# CVEs published 2021-03-15

65 CVEs were published on March 15, 2021: 0 critical, 0 high. Days are UTC.

- [CVE-2021-27230](https://cve.now/CVE-2021-27230.md): ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save (no CVSS)
- [CVE-2021-20283](https://cve.now/CVE-2021-20283.md): The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that (no CVSS, moodle · moodle/moodle)
- [CVE-2021-20282](https://cve.now/CVE-2021-20282.md): When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle be (no CVSS, moodle · moodle/moodle)
- [CVE-2021-20281](https://cve.now/CVE-2021-20281.md): It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-20280](https://cve.now/CVE-2021-20280.md): Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, (no CVSS, moodle · moodle/moodle)
- [CVE-2021-20279](https://cve.now/CVE-2021-20279.md): The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-26987](https://cve.now/CVE-2021-26987.md): Element Plug-in for vCenter Server incorporates SpringBoot Framework. (no CVSS, Element Plug-in for vCenter Server · Management Services… +1)
- [CVE-2020-27290](https://cve.now/CVE-2020-27290.md): In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers w (no CVSS, Hamilton Medical AG, T1-Ventillator)
- [CVE-2020-27282](https://cve.now/CVE-2020-27282.md): In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attacker (no CVSS, Hamilton Medical AG, T1-Ventillator)
- [CVE-2020-27278](https://cve.now/CVE-2020-27278.md): In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical acces (no CVSS, Hamilton Medical AG, T1-Ventillator)
- [CVE-2021-3418](https://cve.now/CVE-2021-3418.md): If certificates that signed grub are installed into db, grub can be booted directly. (no CVSS, grub2)
- [CVE-2021-24029](https://cve.now/CVE-2021-24029.md): A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed ass (no CVSS, Facebook mvfst · Facebook proxygen)
- [CVE-2021-3150](https://cve.now/CVE-2021-3150.md): A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject a (no CVSS)
- [CVE-2021-23879](https://cve.now/CVE-2021-23879.md): Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and ... (CVSS 6.7, McAfee Endpoint Product Removal Tool)
- [CVE-2020-29553](https://cve.now/CVE-2020-29553.md): The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious (no CVSS, getgrav/grav)
- [CVE-2020-29555](https://cve.now/CVE-2020-29555.md): The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying (no CVSS, getgrav/grav)
- [CVE-2020-29556](https://cve.now/CVE-2020-29556.md): The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying se (no CVSS, getgrav/grav)
- [CVE-2020-24985](https://cve.now/CVE-2020-24985.md): An issue was discovered in Quadbase EspressReports ES 7 Update 9. (no CVSS)
- [CVE-2021-22191](https://cve.now/CVE-2021-22191.md): Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted (CVSS 6.3, The Wireshark Foundation Wireshark)
- [CVE-2020-24982](https://cve.now/CVE-2020-24982.md): An issue was discovered in Quadbase ExpressDashboard (EDAB) 7 Update 9. (no CVSS)
- [CVE-2021-20286](https://cve.now/CVE-2021-20286.md): A flaw was found in libnbd 1.7.3. (no CVSS, libnbd)
- [CVE-2020-28149](https://cve.now/CVE-2020-28149.md): myDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS). (no CVSS)
- [CVE-2021-27949](https://cve.now/CVE-2021-27949.md): Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. (no CVSS)
- [CVE-2021-27948](https://cve.now/CVE-2021-27948.md): SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (no CVSS)
- [CVE-2021-27947](https://cve.now/CVE-2021-27947.md): SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (no CVSS)
- [CVE-2021-27946](https://cve.now/CVE-2021-27946.md): SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (no CVSS)
- [CVE-2021-27890](https://cve.now/CVE-2021-27890.md): SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. (no CVSS)
- [CVE-2021-25667](https://cve.now/CVE-2021-25667.md): A vulnerability has been identified in RUGGEDCOM RM1224 (All versions \>= V4.3 and \< V6.4), SCALANCE M-800 (All versions \>= V4.3 and \< V6.4), (CVSS 6.5, Siemens RUGGEDCOM RM1224 · Siemens SCALANCE M-800 +9)
- [CVE-2021-25672](https://cve.now/CVE-2021-25672.md): A vulnerability has been identified in Mendix Forgot Password Appstore module (All Versions \< V3.2.1). (no CVSS, Siemens Mendix Forgot Password Appstore module)
- [CVE-2021-25673](https://cve.now/CVE-2021-25673.md): A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). (no CVSS, Siemens SIMATIC S7-PLCSIM)
- [CVE-2021-25674](https://cve.now/CVE-2021-25674.md): A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). (no CVSS, Siemens SIMATIC S7-PLCSIM)
- [CVE-2021-25675](https://cve.now/CVE-2021-25675.md): A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). (no CVSS, Siemens SIMATIC S7-PLCSIM)
- [CVE-2021-25676](https://cve.now/CVE-2021-25676.md): A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions \> (no CVSS, Siemens RUGGEDCOM RM1224 · Siemens SCALANCE M-800 +2)
