CVEs published March 10, 2021
102 CVEs were published on March 10, 2021: 0 critical, 2 high.
- Published
- 102
- Critical
- 0
- High
- 2
- Medium
- 9
- Low
- 0
- Unrated
- 91
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Android
- 48
- WESEEK GROWI
- 7
- Facebook HHVM
- 6
- pjsip pjproject
- 2
- 3MF
- 1
- Apache Software Foundation Apache Velocity Engine · org.… +1
- 1
- Apache Software Foundation Apache Velocity Tools · org.a… +1
- 1
- containerd · github.com/containerd/containerd
- 1
- Facebook Gameroom
- 1
- IBM SPSS Modeler
- 1
High 2
Medium, low and unrated 100
- CVE-2021-27918encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOFstdlib
- CVE-2021-21375Crash in receiving updated SDP answer after initial SDP negotiation failedpjsip pjproject
- CVE-2020-15260Existing TLS connections can be reused without checking remote hostnamepjsip pjproject
- CVE-2021-21371Execution of untrusted code through config filetenable integration-jira-cloud · tenable-jira-cloud
- CVE-2021-21334environment variable leakcontainerd · github.com/containerd/containerd
- CVE-2021-21265October CMS vulnerable to Potential Host Header Poisoning on misconfigured serversoctobercms october · october/backend
- CVE-2020-35233The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to force
- CVE-2020-35231The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attac
- CVE-2020-35230Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices.
- CVE-2020-35229The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated
- CVE-2021-3034Cortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logsPalo Alto Networks Cortex XSOAR
- CVE-2020-35228A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote atta
- CVE-2020-35227A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web pane
- CVE-2020-35226NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the corresponding
- CVE-2020-35225The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was not properly validating the length of string parameters
- CVE-2020-35224A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote unau
- CVE-2020-35223The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed b
- CVE-2020-35221The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was found to be insecure,
- CVE-2020-19419Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from t
- CVE-2020-19417Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative tasks
- CVE-2021-20205Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a craLibjpeg-turbo
- CVE-2021-0465In GenerateFaceMask of face.cc, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-0464In sound_trigger_event_alloc of platform.h, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0463In convertToHidl of convert.cpp, there is a possible out of bounds read due to uninitialized data from ReturnFrameworkMessage.Android
- CVE-2021-0462In the NXP NFC firmware, there is a possible insecure firmware update due to a logic error.Android
- CVE-2021-0461In iaxxx_core_sensor_change_state of iaxxx-module.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0460In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2021-0459In fts_driver_test_write of fts_proc.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0458In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2021-0457In the FingerTipS touch screen driver, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0456In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0455In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0454In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0453In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0452In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0451In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0450In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0449In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data.Android
- CVE-2021-0389In setNightModeActivated of UiModeManagerService.java, there is a missing permission check.Android
- CVE-2021-0388In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler.Android
- CVE-2021-0387In FindQuotaDeviceForUuid of QuotaUtils.cpp, there is a possible use-after-free due to a race condition.Android
- CVE-2021-0386In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value.Android
- CVE-2021-0385In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFiAndroid
- CVE-2021-0383In done of CaptivePortalLoginActivity.java, there is a confused deputy.Android
- CVE-2021-0382In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check.Android
- CVE-2021-0381In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0380In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing pAndroid
- CVE-2021-0379In getUpTo17bits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0378In getNbits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0377In DeltaPerformer::Write of delta_performer.cc, there is a possible use of untrusted input due to improper input validation.Android
- CVE-2021-0376In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypAndroid
- CVE-2021-0375In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default vAndroid
- CVE-2021-0374In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0372In getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0371In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0370In Write of NxpMfcReader.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0369In CrossProfileAppsServiceImpl.java, there is the possibility of an application's INTERACT_ACROSS_PROFILES grant state not displaying properAndroid
- CVE-2021-0368In oggpack_look of bitwise.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0025In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass.Android
- CVE-2021-24030The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable.Facebook Gameroom
- CVE-2020-1921In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within tFacebook HHVM
- CVE-2021-24025Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integerFacebook HHVM
- CVE-2020-1919Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer thanFacebook HHVM
- CVE-2020-1917xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not usingFacebook HHVM
- CVE-2020-1918In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory priFacebook HHVM
- CVE-2020-1916An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bouFacebook HHVM
- CVE-2021-0399In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free.Android
- CVE-2021-0392In main of main.cpp, there is a possible memory corruption due to a double free.Android
- CVE-2021-0390In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permissionAndroid
- CVE-2021-0397In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free.Android
- CVE-2021-0398In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy.Android
- CVE-2021-0391In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due tAndroid
- CVE-2021-0394In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0395In StopServicesAndLogViolations of reboot.cpp, there is possible memory corruption due to a use after free.Android
- CVE-2021-0393In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0396In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incAndroid
- CVE-2021-20265A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending.kernel
- CVE-2020-5016IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system.IBM WebSphere Application Server
- CVE-2020-4717A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write arbitraryIBM SPSS Modeler
- CVE-2021-28122A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1.
- CVE-2020-35752Baby Care System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the Edit Page tab through the Post title parameter.
- CVE-2021-21491SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow SAP SE SAP NetWeaver Application Server Java
- CVE-2021-3224A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.
- CVE-2020-28705FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
- CVE-2020-24791FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1.
- CVE-2020-23722An issue was discovered in FUEL CMS 1.4.7.
- CVE-2020-23721An issue was discovered in FUEL CMS V1.4.7.
- CVE-2021-28007Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.
- CVE-2021-20673Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated atWESEEK GROWI
- CVE-2021-20671Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite tWESEEK GROWI
- CVE-2021-20672Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from vWESEEK GROWI
- CVE-2021-20670Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's persoWESEEK GROWI
- CVE-2021-20669Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbiWESEEK GROWI
- CVE-2021-20667Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlierWESEEK GROWI
- CVE-2021-20668Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path viaWESEEK GROWI
- CVE-2020-13936Velocity Sandbox BypassApache Software Foundation Apache Velocity Engine · org.… +1
- CVE-2020-13959Velocity Tools XSS VulnerabilityApache Software Foundation Apache Velocity Tools · org.a… +1
- CVE-2021-3310Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares.
- CVE-2020-29238An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information whe
- CVE-2020-27632In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments.