# CVEs published 2021-03-16

22 CVEs were published on March 16, 2021: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-3344](https://cve.now/CVE-2021-3344.md): A privilege escalation flaw was found in OpenShift builder. (no CVSS, openshift/builder)
- [CVE-2019-3897](https://cve.now/CVE-2019-3897.md): It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know it (no CVSS, redhat-certification)
- [CVE-2021-20218](https://cve.now/CVE-2021-20218.md): A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. (no CVSS, fabric8-kubernetes-client · io.fabric8:kubernetes-client)
- [CVE-2021-3127](https://cve.now/CVE-2021-3127.md): NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled. (no CVSS, github.com/nats-io/jwt · github.com/nats-io/jwt/v2 +1)
- [CVE-2021-28295](https://cve.now/CVE-2021-28295.md): Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to d (no CVSS)
- [CVE-2021-28294](https://cve.now/CVE-2021-28294.md): Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to re (no CVSS)
- [CVE-2021-28381](https://cve.now/CVE-2021-28381.md): The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper. (no CVSS, fluidtypo3/vhs)
- [CVE-2021-28380](https://cve.now/CVE-2021-28380.md): The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend u (no CVSS, aimeos/aimeos-typo3)
- [CVE-2020-28899](https://cve.now/CVE-2020-28899.md): The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attack (no CVSS)
- [CVE-2021-27938](https://cve.now/CVE-2021-27938.md): A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. (no CVSS, symbiote/silverstripe-queuedjobs)
- [CVE-2021-25916](https://cve.now/CVE-2021-25916.md): Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead (CVSS 9.8, patchmerge)
- [CVE-2021-22887](https://cve.now/CVE-2021-22887.md): A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firm (no CVSS, PSA5000, PSA7000)
- [CVE-2021-28543](https://cve.now/CVE-2021-28543.md): Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. (CVSS 4.0)
- [CVE-2020-24264](https://cve.now/CVE-2020-24264.md): Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. (no CVSS)
- [CVE-2020-24263](https://cve.now/CVE-2020-24263.md): Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. (no CVSS)
- [CVE-2021-21192](https://cve.now/CVE-2021-21192.md): Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2021-21193](https://cve.now/CVE-2021-21193.md): Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-21191](https://cve.now/CVE-2021-21191.md): Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-4891](https://cve.now/CVE-2020-4891.md): IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user (CVSS 6.2, IBM Spectrum Scale)
- [CVE-2020-4890](https://cve.now/CVE-2020-4890.md): IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a den (CVSS 4.4, IBM Spectrum Scale)
- [CVE-2020-4851](https://cve.now/CVE-2020-4851.md): IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which could impact support a (CVSS 4.0, IBM Spectrum Scale)
- [CVE-2020-1926](https://cve.now/CVE-2020-1926.md): Timing attack in Cookie signature verification (no CVSS, Apache Software Foundation Apache Hive · org.apache.hive:hi…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.