26962](https://cve.now/CVE-2021-26962.md): A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-26961](https://cve.now/CVE-2021-26961.md): A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Pri (no CVSS, Aruba AirWave Management Platform)
- [CVE-2020-29134](https://cve.now/CVE-2020-29134.md): The TOTVS Fluig platform allows path traversal through the parameter "file = .. (no CVSS)
- [CVE-2021-28026](https://cve.now/CVE-2021-28026.md): jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff\_order.cc ReadPermutation. (no CVSS)
- [CVE-2021-27907](https://cve.now/CVE-2021-27907.md): Apache Superset stored XSS on Dashboard markdown (no CVSS, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2021-20665](https://cve.now/CVE-2021-20665.md): Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Mo (no CVSS, Six Apart Movable Type)
- [CVE-2021-20663](https://cve.now/CVE-2021-20663.md): Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable (no CVSS, Six Apart Movable Type)
- [CVE-2021-20664](https://cve.now/CVE-2021-20664.md): Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Typ (no CVSS, Six Apart Movable Type)
- [CVE-2020-29658](https://cve.now/CVE-2020-29658.md): Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalatio (no CVSS)
- [CVE-2021-28027](https://cve.now/CVE-2021-28027.md): An issue was discovered in the bam crate before 0.1.3 for Rust. (no CVSS, bam)
- [CVE-2021-28028](https://cve.now/CVE-2021-28028.md): An issue was discovered in the toodee crate before 0.3.0 for Rust. (no CVSS, toodee)
- [CVE-2021-28030](https://cve.now/CVE-2021-28030.md): An issue was discovered in the truetype crate before 0.30.1 for Rust. (no CVSS, truetype)
- [CVE-2021-28031](https://cve.now/CVE-2021-28031.md): An issue was discovered in the scratchpad crate before 1.3.1 for Rust. (no CVSS, scratchpad)
- [CVE-2021-28032](https://cve.now/CVE-2021-28032.md): An issue was discovered in the nano\_arena crate before 0.5.2 for Rust. (no CVSS, nano\_arena)
- [CVE-2021-28034](https://cve.now/CVE-2021-28034.md): An issue was discovered in the stack\_dst crate before 0.6.1 for Rust. (no CVSS, stack\_dst)
- [CVE-2021-28035](https://cve.now/CVE-2021-28035.md): An issue was discovered in the stack\_dst crate before 0.6.1 for Rust. (no CVSS, stack\_dst)
- [CVE-2021-28036](https://cve.now/CVE-2021-28036.md): An issue was discovered in the quinn crate before 0.7.0 for Rust. (no CVSS, quinn)
- [CVE-2021-28037](https://cve.now/CVE-2021-28037.md): An issue was discovered in the internment crate before 0.4.2 for Rust. (no CVSS, internment)
- [CVE-2021-28033](https://cve.now/CVE-2021-28033.md): An issue was discovered in the byte\_struct crate before 0.6.1 for Rust. (no CVSS, byte\_struct)
- [CVE-2021-28029](https://cve.now/CVE-2021-28029.md): An issue was discovered in the toodee crate before 0.3.0 for Rust. (no CVSS, toodee)
- [CVE-2021-25313](https://cve.now/CVE-2021-25313.md): Rancher: XSS on /v3/cluster/ (CVSS 7.1, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2019-25025](https://cve.now/CVE-2019-25025.md): The activerecord-session\_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time appr (no CVSS, activerecord-session\_store)
- [CVE-2020-5148](https://cve.now/CVE-2020-5148.md): SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a poten (no CVSS, SonicWall Directory Services Connector)
- [CVE-2020-36255](https://cve.now/CVE-2020-36255.md): An issue was discovered in IdentityModel (aka ScottBrady.IdentityModel) before 1.3.0. (no CVSS)
- [CVE-2021-27965](https://cve.now/CVE-2021-27965.md): The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a c (no CVSS)
- [CVE-2021-27963](https://cve.now/CVE-2021-27963.md): SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). (no CVSS)
- [CVE-2021-27964](https://cve.now/CVE-2021-27964.md): SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. (no CVSS)
- [CVE-2021-28038](https://cve.now/CVE-2021-28038.md): An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. (no CVSS)
- [CVE-2021-28039](https://cve.now/CVE-2021-28039.md): An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.