# CVEs published 2021-03-12 43 CVEs were published on March 12, 2021: 4 critical, 14 high. Days are UTC. - [CVE-2021-27290](https://cve.now/CVE-2021-27290.md): ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. (no CVSS, ssri) - [CVE-2021-28162](https://cve.now/CVE-2021-28162.md): In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run. (no CVSS, The Eclipse Foundation Eclipse Theia · @theia/messages) - [CVE-2021-28161](https://cve.now/CVE-2021-28161.md): In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be inj (no CVSS, The Eclipse Foundation Eclipse Theia · @theia/console) - [CVE-2021-28092](https://cve.now/CVE-2021-28092.md): The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReD (no CVSS, is-svg) - [CVE-2021-21518](https://cve.now/CVE-2021-21518.md): Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versions 2.0.x, 2 (CVSS 7.8, Dell SupportAssist Client) - [CVE-2021-20232](https://cve.now/CVE-2021-20232.md): A flaw was found in gnutls. (CVSS 9.8, gnutls) - [CVE-2021-20231](https://cve.now/CVE-2021-20231.md): A flaw was found in gnutls. (no CVSS, gnutls) - [CVE-2021-21082](https://cve.now/CVE-2021-21082.md): Adobe Photoshop Memory Corruption (CVSS 7.8, Adobe Photoshop) - [CVE-2021-21078](https://cve.now/CVE-2021-21078.md): Adobe Creative Cloud Unquoted Service Path in CCXProcess (CVSS 6.5, Adobe Creative Cloud) - [CVE-2021-21074](https://cve.now/CVE-2021-21074.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21056](https://cve.now/CVE-2021-21056.md): Adobe FrameMaker Out-of-Bounds Read Vulnerability Could Lead To Remote Code Execution (CVSS 7.8, Adobe FrameMaker) - [CVE-2021-21085](https://cve.now/CVE-2021-21085.md): Adobe Connect CSV injection via export feature could lead to code execution (CVSS 7.8, Adobe Connect) - [CVE-2021-21071](https://cve.now/CVE-2021-21071.md): Adobe Animate memory corruption vulnerability (CVSS 7.8, Adobe Animate) - [CVE-2021-21067](https://cve.now/CVE-2021-21067.md): Adobe Photoshop CoolType arbitrary stack manipulation in Type 1/Multiple Master (CVSS 7.8, Adobe Photoshop) - [CVE-2021-21075](https://cve.now/CVE-2021-21075.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21080](https://cve.now/CVE-2021-21080.md): Adobe Connect Reflected Cross-site Scripting via query parameter (CVSS 6.1, Adobe Connect) - [CVE-2021-21076](https://cve.now/CVE-2021-21076.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21068](https://cve.now/CVE-2021-21068.md): Adobe Creative Cloud installer arbitrary file overwrite vulnerability (CVSS 6.1, Adobe Creative Cloud) - [CVE-2021-21077](https://cve.now/CVE-2021-21077.md): Adobe Animate heap-based overflow vulnerability (CVSS 7.8, Adobe Animate) - [CVE-2021-21069](https://cve.now/CVE-2021-21069.md): Adobe Creative Cloud Privilege Escalation Vulnerability (CVSS 7.8, Adobe Creative Cloud) - [CVE-2021-21073](https://cve.now/CVE-2021-21073.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21072](https://cve.now/CVE-2021-21072.md): Adobe Animate out-of-bounds read vulnerability (CVSS 7.1, Adobe Animate) - [CVE-2021-21079](https://cve.now/CVE-2021-21079.md): Adobe Connect Reflected Cross-site Scripting via archiveOffset parameter (CVSS 6.1, Adobe Connect) - [CVE-2021-21726](https://cve.now/CVE-2021-21726.md): Some ZTE products have an input verification vulnerability in the diagnostic function interface. (no CVSS, \) - [CVE-2021-21379](https://cve.now/CVE-2021-21379.md): It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro (CVSS 7.7, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…) - [CVE-2021-21368](https://cve.now/CVE-2021-21368.md): Prototype poisoning (CVSS 6.7, mcollina msgpack5 · msgpack5) - [CVE-2020-4831](https://cve.now/CVE-2020-4831.md): IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h (CVSS 5.9, IBM DataPower Gateway) - [CVE-2021-21367](https://cve.now/CVE-2021-21367.md): Incorrect Authorization in switchboard-plug-bluetooth (CVSS 6.1, elementary switchboard-plug-bluetooth) - [CVE-2021-23354](https://cve.now/CVE-2021-23354.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, printf) - [CVE-2021-28302](https://cve.now/CVE-2021-28302.md): A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser\_parseDocument() function. (no CVSS) - [CVE-2021-28305](https://cve.now/CVE-2021-28305.md): An issue was discovered in the diesel crate before 1.4.6 for Rust. (no CVSS, diesel) - [CVE-2021-28306](https://cve.now/CVE-2021-28306.md): An issue was discovered in the fltk crate before 0.15.3 for Rust. (no CVSS, fltk) - [CVE-2021-28307](https://cve.now/CVE-2021-28307.md): An issue was discovered in the fltk crate before 0.15.3 for Rust. (no CVSS, fltk) - [CVE-2021-28308](https://cve.now/CVE-2021-28308.md): An issue was discovered in the fltk crate before 0.15.3 for Rust. (no CVSS, fltk) - [CVE-2021-27646](https://cve.now/CVE-2021-27646.md): Use After Free vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers (CVSS 9.8, Synology DiskStation Manager) - [CVE-2021-26569](https://cve.now/CVE-2021-26569.md): Race Condition within a Thread vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows r (CVSS 9.8, Synology DiskStation Manager) - [CVE-2021-27647](https://cve.now/CVE-2021-27647.md): Out-of-bounds Read vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attack (CVSS 9.8, Synology DiskStation Manager) - [CVE-2021-20674](https://cve.now/CVE-2021-20674.md): Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain p (no CVSS, NTT TechnoCross Installer of MagicConnect Client program) - [CVE-2020-36282](https://cve.now/CVE-2020-36282.md): JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via (no CVSS, com.rabbitmq.jms:rabbitmq-jms) - [CVE-2020-36281](https://cve.now/CVE-2020-36281.md): Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c. (no CVSS) - [CVE-2020-36280](https://cve.now/CVE-2020-36280.md): Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c. (no CVSS) - [CVE-2020-36279](https://cve.now/CVE-2020-36279.md): Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap\_reg.c and adaptmap.c. (no CVSS) - [CVE-2021-21366](https://cve.now/CVE-2021-21366.md): Misinterpretation of malicious XML input (CVSS 4.3, xmldom) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-03-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.