# CVEs published 2021-03-17

38 CVEs were published on March 17, 2021: 2 critical, 0 high. Days are UTC.

- [CVE-2019-18235](https://cve.now/CVE-2019-18235.md): Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may a (no CVSS, Advantech Spectre RT ERT351 Versions 5.1.3 and prior)
- [CVE-2019-18231](https://cve.now/CVE-2019-18231.md): Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may allow an attacker to (no CVSS, Advantech Spectre RT ERT351)
- [CVE-2019-18233](https://cve.now/CVE-2019-18233.md): In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special characters in the error (no CVSS, Advantech Spectre RT Industrial Routers ERT351)
- [CVE-2020-17457](https://cve.now/CVE-2020-17457.md): Fujitsu ServerView Suite iRMC before 9.62F allows XSS. (no CVSS)
- [CVE-2020-35454](https://cve.now/CVE-2020-35454.md): The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an Android backup becau (no CVSS)
- [CVE-2020-35455](https://cve.now/CVE-2020-35455.md): The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from Shared Preferences and (no CVSS)
- [CVE-2020-35456](https://cve.now/CVE-2020-35456.md): The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logca (no CVSS)
- [CVE-2021-27292](https://cve.now/CVE-2021-27292.md): ua-parser-js \>= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. (no CVSS, ua-parser-js)
- [CVE-2020-28873](https://cve.now/CVE-2020-28873.md): Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. (no CVSS)
- [CVE-2021-27291](https://cve.now/CVE-2021-27291.md): In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. (no CVSS, pygments)
- [CVE-2020-17525](https://cve.now/CVE-2020-17525.md): Remote unauthenticated denial-of-service in Subversion mod\_authz\_svn (no CVSS, Apache Software Foundation Apache Subversion)
- [CVE-2021-22860](https://cve.now/CVE-2021-22860.md): EIC e-document system - Broken Authentication (CVSS 9.8, Excellent Infotek e-document system)
- [CVE-2021-22859](https://cve.now/CVE-2021-22859.md): EIC e-document system - SQL Injection (CVSS 9.8, Excellent Infotek e-document system)
- [CVE-2020-13924](https://cve.now/CVE-2020-13924.md): In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other direct (no CVSS, Apache Software Foundation Apache Ambari)
- [CVE-2020-11309](https://cve.now/CVE-2020-11309.md): Use after free in GPU driver while mapping the user memory to GPU memory due to improper check of referenced memory in Snapdragon Auto, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11305](https://cve.now/CVE-2020-11305.md): Integer overflow in boot due to improper length check on arguments received in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrago (no CVSS, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…)
- [CVE-2020-11308](https://cve.now/CVE-2020-11308.md): Buffer overflow occurs when trying to convert ASCII string to Unicode string if the actual size is more than required in Snapdragon Auto, Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11299](https://cve.now/CVE-2020-11299.md): Buffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11290](https://cve.now/CVE-2020-11290.md): Use after free condition in msm ioctl events due to race between the ioctl register and deregister events in Snapdragon Auto, Snapdragon Com (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11228](https://cve.now/CVE-2020-11228.md): Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11230](https://cve.now/CVE-2020-11230.md): Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11227](https://cve.now/CVE-2020-11227.md): Out of bound write while parsing RTT/TTY packet parsing due to lack of check of buffer size before copying into buffer in Snapdragon Auto, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11226](https://cve.now/CVE-2020-11226.md): Out of bound memory read in Data modem while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11222](https://cve.now/CVE-2020-11222.md): Buffer over read while processing MT SMS with maximum length due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11220](https://cve.now/CVE-2020-11220.md): While processing storage SCM commands there is a time of check or time of use window where a pointer used could be invalid at a specific tim (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11221](https://cve.now/CVE-2020-11221.md): Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insufficient chec (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11218](https://cve.now/CVE-2020-11218.md): Denial of service in baseband when NW configures LTE betaOffset-RI-Index due to lack of data validation in Snapdragon Auto, Snapdragon Compu (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11192](https://cve.now/CVE-2020-11192.md): Out of bound write while parsing SDP string due to missing check on null termination in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11199](https://cve.now/CVE-2020-11199.md): HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11190](https://cve.now/CVE-2020-11190.md): Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11189](https://cve.now/CVE-2020-11189.md): Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11186](https://cve.now/CVE-2020-11186.md): Modem will enter into busy mode in an infinite loop while parsing histogram dimension due to improper validation of input received in Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11188](https://cve.now/CVE-2020-11188.md): Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11171](https://cve.now/CVE-2020-11171.md): Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11166](https://cve.now/CVE-2020-11166.md): Potential out of bound read exception when UE receives unusually large number of padding octets in the beginning of ROHC header in Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2017-20002](https://cve.now/CVE-2017-20002.md): The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. (no CVSS)
- [CVE-2021-28650](https://cve.now/CVE-2021-28650.md): autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal duri (no CVSS)
- [CVE-2021-28660](https://cve.now/CVE-2021-28660.md): rtw\_wx\_set\_scan in drivers/staging/rtl8188eu/os\_dep/ioctl\_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the -\> (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.