# CVEs published 2021-03-18

96 CVEs were published on March 18, 2021: 0 critical, 5 high. Days are UTC.

- [CVE-2021-21384](https://cve.now/CVE-2021-21384.md): Null characters not escaped in shescape (CVSS 6.3, ericcornelissen shescape · shescape)
- [CVE-2021-28653](https://cve.now/CVE-2021-28653.md): The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. (no CVSS)
- [CVE-2021-26275](https://cve.now/CVE-2021-26275.md): The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. (no CVSS, eslint-fixer)
- [CVE-2021-27436](https://cve.now/CVE-2021-27436.md): WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2021-3416](https://cve.now/CVE-2021-3416.md): A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. (no CVSS, QEMU)
- [CVE-2021-27358](https://cve.now/CVE-2021-27358.md): The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remot (no CVSS, github.com/grafana/grafana)
- [CVE-2020-36144](https://cve.now/CVE-2020-36144.md): Redash 8.0.0 is affected by LDAP Injection. (no CVSS)
- [CVE-2020-9367](https://cve.now/CVE-2020-9367.md): The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig (no CVSS)
- [CVE-2020-26886](https://cve.now/CVE-2020-26886.md): Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Store (no CVSS)
- [CVE-2021-25764](https://cve.now/CVE-2021-25764.md): In JetBrains PhpStorm before 2020.3, source code could be added to debug logs. (no CVSS)
- [CVE-2020-26797](https://cve.now/CVE-2020-26797.md): Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File\_Gxf::ChooseParser\_ChannelGrouping. (no CVSS)
- [CVE-2019-14852](https://cve.now/CVE-2019-14852.md): A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. (no CVSS, apicast)
- [CVE-2019-14851](https://cve.now/CVE-2019-14851.md): A denial of service vulnerability was discovered in nbdkit. (no CVSS, nbdkit)
- [CVE-2020-35492](https://cve.now/CVE-2020-35492.md): A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. (no CVSS, cairo)
- [CVE-2019-14850](https://cve.now/CVE-2019-14850.md): A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. (no CVSS, nbdkit)
- [CVE-2021-28160](https://cve.now/CVE-2021-28160.md): Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is di (no CVSS)
- [CVE-2021-1287](https://cve.now/CVE-2021-1287.md): Cisco Small Business RV132W and RV134W Routers Management Interface Remote Command Execution and Denial of Service Vulnerability (CVSS 7.2, Cisco Small Business RV Series Router Firmware)
- [CVE-2019-3867](https://cve.now/CVE-2019-3867.md): A vulnerability was found in the Quay web application. (no CVSS, quay)
- [CVE-2021-27656](https://cve.now/CVE-2021-27656.md): exacqVision Web Services - Information Exposure (CVSS 5.3, Johnson Controls exacqVision Web Service)
- [CVE-2020-14516](https://cve.now/CVE-2020-14516.md): In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 (no CVSS, Rockwell Automation FactoryTalk Services Platform)
- [CVE-2021-21383](https://cve.now/CVE-2021-21383.md): XSS in Wiki.js (CVSS 7.6, Requarks wiki)
- [CVE-2021-22665](https://cve.now/CVE-2021-22665.md): Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with lim (no CVSS, Rockwell Automation DriveTools SP and Drives AOP)
- [CVE-2020-26155](https://cve.now/CVE-2020-26155.md): Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. (no CVSS)
- [CVE-2021-26216](https://cve.now/CVE-2021-26216.md): SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php. (no CVSS)
- [CVE-2021-26215](https://cve.now/CVE-2021-26215.md): SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. (no CVSS)
- [CVE-2021-28145](https://cve.now/CVE-2021-28145.md): Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. (no CVSS, concrete5/concrete5)
- [CVE-2021-28791](https://cve.now/CVE-2021-28791.md): The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a (no CVSS)
- [CVE-2021-28789](https://cve.now/CVE-2021-28789.md): The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constru (no CVSS)
- [CVE-2021-28796](https://cve.now/CVE-2021-28796.md): Increments Qiita::Markdown before 0.33.0 allows XSS in transformers. (no CVSS, qiita-markdown)
- [CVE-2021-28794](https://cve.now/CVE-2021-28794.md): The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath. (no CVSS)
- [CVE-2021-28792](https://cve.now/CVE-2021-28792.md): The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2021-28790](https://cve.now/CVE-2021-28790.md): The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a m (no CVSS)
- [CVE-2021-24142](https://cve.now/CVE-2021-24142.md): 301 Redirects - Easy Redirect Manager \< 2.51 - Authenticated SQL Injection (no CVSS, 301 Redirects - Easy Redirect Manager)
- [CVE-2021-24143](https://cve.now/CVE-2021-24143.md): AccessPress Social Icons \< 1.8.1 - Authenticated SQL Injection (no CVSS, AccessPress Social Icons)
