CVEs published March 18, 2021
96 CVEs were published on March 18, 2021: 0 critical, 5 high.
- Published
- 96
- Critical
- 0
- High
- 5
- Medium
- 2
- Low
- 0
- Unrated
- 89
- Now in CISA KEV
- 0
- Fix available
- 38
Most affected products
- Cybozu Office
- 11
- Modern Events Calendar Lite
- 4
- M-System Co. M-System DL8 series
- 2
- nbdkit
- 2
- 301 Redirects - Easy Redirect Manager
- 1
- AccessPress Social Icons
- 1
- ActiveCampaign
- 1
- AdRotate
- 1
- Advanced Database Cleaner
- 1
- Advantech WebAccess/SCADA
- 1
High 5
- CVE-2021-1287Cisco Small Business RV132W and RV134W Routers Management Interface Remote Command Execution and Denial of Service VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2021-21383XSS in Wiki.jsRequarks wiki
- CVE-2021-23359Arbitrary Command Injectionport-killer
- CVE-2021-22848HGiga MailSherlock - SQL Injection-2HGiga MailSherlock MSR45/SSR45
- CVE-2020-27827A flaw was found in multiple versions of OpenvSwitch.lldp/openvswitch
Medium, low and unrated 91
- CVE-2021-21384Null characters not escaped in shescapeericcornelissen shescape · shescape
- CVE-2021-28653The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely.
- CVE-2021-26275The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function.eslint-fixer
- CVE-2021-27436WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code Advantech WebAccess/SCADA
- CVE-2021-3416A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0.QEMU
- CVE-2021-27358The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remotgithub.com/grafana/grafana
- CVE-2020-36144Redash 8.0.0 is affected by LDAP Injection.
- CVE-2020-9367The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig
- CVE-2020-26886Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Store
- CVE-2021-25764In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.
- CVE-2020-26797Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping.
- CVE-2019-14852A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol.apicast
- CVE-2019-14851A denial of service vulnerability was discovered in nbdkit.nbdkit
- CVE-2020-35492A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4.cairo
- CVE-2019-14850A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1.nbdkit
- CVE-2021-28160Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is di
- CVE-2019-3867A vulnerability was found in the Quay web application.quay
- CVE-2021-27656exacqVision Web Services - Information ExposureJohnson Controls exacqVision Web Service
- CVE-2020-14516In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 Rockwell Automation FactoryTalk Services Platform
- CVE-2021-22665Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limRockwell Automation DriveTools SP and Drives AOP
- CVE-2020-26155Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0.
- CVE-2021-26216SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
- CVE-2021-26215SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
- CVE-2021-28145Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block.concrete5/concrete5
- CVE-2021-28791The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a
- CVE-2021-28789The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constru
- CVE-2021-28796Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.qiita-markdown
- CVE-2021-28794The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath.
- CVE-2021-28792The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary cod
- CVE-2021-28790The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a m
- CVE-2021-24142301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection301 Redirects - Easy Redirect Manager
- CVE-2021-24143AccessPress Social Icons < 1.8.1 - Authenticated SQL InjectionAccessPress Social Icons
- CVE-2021-24144Contact Form 7 Database Addon < 1.2.5.6 - CSV InjectionContact Form 7 Database Addon
- CVE-2021-24145Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCEModern Events Calendar Lite
- CVE-2021-24146Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events ExportModern Events Calendar Lite
- CVE-2021-24147Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)Modern Events Calendar Lite
- CVE-2021-24148MStore API < 3.2.0 - Authentication Bypass With Sign In With AppleMStore API
- CVE-2021-24149Modern Events Calendar Lite < 5.16.6 - Authenticated SQL InjectionModern Events Calendar Lite
- CVE-2021-24133ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in SettingsActiveCampaign
- CVE-2021-24134Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSSConstant Contact Forms
- CVE-2021-24135WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSSWP Customer Reviews
- CVE-2021-24136Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSSTestimonials Widget
- CVE-2021-24137Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL InjectionBlog2Social: Social Media Auto Post & Scheduler
- CVE-2021-24138AdRotate < 5.8.4 - Authenticated SQL InjectionAdRotate
- CVE-2021-24139Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL InjectionPhoto Gallery by 10Web
- CVE-2021-24140Ajax Load More < 5.3.2 - Authenticated SQL InjectionAjax Load More
- CVE-2021-24141Advanced Database Cleaner < 3.0.2 - Authenticated SQL injectionAdvanced Database Cleaner
- CVE-2021-24124WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)WP Shieldon
- CVE-2021-24125Contact Form Submissions < 1.7.1 - Authenticated SQL InjectionContact Form Submissions
- CVE-2021-24126Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site ScriptingEnvira Gallery Lite
- CVE-2021-24127ThirstyAffiliates < 3.9.3 - Authenticated Stored XSSThirstyAffiliates
- CVE-2021-24128Team Members < 5.0.4 - Authenticated Stored Cross-Site Scripting (XSS)Team Members
- CVE-2021-24129Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site ScriptingThemify Portfolio Post
- CVE-2021-24130WP Google Map Plugin < 4.1.5 - Authenticated SQL InjectionWP Google Map Plugin
- CVE-2021-24131Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL InjectionsAnti-Spam by CleanTalk
- CVE-2021-24132Slider by 10Web < 1.2.36 - Multiple Authenticated SQL InjectionSlider by 10Web
- CVE-2021-24123PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCEPowerPress
- CVE-2021-26935In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnera
- CVE-2021-27306An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authentic
- CVE-2021-28133Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attem
- CVE-2021-26237FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user opens or views a malfor
- CVE-2021-26235FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when a user opens or view
- CVE-2021-26234FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d8a, triggered when a user opens or views a malfor
- CVE-2021-26233FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfcb, triggered when a user opens or view
- CVE-2021-21626Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowJenkins project Jenkins Warnings Next Generation Plugin · i…
- CVE-2021-21627A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domJenkins project Jenkins Libvirt Agents Plugin · org.jenkins…
- CVE-2021-21625Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowinJenkins project Jenkins CloudBees AWS Credentials Plugin ·…
- CVE-2021-21624An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permissionJenkins project Jenkins Role-based Authorization Strategy P…
- CVE-2021-21623An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission oJenkins project Jenkins Matrix Authorization Strategy Plugi…
- CVE-2021-26236FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BI
- CVE-2021-28420A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parame
- CVE-2021-28419The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to r
- CVE-2021-28418A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" param
- CVE-2021-28417A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" par
- CVE-2021-3141In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attac
- CVE-2021-28681Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed.github.com/pion/webrtc/v3
- CVE-2021-28667StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space.
- CVE-2021-20676M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3M-System Co. M-System DL8 series
- CVE-2021-20678SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SStranger Studios Paid Memberships Pro
- CVE-2021-20675M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3M-System Co. M-System DL8 series
- CVE-2021-20634Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriCybozu Office
- CVE-2021-20632Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access reCybozu Office
- CVE-2021-20633Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restrictiCybozu Office
- CVE-2021-20631Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of CCybozu Office
- CVE-2021-20629Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unsCybozu Office
- CVE-2021-20630Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access reCybozu Office
- CVE-2021-20628Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script vCybozu Office
- CVE-2021-20627Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script vCybozu Office
- CVE-2021-20625Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access Cybozu Office
- CVE-2021-20626Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restrictCybozu Office
- CVE-2021-20624Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restrCybozu Office