# CVEs published 2021-03-09

90 CVEs were published on March 9, 2021: 3 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-28119](https://cve.now/CVE-2021-28119.md): Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. (no CVSS)
- [CVE-2021-28116](https://cve.now/CVE-2021-28116.md): Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP pro (CVSS 3.7)
- [CVE-2021-28115](https://cve.now/CVE-2021-28115.md): The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation. (no CVSS)
- [CVE-2021-23273](https://cve.now/CVE-2021-23273.md): TIBCO Spotfire Cross Site Scripting Vulnerability (CVSS 8.0, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2020-28952](https://cve.now/CVE-2020-28952.md): An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. (no CVSS)
- [CVE-2020-35524](https://cve.now/CVE-2020-35524.md): A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. (no CVSS, libtiff)
- [CVE-2020-35523](https://cve.now/CVE-2020-35523.md): An integer overflow flaw was found in libtiff that exists in the tif\_getimage.c file. (no CVSS, libtiff)
- [CVE-2020-35522](https://cve.now/CVE-2020-35522.md): In LibTIFF, there is a memory malloc failure in tif\_pixarlog.c. (no CVSS, libtiff)
- [CVE-2020-35521](https://cve.now/CVE-2020-35521.md): A flaw was found in libtiff. (no CVSS, libtiff)
- [CVE-2021-20255](https://cve.now/CVE-2021-20255.md): A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. (no CVSS, QEMU)
- [CVE-2021-3411](https://cve.now/CVE-2021-3411.md): A flaw was found in the Linux kernel in versions prior to 5.10. (no CVSS, Linux kernel)
- [CVE-2021-21295](https://cve.now/CVE-2021-21295.md): Possible request smuggling in HTTP/2 due missing validation (CVSS 5.9, io.netty:netty-codec-http2 · zookeeper +2)
- [CVE-2021-23352](https://cve.now/CVE-2021-23352.md): Command Injection (CVSS 8.6, madge)
- [CVE-2021-23353](https://cve.now/CVE-2021-23353.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.9, jspdf)
- [CVE-2020-27225](https://cve.now/CVE-2020-27225.md): In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web se (no CVSS, The Eclipse Foundation Eclipse Platform)
- [CVE-2021-21369](https://cve.now/CVE-2021-21369.md): Potential DoS in Besu HTTP JSON-RPC API (CVSS 6.5, hyperledger besu)
- [CVE-2020-28150](https://cve.now/CVE-2020-28150.md): I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses t (no CVSS)
- [CVE-2021-21190](https://cve.now/CVE-2021-21190.md): Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2021-21188](https://cve.now/CVE-2021-21188.md): Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2021-21189](https://cve.now/CVE-2021-21189.md): Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictio (no CVSS, Google Chrome)
- [CVE-2021-21187](https://cve.now/CVE-2021-21187.md): Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing v (no CVSS, Google Chrome)
- [CVE-2021-21185](https://cve.now/CVE-2021-21185.md): Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a m (no CVSS, Google Chrome)
- [CVE-2021-21186](https://cve.now/CVE-2021-21186.md): Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to s (no CVSS, Google Chrome)
- [CVE-2021-21184](https://cve.now/CVE-2021-21184.md): Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data (no CVSS, Google Chrome)
- [CVE-2021-21183](https://cve.now/CVE-2021-21183.md): Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data (no CVSS, Google Chrome)
- [CVE-2021-21181](https://cve.now/CVE-2021-21181.md): Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitiv (no CVSS, Google Chrome)
- [CVE-2021-21182](https://cve.now/CVE-2021-21182.md): Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the rend (no CVSS, Google Chrome)
- [CVE-2021-21180](https://cve.now/CVE-2021-21180.md): Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2021-21178](https://cve.now/CVE-2021-21178.md): Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof t (no CVSS, Google Chrome)
- [CVE-2021-21179](https://cve.now/CVE-2021-21179.md): Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap co (no CVSS, Google Chrome)
- [CVE-2021-21177](https://cve.now/CVE-2021-21177.md): Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive (no CVSS, Google Chrome)
- [CVE-2021-21175](https://cve.now/CVE-2021-21175.md): Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data vi (no CVSS, Google Chrome)
- [CVE-2021-21176](https://cve.now/CVE-2021-21176.md): Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of t (no CVSS, Google Chrome)
- [CVE-2021-21174](https://cve.now/CVE-2021-21174.md): Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions (no CVSS, Google Chrome)
- [CVE-2021-21172](https://cve.now/CVE-2021-21172.md): Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass fil (no CVSS, Google Chrome)
- [CVE-2021-21173](https://cve.now/CVE-2021-21173.md): Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin (no CVSS, Google Chrome)
- [CVE-2021-21171](https://cve.now/CVE-2021-21171.md): Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the co (no CVSS, Google Chrome)
- [CVE-2021-21170](https://cve.now/CVE-2021-21170.md): Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to (no CVSS, Google Chrome)
- [CVE-2021-21168](https://cve.now/CVE-2021-21168.md): Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive (no CVSS, Google Chrome)
- [CVE-2021-21169](https://cve.now/CVE-2021-21169.md): Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memo (no CVSS, Google Chrome)
- [CVE-2021-21167](https://cve.now/CVE-2021-21167.md): Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-21165](https://cve.now/CVE-2021-21165.md): Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM (no CVSS, Google Chrome)
- [CVE-2021-21166](https://cve.now/CVE-2021-21166.md): Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-21164](https://cve.now/CVE-2021-21164.md): Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin d (no CVSS, Google Chrome)
- [CVE-2021-21163](https://cve.now/CVE-2021-21163.md): Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin dat (no CVSS, Google Chrome)
