CVEs published March 8, 2021
25 CVEs were published on March 8, 2021: 0 critical, 6 high.
- Published
- 25
- Critical
- 0
- High
- 6
- Medium
- 11
- Low
- 0
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- glpi-project glpi
- 4
- Dell PowerScale OneFS
- 2
- IBM API Connect
- 2
- zopefoundation Products.PluggableAuthService · products-plu…
- 2
- Elasticsearch · org.elasticsearch:elasticsearch
- 1
- github.com/pires/go-proxyproto
- 1
- IBM DataPower Gateway
- 1
- Integrated Dell Remote Access Controller
- 1
- keycloak · org.keycloak:keycloak-core
- 1
- minio
- 1
High 6
- CVE-2021-21506PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler.Dell PowerScale OneFS
- CVE-2021-21503PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command.Dell PowerScale OneFS
- CVE-2021-21354Open redirect in pollbotmozilla PollBot
- CVE-2021-21362Bypassing readOnly policy by creating a temporary 'mc share upload' URLminio
- CVE-2021-21329Multi Factor Authentication Token Improperly Validated On User Loginractf core
- CVE-2021-21326Horizontal Privilege Escalationglpi-project glpi
Medium, low and unrated 19
- CVE-2021-21510Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability.Integrated Dell Remote Access Controller
- CVE-2020-27838A flaw was found in keycloak in versions prior to 13.0.0.keycloak · org.keycloak:keycloak-core
- CVE-2020-27576Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS).
- CVE-2021-21337URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthServicezopefoundation Products.PluggableAuthService · products-plu…
- CVE-2020-27575Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability.
- CVE-2020-27574Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF).
- CVE-2021-22134A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2021-21336Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManagerzopefoundation Products.PluggableAuthService · products-plu…
- CVE-2021-21335Basic Authentication can be bypassed using a malformed usernamestnoonan spnego-http-auth-nginx-module
- CVE-2020-5014IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system usinIBM DataPower Gateway
- CVE-2020-4903IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user IBM API Connect
- CVE-2020-4695IBM API Connect V10 is impacted by insecure communications during database replication.IBM API Connect
- CVE-2021-21324Insecure Direct Object Reference (IDOR) on "Solutions"glpi-project glpi
- CVE-2021-21325Stored XSS in budget typeglpi-project glpi
- CVE-2021-21327Unsafe Reflection in getItemForItemtype()glpi-project glpi
- CVE-2020-23967Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\SYST
- CVE-2021-27222In the "Time in Status" app before 4.13.0 for Jira, remote authenticated attackers can cause Stored XSS.
- CVE-2021-26788Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is affected by incorrect input validation, which may cause a denial of service (DoS
- CVE-2021-23351Denial of Service (DoS)github.com/pires/go-proxyproto