# CVEs published 2021-03-19

42 CVEs were published on March 19, 2021: 0 critical, 3 high. Days are UTC.

- [CVE-2019-10200](https://cve.now/CVE-2019-10200.md): A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedul (no CVSS, OpenShift Container Platform)
- [CVE-2021-21267](https://cve.now/CVE-2021-21267.md): Regular Expression Denial-of-Service in npm schema-inspector (CVSS 7.5, schema-inspector)
- [CVE-2019-14831](https://cve.now/CVE-2019-14831.md): A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link co (no CVSS, Moodle)
- [CVE-2019-14830](https://cve.now/CVE-2019-14830.md): A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpo (no CVSS, Moodle)
- [CVE-2019-14829](https://cve.now/CVE-2019-14829.md): A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creat (no CVSS, Moodle)
- [CVE-2019-14828](https://cve.now/CVE-2019-14828.md): A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with th (no CVSS, Moodle)
- [CVE-2019-10225](https://cve.now/CVE-2019-10225.md): A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently pr (no CVSS, atomic-openshift)
- [CVE-2019-10196](https://cve.now/CVE-2019-10196.md): A flaw was found in http-proxy-agent, prior to version 2.1.0. (no CVSS, nodejs-http-proxy-agent · http-proxy-agent)
- [CVE-2019-10128](https://cve.now/CVE-2019-10128.md): A vulnerability was found in postgresql versions 11.x prior to 11.3. (no CVSS, postgresql)
- [CVE-2021-27519](https://cve.now/CVE-2021-27519.md): A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter. (no CVSS)
- [CVE-2021-27520](https://cve.now/CVE-2021-27520.md): A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter. (no CVSS)
- [CVE-2019-10127](https://cve.now/CVE-2019-10127.md): A vulnerability was found in postgresql versions 11.x prior to 11.3. (no CVSS, postgresql)
- [CVE-2021-20077](https://cve.now/CVE-2021-20077.md): Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial l (no CVSS, Tenable Nessus Agent)
- [CVE-2021-26990](https://cve.now/CVE-2021-26990.md): Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system fi (no CVSS, Cloud Manager)
- [CVE-2021-26992](https://cve.now/CVE-2021-26992.md): Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (D (no CVSS, Cloud Manager)
- [CVE-2021-26991](https://cve.now/CVE-2021-26991.md): Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to (no CVSS, Cloud Manager)
- [CVE-2021-25278](https://cve.now/CVE-2021-25278.md): FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor. (no CVSS)
- [CVE-2021-25277](https://cve.now/CVE-2021-25277.md): FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component. (no CVSS)
- [CVE-2021-27906](https://cve.now/CVE-2021-27906.md): A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file (no CVSS, Apache Software Foundation Apache PDFBox · org.apache.pdfbo…)
- [CVE-2021-27807](https://cve.now/CVE-2021-27807.md): A carefully crafted PDF file can trigger an infinite loop while loading the file (no CVSS, Apache Software Foundation Apache PDFBox · org.apache.pdfbo…)
- [CVE-2021-21390](https://cve.now/CVE-2021-21390.md): MITM modification of request bodies in MinIO (CVSS 6.5, minio)
- [CVE-2021-21387](https://cve.now/CVE-2021-21387.md): Partial secret key disclosure, improper safety number calculation, & inadequate encryption strength (CVSS 8.1, parabirb wrongthink)
- [CVE-2020-4635](https://cve.now/CVE-2020-4635.md): IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames. (CVSS 3.7, IBM Resilient)
- [CVE-2021-27506](https://cve.now/CVE-2021-27506.md): The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing (no CVSS)
- [CVE-2021-28834](https://cve.now/CVE-2021-28834.md): Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. (no CVSS, kramdown)
- [CVE-2021-28090](https://cve.now/CVE-2021-28090.md): Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002. (no CVSS)
- [CVE-2021-28089](https://cve.now/CVE-2021-28089.md): Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001. (no CVSS)
- [CVE-2020-25097](https://cve.now/CVE-2020-25097.md): An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. (no CVSS)
- [CVE-2021-28831](https://cve.now/CVE-2021-28831.md): decompress\_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft\_build result pointer, with a resultant invalid free or se (CVSS 7.5)
- [CVE-2021-25293](https://cve.now/CVE-2021-25293.md): An issue was discovered in Pillow before 8.1.1. (no CVSS, pillow)
- [CVE-2021-25292](https://cve.now/CVE-2021-25292.md): An issue was discovered in Pillow before 8.1.1. (no CVSS, pillow)
- [CVE-2021-25291](https://cve.now/CVE-2021-25291.md): An issue was discovered in Pillow before 8.1.1. (no CVSS, pillow)
- [CVE-2021-25290](https://cve.now/CVE-2021-25290.md): An issue was discovered in Pillow before 8.1.1. (no CVSS, pillow)
- [CVE-2021-25289](https://cve.now/CVE-2021-25289.md): An issue was discovered in Pillow before 8.1.1. (no CVSS, pillow)
- [CVE-2020-6578](https://cve.now/CVE-2020-6578.md): Zen Cart 1.5.6d allows reflected XSS via the main\_page parameter to includes/templates/template\_default/common/tpl\_main\_page.php or includes (no CVSS, zencart/zencart)
- [CVE-2020-6577](https://cve.now/CVE-2020-6577.md): The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German edition) allows itrk-api.php rechtstext\_language SQL Injection. (no CVSS)
- [CVE-2021-28126](https://cve.now/CVE-2021-28126.md): index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability (no CVSS)
- [CVE-2021-28110](https://cve.now/CVE-2021-28110.md): /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser. (no CVSS)
- [CVE-2021-28109](https://cve.now/CVE-2021-28109.md): TranzWare (POI) FIMI before 4.2.20.4.2 allows login\_tw.php reflected Cross-Site Scripting (XSS). (no CVSS)
- [CVE-2021-3327](https://cve.now/CVE-2021-3327.md): Ovation Dynamic Content 1.10.1 for Elementor allows XSS via the post\_title parameter. (no CVSS)
- [CVE-2021-27928](https://cve.now/CVE-2021-27928.md): A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5. (no CVSS)
- [CVE-2021-27221](https://cve.now/CVE-2021-27221.md): MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.