CVEs published March 16, 2021
22 CVEs were published on March 16, 2021: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 22
- Critical
- 1
- High
- 1
- Medium
- 4
- Low
- 0
- Unrated
- 16
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Google Chrome
- 3
- IBM Spectrum Scale
- 3
- aimeos/aimeos-typo3
- 1
- Apache Software Foundation Apache Hive · org.apache.hive:hi…
- 1
- fabric8-kubernetes-client · io.fabric8:kubernetes-client
- 1
- fluidtypo3/vhs
- 1
- github.com/nats-io/jwt · github.com/nats-io/jwt/v2 +1
- 1
- openshift/builder
- 1
- patchmerge
- 1
- PSA5000, PSA7000
- 1
Critical 1
High 1
Medium, low and unrated 20
- CVE-2021-3344A privilege escalation flaw was found in OpenShift builder.openshift/builder
- CVE-2019-3897It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know itredhat-certification
- CVE-2021-20218A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after.fabric8-kubernetes-client · io.fabric8:kubernetes-client
- CVE-2021-3127NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.github.com/nats-io/jwt · github.com/nats-io/jwt/v2 +1
- CVE-2021-28295Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to d
- CVE-2021-28294Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to re
- CVE-2021-28381The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.fluidtypo3/vhs
- CVE-2021-28380The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend uaimeos/aimeos-typo3
- CVE-2020-28899The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attack
- CVE-2021-27938A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module.symbiote/silverstripe-queuedjobs
- CVE-2021-22887A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmPSA5000, PSA7000
- CVE-2021-28543Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations.
- CVE-2020-24264Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution.
- CVE-2020-24263Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution.
- CVE-2021-21192Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-21191Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-4891IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user IBM Spectrum Scale
- CVE-2020-4890IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denIBM Spectrum Scale
- CVE-2020-4851IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which could impact support aIBM Spectrum Scale
- CVE-2020-1926Timing attack in Cookie signature verificationApache Software Foundation Apache Hive · org.apache.hive:hi…