CVEs published March 19, 2021
42 CVEs were published on March 19, 2021: 0 critical, 3 high.
- Published
- 42
- Critical
- 0
- High
- 3
- Medium
- 1
- Low
- 1
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- pillow
- 5
- Moodle
- 4
- Cloud Manager
- 3
- Apache Software Foundation Apache PDFBox · org.apache.pdfbo…
- 2
- postgresql
- 2
- atomic-openshift
- 1
- IBM Resilient
- 1
- kramdown
- 1
- minio
- 1
- nodejs-http-proxy-agent · http-proxy-agent
- 1
High 3
- CVE-2021-21267Regular Expression Denial-of-Service in npm schema-inspectorschema-inspector
- CVE-2021-21387Partial secret key disclosure, improper safety number calculation, & inadequate encryption strengthparabirb wrongthink
- CVE-2021-28831decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or se
Medium, low and unrated 39
- CVE-2019-10200A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedulOpenShift Container Platform
- CVE-2019-14831A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link coMoodle
- CVE-2019-14830A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoMoodle
- CVE-2019-14829A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creatMoodle
- CVE-2019-14828A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with thMoodle
- CVE-2019-10225A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently pratomic-openshift
- CVE-2019-10196A flaw was found in http-proxy-agent, prior to version 2.1.0.nodejs-http-proxy-agent · http-proxy-agent
- CVE-2019-10128A vulnerability was found in postgresql versions 11.x prior to 11.3.postgresql
- CVE-2021-27519A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.
- CVE-2021-27520A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.
- CVE-2019-10127A vulnerability was found in postgresql versions 11.x prior to 11.3.postgresql
- CVE-2021-20077Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial lTenable Nessus Agent
- CVE-2021-26990Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system fiCloud Manager
- CVE-2021-26992Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DCloud Manager
- CVE-2021-26991Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker toCloud Manager
- CVE-2021-25278FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.
- CVE-2021-25277FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.
- CVE-2021-27906A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the fileApache Software Foundation Apache PDFBox · org.apache.pdfbo…
- CVE-2021-27807A carefully crafted PDF file can trigger an infinite loop while loading the fileApache Software Foundation Apache PDFBox · org.apache.pdfbo…
- CVE-2021-21390MITM modification of request bodies in MinIOminio
- CVE-2020-4635IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames.IBM Resilient
- CVE-2021-27506The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing
- CVE-2021-28834Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.kramdown
- CVE-2021-28090Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
- CVE-2021-28089Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.
- CVE-2020-25097An issue was discovered in Squid through 4.13 and 5.x through 5.0.4.
- CVE-2021-25293An issue was discovered in Pillow before 8.1.1.pillow
- CVE-2021-25292An issue was discovered in Pillow before 8.1.1.pillow
- CVE-2021-25291An issue was discovered in Pillow before 8.1.1.pillow
- CVE-2021-25290An issue was discovered in Pillow before 8.1.1.pillow
- CVE-2021-25289An issue was discovered in Pillow before 8.1.1.pillow
- CVE-2020-6578Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includeszencart/zencart
- CVE-2020-6577The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German edition) allows itrk-api.php rechtstext_language SQL Injection.
- CVE-2021-28126index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability
- CVE-2021-28110/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
- CVE-2021-28109TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
- CVE-2021-3327Ovation Dynamic Content 1.10.1 for Elementor allows XSS via the post_title parameter.
- CVE-2021-27928A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.
- CVE-2021-27221MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command.