CVEs published March 9, 2021
90 CVEs were published on March 9, 2021: 3 critical, 5 high. 1 is now in CISA KEV.
- Published
- 90
- Critical
- 3
- High
- 5
- Medium
- 22
- Low
- 1
- Unrated
- 59
- Now in CISA KEV
- 1
- Fix available
- 61
Most affected products
- Google Chrome
- 32
- SAP SE SAP 3D Visual Enterprise Viewer
- 10
- ImageMagick
- 5
- privoxy
- 5
- libtiff
- 4
- Lenovo XClarity Orchestrator
- 2
- QEMU
- 2
- ansible-tower
- 1
- Apache Software Foundation Apache Oozie
- 1
- changeset
- 1
Critical 3
- CVE-2021-25915Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead tchangeset
- CVE-2021-21480SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment).SAP SE SAP Manufacturing Integration and Intelligence
- CVE-2021-21481The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization chSAP SE SAP NetWeaver AS JAVA
High 5
- CVE-2021-23273TIBCO Spotfire Cross Site Scripting VulnerabilityTIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2
- CVE-2021-23352Command Injectionmadge
- CVE-2021-21166Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMGoogle Chrome
- CVE-2021-21484LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthentSAP SE SAP HANA
- CVE-2021-21300malicious repositories can execute remote code while cloninggit
Medium, low and unrated 82
- CVE-2021-28119Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution.
- CVE-2021-28116Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP pro
- CVE-2021-28115The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.
- CVE-2020-28952An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0.
- CVE-2020-35524A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool.libtiff
- CVE-2020-35523An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file.libtiff
- CVE-2020-35522In LibTIFF, there is a memory malloc failure in tif_pixarlog.c.libtiff
- CVE-2020-35521A flaw was found in libtiff.libtiff
- CVE-2021-20255A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU.QEMU
- CVE-2021-3411A flaw was found in the Linux kernel in versions prior to 5.10.Linux kernel
- CVE-2021-21295Possible request smuggling in HTTP/2 due missing validationio.netty:netty-codec-http2 · zookeeper +2
- CVE-2021-23353Regular Expression Denial of Service (ReDoS)jspdf
- CVE-2020-27225In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web seThe Eclipse Foundation Eclipse Platform
- CVE-2021-21369Potential DoS in Besu HTTP JSON-RPC APIhyperledger besu
- CVE-2020-28150I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses t
- CVE-2021-21190Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2021-21188Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2021-21189Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictioGoogle Chrome
- CVE-2021-21187Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing vGoogle Chrome
- CVE-2021-21185Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a mGoogle Chrome
- CVE-2021-21186Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to sGoogle Chrome
- CVE-2021-21184Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2021-21183Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2021-21181Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitivGoogle Chrome
- CVE-2021-21182Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2021-21180Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2021-21178Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof tGoogle Chrome
- CVE-2021-21179Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2021-21177Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitiveGoogle Chrome
- CVE-2021-21175Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data viGoogle Chrome
- CVE-2021-21176Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of tGoogle Chrome
- CVE-2021-21174Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions Google Chrome
- CVE-2021-21172Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass filGoogle Chrome
- CVE-2021-21173Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin Google Chrome
- CVE-2021-21171Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the coGoogle Chrome
- CVE-2021-21170Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2021-21168Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitiveGoogle Chrome
- CVE-2021-21169Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memoGoogle Chrome
- CVE-2021-21167Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-21165Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMGoogle Chrome
- CVE-2021-21164Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2021-21163Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin datGoogle Chrome
- CVE-2021-21161Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2021-21162Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-21160Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2021-21159Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2021-20262A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password.keycloak · org.keycloak:keycloak-core
- CVE-2021-20263A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU.QEMU
- CVE-2021-20268An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF scrkernel
- CVE-2021-20253A flaw was found in ansible-tower.ansible-tower
- CVE-2021-3417An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), ifLenovo XClarity Orchestrator
- CVE-2020-8357A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to bLenovo PCManager
- CVE-2020-8356An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTLenovo XClarity Orchestrator
- CVE-2020-35451Oozie local privilege escalationApache Software Foundation Apache Oozie
- CVE-2021-20341IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attaIBM Cloud Pak for Multicloud Management Monitoring
- CVE-2021-27592When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27590When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27584When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer versSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27588When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applicatioSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27586When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise ViewerSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27587When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer verSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27591When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise VieweSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27589When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise VieweSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27585When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D Visual Enterprise VieSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21487SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilSAP SE SAP Payment Engine
- CVE-2021-21493When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise ViSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21486SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessarySAP SE SAP Enterprise Financial Services
- CVE-2021-21488Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controllSAP SE SAP NetWeaver Knowledge Management
- CVE-2021-20276A flaw was found in privoxy before 3.0.32.privoxy
- CVE-2021-20275A flaw was found in privoxy before 3.0.32.privoxy
- CVE-2021-20274A flaw was found in privoxy before 3.0.32.privoxy
- CVE-2021-20273A flaw was found in privoxy before 3.0.32.privoxy
- CVE-2021-20272A flaw was found in privoxy before 3.0.32.privoxy
- CVE-2021-28006Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.
- CVE-2021-21361Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-pluginJLLeitschuh security-research · com.bmuschko:gradle-vagrant…
- CVE-2021-21360Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetupzopefoundation Products.GenericSetup · products-genericsetup
- CVE-2021-24033react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be Facebook react-dev-utils · react-dev-utils
- CVE-2021-20241A flaw was found in ImageMagick in coders/jp2.c.ImageMagick
- CVE-2021-20243A flaw was found in ImageMagick in MagickCore/resize.c.ImageMagick
- CVE-2021-20244A flaw was found in ImageMagick in MagickCore/visual-effects.c.ImageMagick
- CVE-2021-20245A flaw was found in ImageMagick in coders/webp.c.ImageMagick
- CVE-2021-20246A flaw was found in ImageMagick in MagickCore/resample.c.ImageMagick