- [CVE-2021-21161](https://cve.now/CVE-2021-21161.md): Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-21162](https://cve.now/CVE-2021-21162.md): Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-21160](https://cve.now/CVE-2021-21160.md): Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-21159](https://cve.now/CVE-2021-21159.md): Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-20262](https://cve.now/CVE-2021-20262.md): A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-20263](https://cve.now/CVE-2021-20263.md): A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. (no CVSS, QEMU)
- [CVE-2021-20268](https://cve.now/CVE-2021-20268.md): An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF scr (no CVSS, kernel)
- [CVE-2021-20253](https://cve.now/CVE-2021-20253.md): A flaw was found in ansible-tower. (no CVSS, ansible-tower)
- [CVE-2021-3417](https://cve.now/CVE-2021-3417.md): An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if (CVSS 4.9, Lenovo XClarity Orchestrator)
- [CVE-2020-8357](https://cve.now/CVE-2020-8357.md): A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to b (CVSS 5.5, Lenovo PCManager)
- [CVE-2020-8356](https://cve.now/CVE-2020-8356.md): An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMT (CVSS 4.9, Lenovo XClarity Orchestrator)
- [CVE-2020-35451](https://cve.now/CVE-2020-35451.md): Oozie local privilege escalation (no CVSS, Apache Software Foundation Apache Oozie)
- [CVE-2021-20341](https://cve.now/CVE-2021-20341.md): IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further atta (CVSS 5.3, IBM Cloud Pak for Multicloud Management Monitoring)
- [CVE-2021-25915](https://cve.now/CVE-2021-25915.md): Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead t (CVSS 9.8, changeset)
- [CVE-2021-27592](https://cve.now/CVE-2021-27592.md): When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27590](https://cve.now/CVE-2021-27590.md): When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27584](https://cve.now/CVE-2021-27584.md): When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer vers (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27588](https://cve.now/CVE-2021-27588.md): When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applicatio (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27586](https://cve.now/CVE-2021-27586.md): When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27587](https://cve.now/CVE-2021-27587.md): When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer ver (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27591](https://cve.now/CVE-2021-27591.md): When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewe (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27589](https://cve.now/CVE-2021-27589.md): When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise Viewe (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27585](https://cve.now/CVE-2021-27585.md): When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D Visual Enterprise Vie (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21484](https://cve.now/CVE-2021-21484.md): LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthent (CVSS 7.7, SAP SE SAP HANA)
- [CVE-2021-21487](https://cve.now/CVE-2021-21487.md): SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privil (CVSS 6.8, SAP SE SAP Payment Engine)
- [CVE-2021-21480](https://cve.now/CVE-2021-21480.md): SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). (CVSS 9.9, SAP SE SAP Manufacturing Integration and Intelligence)
- [CVE-2021-21493](https://cve.now/CVE-2021-21493.md): When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Vi (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21486](https://cve.now/CVE-2021-21486.md): SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary (CVSS 6.8, SAP SE SAP Enterprise Financial Services)
- [CVE-2021-21488](https://cve.now/CVE-2021-21488.md): Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controll (CVSS 6.5, SAP SE SAP NetWeaver Knowledge Management)
- [CVE-2021-21481](https://cve.now/CVE-2021-21481.md): The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization ch (CVSS 9.6, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2021-20276](https://cve.now/CVE-2021-20276.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20275](https://cve.now/CVE-2021-20275.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20274](https://cve.now/CVE-2021-20274.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20273](https://cve.now/CVE-2021-20273.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-20272](https://cve.now/CVE-2021-20272.md): A flaw was found in privoxy before 3.0.32. (no CVSS, privoxy)
- [CVE-2021-28006](https://cve.now/CVE-2021-28006.md): Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter. (no CVSS)
- [CVE-2021-21361](https://cve.now/CVE-2021-21361.md): Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin (CVSS 5.3, JLLeitschuh security-research · com.bmuschko:gradle-vagrant…)
- [CVE-2021-21360](https://cve.now/CVE-2021-21360.md): Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup (CVSS 5.3, zopefoundation Products.GenericSetup · products-genericsetup)
- [CVE-2021-24033](https://cve.now/CVE-2021-24033.md): react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be (no CVSS, Facebook react-dev-utils · react-dev-utils)
- [CVE-2021-20241](https://cve.now/CVE-2021-20241.md): A flaw was found in ImageMagick in coders/jp2.c. (no CVSS, ImageMagick)
- [CVE-2021-20243](https://cve.now/CVE-2021-20243.md): A flaw was found in ImageMagick in MagickCore/resize.c. (no CVSS, ImageMagick)
- [CVE-2021-20244](https://cve.now/CVE-2021-20244.md): A flaw was found in ImageMagick in MagickCore/visual-effects.c. (no CVSS, ImageMagick)
- [CVE-2021-20245](https://cve.now/CVE-2021-20245.md): A flaw was found in ImageMagick in coders/webp.c. (no CVSS, ImageMagick)
- [CVE-2021-20246](https://cve.now/CVE-2021-20246.md): A flaw was found in ImageMagick in MagickCore/resample.c. (no CVSS, ImageMagick)
- [CVE-2021-21300](https://cve.now/CVE-2021-21300.md): malicious repositories can execute remote code while cloning (CVSS 8.0, git)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.