- [CVE-2021-24144](https://cve.now/CVE-2021-24144.md): Contact Form 7 Database Addon \< 1.2.5.6 - CSV Injection (no CVSS, Contact Form 7 Database Addon)
- [CVE-2021-24145](https://cve.now/CVE-2021-24145.md): Modern Events Calendar Lite \< 5.16.5 - Authenticated Arbitrary File Upload leading to RCE (no CVSS, Modern Events Calendar Lite)
- [CVE-2021-24146](https://cve.now/CVE-2021-24146.md): Modern Events Calendar Lite \< 5.16.5 - Unauthenticated Events Export (no CVSS, Modern Events Calendar Lite)
- [CVE-2021-24147](https://cve.now/CVE-2021-24147.md): Modern Events Calendar Lite \< 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Modern Events Calendar Lite)
- [CVE-2021-24148](https://cve.now/CVE-2021-24148.md): MStore API \< 3.2.0 - Authentication Bypass With Sign In With Apple (no CVSS, MStore API)
- [CVE-2021-24149](https://cve.now/CVE-2021-24149.md): Modern Events Calendar Lite \< 5.16.6 - Authenticated SQL Injection (no CVSS, Modern Events Calendar Lite)
- [CVE-2021-24133](https://cve.now/CVE-2021-24133.md): ActiveCampaign \< 8.0.2 - Cross-Site Request Forgery in Settings (no CVSS, ActiveCampaign)
- [CVE-2021-24134](https://cve.now/CVE-2021-24134.md): Constant Contact Forms \< 1.8.8 - Multiple Authenticated Stored XSS (no CVSS, Constant Contact Forms)
- [CVE-2021-24135](https://cve.now/CVE-2021-24135.md): WP Customer Reviews \< 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS (no CVSS, WP Customer Reviews)
- [CVE-2021-24136](https://cve.now/CVE-2021-24136.md): Testimonials Widget \< 4.0.0 - Multiple Authenticated Stored XSS (no CVSS, Testimonials Widget)
- [CVE-2021-24137](https://cve.now/CVE-2021-24137.md): Blog2Social: Social Media Auto Post & Scheduler \< 6.3.1 - Authenticated SQL Injection (no CVSS, Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2021-24138](https://cve.now/CVE-2021-24138.md): AdRotate \< 5.8.4 - Authenticated SQL Injection (no CVSS, AdRotate)
- [CVE-2021-24139](https://cve.now/CVE-2021-24139.md): Photo Gallery by 10Web \< 1.5.55 - Unauthenticated SQL Injection (no CVSS, Photo Gallery by 10Web)
- [CVE-2021-24140](https://cve.now/CVE-2021-24140.md): Ajax Load More \< 5.3.2 - Authenticated SQL Injection (no CVSS, Ajax Load More)
- [CVE-2021-24141](https://cve.now/CVE-2021-24141.md): Advanced Database Cleaner \< 3.0.2 - Authenticated SQL injection (no CVSS, Advanced Database Cleaner)
- [CVE-2021-24124](https://cve.now/CVE-2021-24124.md): WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS) (no CVSS, WP Shieldon)
- [CVE-2021-24125](https://cve.now/CVE-2021-24125.md): Contact Form Submissions \< 1.7.1 - Authenticated SQL Injection (no CVSS, Contact Form Submissions)
- [CVE-2021-24126](https://cve.now/CVE-2021-24126.md): Envira Gallery Lite \< 1.8.3.3 - Authenticated Stored Cross-Site Scripting (no CVSS, Envira Gallery Lite)
- [CVE-2021-24127](https://cve.now/CVE-2021-24127.md): ThirstyAffiliates \< 3.9.3 - Authenticated Stored XSS (no CVSS, ThirstyAffiliates)
- [CVE-2021-24128](https://cve.now/CVE-2021-24128.md): Team Members \< 5.0.4 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Team Members)
- [CVE-2021-24129](https://cve.now/CVE-2021-24129.md): Themify Portfolio Post \< 1.1.6 - Authenticated Stored Cross-Site Scripting (no CVSS, Themify Portfolio Post)
- [CVE-2021-24130](https://cve.now/CVE-2021-24130.md): WP Google Map Plugin \< 4.1.5 - Authenticated SQL Injection (no CVSS, WP Google Map Plugin)
- [CVE-2021-24131](https://cve.now/CVE-2021-24131.md): Anti-Spam by CleanTalk \< 5.149 - Multiple Authenticated SQL Injections (no CVSS, Anti-Spam by CleanTalk)
- [CVE-2021-24132](https://cve.now/CVE-2021-24132.md): Slider by 10Web \< 1.2.36 - Multiple Authenticated SQL Injection (no CVSS, Slider by 10Web)
- [CVE-2021-24123](https://cve.now/CVE-2021-24123.md): PowerPress \< 8.3.8 - Authenticated Arbitrary File Upload leading to RCE (no CVSS, PowerPress)
- [CVE-2021-26935](https://cve.now/CVE-2021-26935.md): In WoWonder \< 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnera (no CVSS)
- [CVE-2021-27306](https://cve.now/CVE-2021-27306.md): An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authentic (no CVSS)
- [CVE-2021-28133](https://cve.now/CVE-2021-28133.md): Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attem (no CVSS)
- [CVE-2021-26237](https://cve.now/CVE-2021-26237.md): FastStone Image Viewer \<= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user opens or views a malfor (no CVSS)
- [CVE-2021-26235](https://cve.now/CVE-2021-26235.md): FastStone Image Viewer \<= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when a user opens or view (no CVSS)
- [CVE-2021-26234](https://cve.now/CVE-2021-26234.md): FastStone Image Viewer \<= 7.5 is affected by a user mode write access violation at 0x00402d8a, triggered when a user opens or views a malfor (no CVSS)