- [CVE-2021-27380](https://cve.now/CVE-2021-27380.md): A vulnerability has been identified in Solid Edge SE2020 (All versions \< SE2020MP13), Solid Edge SE2021 (All Versions \< SE2021MP4). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2021-27381](https://cve.now/CVE-2021-27381.md): A vulnerability has been identified in Solid Edge SE2020 (All Versions \< SE2020MP13), Solid Edge SE2021 (All Versions \< SE2021MP3). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2020-25236](https://cve.now/CVE-2020-25236.md): A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All version (CVSS 5.5, Siemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14)
- [CVE-2020-25239](https://cve.now/CVE-2020-25239.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0). (no CVSS, Siemens SINEMA Remote Connect Server)
- [CVE-2020-25240](https://cve.now/CVE-2020-25240.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0). (no CVSS, Siemens SINEMA Remote Connect Server)
- [CVE-2020-25241](https://cve.now/CVE-2020-25241.md): A vulnerability has been identified in SIMATIC MV400 family (All Versions \< V7.0.6). (no CVSS, Siemens SIMATIC MV400 family)
- [CVE-2020-28385](https://cve.now/CVE-2020-28385.md): A vulnerability has been identified in Solid Edge SE2020 (All versions \< SE2020MP13), Solid Edge SE2021 (All Versions \< SE2021MP4). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2020-28387](https://cve.now/CVE-2020-28387.md): A vulnerability has been identified in Solid Edge SE2020 (All Versions \< SE2020MP13), Solid Edge SE2021 (All Versions \< SE2021MP3). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2021-27889](https://cve.now/CVE-2021-27889.md): Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages. (no CVSS)
- [CVE-2021-23357](https://cve.now/CVE-2021-23357.md): Directory Traversal (CVSS 3.3, github.com/TykTechnologies/tyk/gateway)
- [CVE-2021-27817](https://cve.now/CVE-2021-27817.md): A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is J (no CVSS, shopxo/shopxo)
- [CVE-2020-24877](https://cve.now/CVE-2020-24877.md): A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass. (no CVSS)
- [CVE-2021-23355](https://cve.now/CVE-2021-23355.md): Arbitrary Command Injection (CVSS 5.6, ps-kill)
- [CVE-2021-23356](https://cve.now/CVE-2021-23356.md): Arbitrary Command Injection (CVSS 5.6, kill-process-by-name)
- [CVE-2021-27695](https://cve.now/CVE-2021-27695.md): Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2021-20440](https://cve.now/CVE-2021-20440.md): IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. (CVSS 6.4, IBM API Connect)
- [CVE-2020-4184](https://cve.now/CVE-2020-4184.md): IBM Security Guardium 11.2 performs an operation at a privilege level that is higher than the minimum level required, which creates new weak (CVSS 5.8, IBM Security Guardium)
- [CVE-2021-3167](https://cve.now/CVE-2021-3167.md): In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs. (no CVSS)
- [CVE-2021-26924](https://cve.now/CVE-2021-26924.md): An issue was discovered in Argo CD before 1.8.4. (no CVSS)
- [CVE-2021-26923](https://cve.now/CVE-2021-26923.md): An issue was discovered in Argo CD before 1.8.4. (no CVSS)
- [CVE-2021-27892](https://cve.now/CVE-2021-27892.md): SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation. (no CVSS)
- [CVE-2021-27891](https://cve.now/CVE-2021-27891.md): SSH Tectia Client and Server before 6.4.19 on Windows have weak key generation. (no CVSS)
- [CVE-2021-27893](https://cve.now/CVE-2021-27893.md): SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation in nonstandard conditions. (no CVSS)
- [CVE-2021-27208](https://cve.now/CVE-2021-27208.md): When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any para (no CVSS)
- [CVE-2021-20179](https://cve.now/CVE-2021-20179.md): A flaw was found in pki-core. (no CVSS, pki-core)
- [CVE-2020-35358](https://cve.now/CVE-2020-35358.md): DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. (no CVSS)
- [CVE-2021-27576](https://cve.now/CVE-2021-27576.md): Apache OpenMeetings: bandwidth can be overloaded with public web service (no CVSS, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2021-28379](https://cve.now/CVE-2021-28379.md): web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a dif (no CVSS)
- [CVE-2021-28378](https://cve.now/CVE-2021-28378.md): Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. (CVSS 3.7, code.gitea.io/gitea)
- [CVE-2021-28374](https://cve.now/CVE-2021-28374.md): The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak (no CVSS)
- [CVE-2021-28375](https://cve.now/CVE-2021-28375.md): An issue was discovered in the Linux kernel through 5.11.6. (no CVSS)
- [CVE-2021-28363](https://cve.now/CVE-2021-28363.md): The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. (no CVSS, urllib3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.