# CVEs published 2021-03-08

25 CVEs were published on March 8, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2021-21510](https://cve.now/CVE-2021-21510.md): Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. (CVSS 6.1, Integrated Dell Remote Access Controller)
- [CVE-2021-21506](https://cve.now/CVE-2021-21506.md): PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. (CVSS 8.8, Dell PowerScale OneFS)
- [CVE-2021-21503](https://cve.now/CVE-2021-21503.md): PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2020-27838](https://cve.now/CVE-2020-27838.md): A flaw was found in keycloak in versions prior to 13.0.0. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2020-27576](https://cve.now/CVE-2020-27576.md): Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2021-21337](https://cve.now/CVE-2021-21337.md): URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService (CVSS 5.7, zopefoundation Products.PluggableAuthService · products-plu…)
- [CVE-2020-27575](https://cve.now/CVE-2020-27575.md): Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. (no CVSS)
- [CVE-2020-27574](https://cve.now/CVE-2020-27574.md): Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). (no CVSS)
- [CVE-2021-22134](https://cve.now/CVE-2021-22134.md): A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2021-21336](https://cve.now/CVE-2021-21336.md): Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager (CVSS 6.5, zopefoundation Products.PluggableAuthService · products-plu…)
- [CVE-2021-21335](https://cve.now/CVE-2021-21335.md): Basic Authentication can be bypassed using a malformed username (CVSS 5.3, stnoonan spnego-http-auth-nginx-module)
- [CVE-2021-21354](https://cve.now/CVE-2021-21354.md): Open redirect in pollbot (CVSS 7.4, mozilla PollBot)
- [CVE-2021-21362](https://cve.now/CVE-2021-21362.md): Bypassing readOnly policy by creating a temporary 'mc share upload' URL (CVSS 7.7, minio)
- [CVE-2020-5014](https://cve.now/CVE-2020-5014.md): IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system usin (CVSS 6.7, IBM DataPower Gateway)
- [CVE-2020-4903](https://cve.now/CVE-2020-4903.md): IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user (CVSS 4.8, IBM API Connect)
- [CVE-2020-4695](https://cve.now/CVE-2020-4695.md): IBM API Connect V10 is impacted by insecure communications during database replication. (CVSS 5.9, IBM API Connect)
- [CVE-2021-21329](https://cve.now/CVE-2021-21329.md): Multi Factor Authentication Token Improperly Validated On User Login (CVSS 8.7, ractf core)
- [CVE-2021-21324](https://cve.now/CVE-2021-21324.md): Insecure Direct Object Reference (IDOR) on "Solutions" (CVSS 6.8, glpi-project glpi)
- [CVE-2021-21325](https://cve.now/CVE-2021-21325.md): Stored XSS in budget type (CVSS 6.2, glpi-project glpi)
- [CVE-2021-21326](https://cve.now/CVE-2021-21326.md): Horizontal Privilege Escalation (CVSS 7.7, glpi-project glpi)
- [CVE-2021-21327](https://cve.now/CVE-2021-21327.md): Unsafe Reflection in getItemForItemtype() (CVSS 6.8, glpi-project glpi)
- [CVE-2020-23967](https://cve.now/CVE-2020-23967.md): Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\\SYST (no CVSS)
- [CVE-2021-27222](https://cve.now/CVE-2021-27222.md): In the "Time in Status" app before 4.13.0 for Jira, remote authenticated attackers can cause Stored XSS. (no CVSS)
- [CVE-2021-26788](https://cve.now/CVE-2021-26788.md): Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is affected by incorrect input validation, which may cause a denial of service (DoS (no CVSS)
- [CVE-2021-23351](https://cve.now/CVE-2021-23351.md): Denial of Service (DoS) (CVSS 4.4, github.com/pires/go-proxyproto)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.