CVEs published March 15, 2021
65 CVEs were published on March 15, 2021: 0 critical, 0 high.
- Published
- 65
- Critical
- 0
- High
- 0
- Medium
- 8
- Low
- 2
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- moodle · moodle/moodle
- 5
- Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- 4
- getgrav/grav
- 3
- Hamilton Medical AG, T1-Ventillator
- 3
- Siemens SIMATIC S7-PLCSIM
- 3
- Siemens SINEMA Remote Connect Server
- 2
- Apache Software Foundation Apache OpenMeetings · org.apache…
- 1
- code.gitea.io/gitea
- 1
- Element Plug-in for vCenter Server · Management Services… +1
- 1
- Facebook mvfst · Facebook proxygen
- 1
Medium, low and unrated 65
- CVE-2021-27230ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save
- CVE-2021-20283The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view thatmoodle · moodle/moodle
- CVE-2021-20282When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle bemoodle · moodle/moodle
- CVE-2021-20281It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.moodle · moodle/moodle
- CVE-2021-20280Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8,moodle · moodle/moodle
- CVE-2021-20279The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.moodle · moodle/moodle
- CVE-2021-26987Element Plug-in for vCenter Server incorporates SpringBoot Framework.Element Plug-in for vCenter Server · Management Services… +1
- CVE-2020-27290In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers wHamilton Medical AG, T1-Ventillator
- CVE-2020-27282In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackerHamilton Medical AG, T1-Ventillator
- CVE-2020-27278In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical accesHamilton Medical AG, T1-Ventillator
- CVE-2021-3418If certificates that signed grub are installed into db, grub can be booted directly.grub2
- CVE-2021-24029A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assFacebook mvfst · Facebook proxygen
- CVE-2021-3150A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject a
- CVE-2021-23879Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and ...McAfee Endpoint Product Removal Tool
- CVE-2020-29553The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious getgrav/grav
- CVE-2020-29555The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying getgrav/grav
- CVE-2020-29556The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying segetgrav/grav
- CVE-2020-24985An issue was discovered in Quadbase EspressReports ES 7 Update 9.
- CVE-2021-22191Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted The Wireshark Foundation Wireshark
- CVE-2020-24982An issue was discovered in Quadbase ExpressDashboard (EDAB) 7 Update 9.
- CVE-2021-20286A flaw was found in libnbd 1.7.3.libnbd
- CVE-2020-28149myDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS).
- CVE-2021-27949Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
- CVE-2021-27948SQL Injection vulnerability in MyBB before 1.8.26 via User Groups.
- CVE-2021-27947SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management.
- CVE-2021-27946SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count.
- CVE-2021-27890SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.
- CVE-2021-25667A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4),Siemens RUGGEDCOM RM1224 · Siemens SCALANCE M-800 +9
- CVE-2021-25672A vulnerability has been identified in Mendix Forgot Password Appstore module (All Versions < V3.2.1).Siemens Mendix Forgot Password Appstore module
- CVE-2021-25673A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions).Siemens SIMATIC S7-PLCSIM
- CVE-2021-25674A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions).Siemens SIMATIC S7-PLCSIM
- CVE-2021-25675A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions).Siemens SIMATIC S7-PLCSIM
- CVE-2021-25676A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >Siemens RUGGEDCOM RM1224 · Siemens SCALANCE M-800 +2
- CVE-2021-27380A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2021-27381A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2020-25236A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versionSiemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14
- CVE-2020-25239A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0).Siemens SINEMA Remote Connect Server
- CVE-2020-25240A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0).Siemens SINEMA Remote Connect Server
- CVE-2020-25241A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6).Siemens SIMATIC MV400 family
- CVE-2020-28385A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2020-28387A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2021-27889Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.
- CVE-2021-23357Directory Traversalgithub.com/TykTechnologies/tyk/gateway
- CVE-2021-27817A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is Jshopxo/shopxo
- CVE-2020-24877A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.
- CVE-2021-23355Arbitrary Command Injectionps-kill
- CVE-2021-23356Arbitrary Command Injectionkill-process-by-name
- CVE-2021-27695Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or H
- CVE-2021-20440IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient.IBM API Connect
- CVE-2020-4184IBM Security Guardium 11.2 performs an operation at a privilege level that is higher than the minimum level required, which creates new weakIBM Security Guardium
- CVE-2021-3167In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.
- CVE-2021-26924An issue was discovered in Argo CD before 1.8.4.
- CVE-2021-26923An issue was discovered in Argo CD before 1.8.4.
- CVE-2021-27892SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation.
- CVE-2021-27891SSH Tectia Client and Server before 6.4.19 on Windows have weak key generation.
- CVE-2021-27893SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation in nonstandard conditions.
- CVE-2021-27208When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any para
- CVE-2021-20179A flaw was found in pki-core.pki-core
- CVE-2020-35358DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability.
- CVE-2021-27576Apache OpenMeetings: bandwidth can be overloaded with public web serviceApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2021-28379web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a dif
- CVE-2021-28378Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.code.gitea.io/gitea
- CVE-2021-28374The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak
- CVE-2021-28375An issue was discovered in the Linux kernel through 5.11.6.
- CVE-2021-28363The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies.urllib3