- [CVE-2021-26233](https://cve.now/CVE-2021-26233.md): FastStone Image Viewer \<= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfcb, triggered when a user opens or view (no CVSS)
- [CVE-2021-21626](https://cve.now/CVE-2021-21626.md): Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allow (no CVSS, Jenkins project Jenkins Warnings Next Generation Plugin · i…)
- [CVE-2021-21627](https://cve.now/CVE-2021-21627.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor dom (no CVSS, Jenkins project Jenkins Libvirt Agents Plugin · org.jenkins…)
- [CVE-2021-21625](https://cve.now/CVE-2021-21625.md): Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowin (no CVSS, Jenkins project Jenkins CloudBees AWS Credentials Plugin ·…)
- [CVE-2021-21624](https://cve.now/CVE-2021-21624.md): An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission (no CVSS, Jenkins project Jenkins Role-based Authorization Strategy P…)
- [CVE-2021-21623](https://cve.now/CVE-2021-21623.md): An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission o (no CVSS, Jenkins project Jenkins Matrix Authorization Strategy Plugi…)
- [CVE-2021-26236](https://cve.now/CVE-2021-26236.md): FastStone Image Viewer v.\<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BI (no CVSS)
- [CVE-2021-23359](https://cve.now/CVE-2021-23359.md): Arbitrary Command Injection (CVSS 7.5, port-killer)
- [CVE-2021-28420](https://cve.now/CVE-2021-28420.md): A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from\_time" parame (no CVSS)
- [CVE-2021-28419](https://cve.now/CVE-2021-28419.md): The "order\_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to r (no CVSS)
- [CVE-2021-28418](https://cve.now/CVE-2021-28418.md): A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" param (no CVSS)
- [CVE-2021-28417](https://cve.now/CVE-2021-28417.md): A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search\_name" par (no CVSS)
- [CVE-2021-22848](https://cve.now/CVE-2021-22848.md): HGiga MailSherlock - SQL Injection-2 (CVSS 7.0, HGiga MailSherlock MSR45/SSR45)
- [CVE-2021-3141](https://cve.now/CVE-2021-3141.md): In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attac (no CVSS)
- [CVE-2021-28681](https://cve.now/CVE-2021-28681.md): Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. (no CVSS, github.com/pion/webrtc/v3)
- [CVE-2021-28667](https://cve.now/CVE-2021-28667.md): StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. (no CVSS)
- [CVE-2021-20676](https://cve.now/CVE-2021-20676.md): M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3 (no CVSS, M-System Co. M-System DL8 series)
- [CVE-2021-20678](https://cve.now/CVE-2021-20678.md): SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary S (no CVSS, Stranger Studios Paid Memberships Pro)
- [CVE-2021-20675](https://cve.now/CVE-2021-20675.md): M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3 (no CVSS, M-System Co. M-System DL8 series)
- [CVE-2021-20634](https://cve.now/CVE-2021-20634.md): Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restri (no CVSS, Cybozu Office)
- [CVE-2021-20632](https://cve.now/CVE-2021-20632.md): Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access re (no CVSS, Cybozu Office)
- [CVE-2021-20633](https://cve.now/CVE-2021-20633.md): Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restricti (no CVSS, Cybozu Office)
- [CVE-2021-20631](https://cve.now/CVE-2021-20631.md): Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of C (no CVSS, Cybozu Office)
- [CVE-2021-20629](https://cve.now/CVE-2021-20629.md): Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via uns (no CVSS, Cybozu Office)
- [CVE-2021-20630](https://cve.now/CVE-2021-20630.md): Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access re (no CVSS, Cybozu Office)
- [CVE-2021-20628](https://cve.now/CVE-2021-20628.md): Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script v (no CVSS, Cybozu Office)
- [CVE-2021-20627](https://cve.now/CVE-2021-20627.md): Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script v (no CVSS, Cybozu Office)
- [CVE-2021-20625](https://cve.now/CVE-2021-20625.md): Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access (no CVSS, Cybozu Office)
- [CVE-2021-20626](https://cve.now/CVE-2021-20626.md): Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restrict (no CVSS, Cybozu Office)
- [CVE-2021-20624](https://cve.now/CVE-2021-20624.md): Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restr (no CVSS, Cybozu Office)
- [CVE-2020-27827](https://cve.now/CVE-2020-27827.md): A flaw was found in multiple versions of OpenvSwitch. (CVSS 7.5, lldp/openvswitch)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.