CVEs published March 11, 2021
120 CVEs were published on March 11, 2021: 7 critical, 68 high. 3 are now in CISA KEV.
- Published
- 120
- Critical
- 7
- High
- 68
- Medium
- 14
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 3
- Fix available
- 87
Most affected products
- Microsoft Windows
- 40
- Microsoft HEVC Video Extensions
- 10
- Microsoft Windows Server 2008 R2 Service Pack · Microsof… +2
- 7
- Interactive Graphical SCADA System (IGSS) Definition (Def.e…
- 4
- Facebook HHVM
- 3
- IBM DB2 for Linux, UNIX and Windows
- 3
- Microsoft 365 Apps for Enterprise · Microsoft Excel 2010… +5
- 2
- Microsoft 365 Apps for Enterprise · Microsoft Office +3
- 2
- Microsoft Azure Sphere
- 2
- swagger-api swagger-codegen · io.swagger:swagger-codegen
- 2
Critical 7
- CVE-2021-27080Azure Sphere Unsigned Code Execution VulnerabilityMicrosoft Azure Sphere
- CVE-2021-26897Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +2
- CVE-2021-26895Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +2
- CVE-2021-26894Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +2
- CVE-2021-26893Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +2
- CVE-2021-26877Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +2
- CVE-2021-26867Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
High 68
- CVE-2021-22713A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION8650, ION8800, ION76PowerLogic ION8650, ION8800, ION7650, ION7700/73xx, and ION…
- CVE-2021-27077Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27076Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft Business Productivity Servers 2010 Service Pac… +2
- CVE-2021-27070Windows 10 Update Assistant Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27063Windows DNS Server Denial of Service VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +2
- CVE-2021-27062HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-27061HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-27060Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-27059Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office 2010 Service Pack · Microsoft Office 20… +1
- CVE-2021-27058Microsoft Office ClickToRun Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2021-27057Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel 2010… +5
- CVE-2021-27056Microsoft PowerPoint Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2021-27055Microsoft Visio Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2021-27081Visual Studio Code ESLint Extension Remote Code Execution VulnerabilityMicrosoft Visual Studio Code ESLint extension
- CVE-2021-27082Quantum Development Kit for Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Quantum Development Kit for Visual Studio Code
- CVE-2021-27083Remote Development Extension for Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code Remote - Containers Extension
- CVE-2021-27084Visual Studio Code Java Extension Pack Remote Code Execution VulnerabilityMicrosoft Visual Studio Code - Java Extension Pack
- CVE-2021-27085Internet Explorer Remote Code Execution VulnerabilityMicrosoft Internet Explorer
- CVE-2021-27054Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel 2010… +5
- CVE-2021-27053Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel 2010… +3
- CVE-2021-27051HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-27050HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-27049HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-27048HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-27047HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-26902HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-26901Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26900Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26899Windows UPnP Device Host Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26898Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26896Windows DNS Server Denial of Service VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +2
- CVE-2021-26891Windows Container Execution Agent Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26890Application Virtualization Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-26889Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26887Microsoft Windows Folder Redirection Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26885Windows WalletService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26882Remote Access API Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26881Microsoft Windows Media Foundation Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-26880Windows Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26879Windows Network Address Translation (NAT) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-26878Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26876OpenType Font Parsing Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-26875Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26874Windows Overlay Filter Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26873Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26871Windows WalletService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26872Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26870Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26868Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26866Windows Update Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26865Windows Container Execution Agent Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26864Windows Virtual Registry Provider Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26863Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26862Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26861Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-26860Windows App-V Overlay Filter Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26859Microsoft Power BI Information Disclosure VulnerabilityMicrosoft Power BI Report Server
- CVE-2020-5025IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, IBM DB2 for Linux, UNIX and Windows
- CVE-2020-5024IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker toIBM DB2 for Linux, UNIX and Windows
- CVE-2021-26411Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2021-24110HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-24108Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 201… +2
- CVE-2021-24095DirectX Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-24090Windows Error Reporting Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-24089HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-1729Windows Update Stack Setup Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-21378JWT authentication bypass with unknown issuer tokenenvoyproxy envoy
- CVE-2021-21381Sandbox escape via special tokens in .desktop fileflatpak
Medium, low and unrated 45
- CVE-2020-36278Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.
- CVE-2021-28143/jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).
- CVE-2020-24983An issue was discovered in Quadbase EspressReports ES 7 Update 9.
- CVE-2016-20009A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7.
- CVE-2021-28154Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access.
- CVE-2020-24984An issue was discovered in Quadbase EspressReports ES 7 Update 9.
- CVE-2021-28153An issue was discovered in GNOME GLib before 2.66.8.
- CVE-2021-22709A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA SystemInteractive Graphical SCADA System (IGSS) Definition (Def.e…
- CVE-2021-22710A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA SystemInteractive Graphical SCADA System (IGSS) Definition (Def.e…
- CVE-2021-22712A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA SystemInteractive Graphical SCADA System (IGSS) Definition (Def.e…
- CVE-2020-36277Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c.
- CVE-2021-22711A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA SystemInteractive Graphical SCADA System (IGSS) Definition (Def.e…
- CVE-2021-22714A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and IONPowerLogic ION7400, PM8000 and ION9000
- CVE-2021-20261A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software.kernel
- CVE-2020-29045The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize opera
- CVE-2020-14989An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2.
- CVE-2020-14988An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2.
- CVE-2020-14987An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2.
- CVE-2021-28141An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224.
- CVE-2021-28088Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web impresscms/impresscms
- CVE-2021-27679Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML v
- CVE-2021-27678Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via
- CVE-2021-27677Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML vi
- CVE-2021-26776CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.
- CVE-2021-28144prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root co
- CVE-2021-27075Azure Virtual Machine Information Disclosure VulnerabilityMicrosoft Azure Container Instance · Microsoft Azure Kub… +2
- CVE-2021-27074Azure Sphere Unsigned Code Execution VulnerabilityMicrosoft Azure Sphere
- CVE-2021-27066Windows Admin Center Security Feature Bypass VulnerabilityMicrosoft Windows Admin Center
- CVE-2021-27052Microsoft SharePoint Server Information Disclosure VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2021-26892Windows Extensible Firmware Interface Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-26886User Profile Service Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-26884Windows Media Photo Codec Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-26869Windows ActiveX Installer Service Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-20336IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting.IBM Tivoli Netcool/OMNIbus_GUI
- CVE-2020-4976IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and writeIBM DB2 for Linux, UNIX and Windows
- CVE-2021-24107Windows Event Tracing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-24104Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-28132LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support secti
- CVE-2021-21363Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directoryswagger-api swagger-codegen · io.swagger:swagger-codegen
- CVE-2021-21364Generated Code Contains Local Information Disclosure Vulnerabilityswagger-api swagger-codegen · io.swagger:swagger-codegen
- CVE-2020-1900When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting Facebook HHVM
- CVE-2020-1899The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization.Facebook HHVM
- CVE-2020-1898The fb_unserialize function did not impose a depth limit for nested deserialization.Facebook HHVM
- CVE-2021-28134Clipper before 1.0.5 allows remote command execution.
- CVE-2021-27919archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for astdlib