CVEs published March 22, 2021
51 CVEs were published on March 22, 2021: 0 critical, 1 high.
- Published
- 51
- Critical
- 0
- High
- 1
- Medium
- 21
- Low
- 2
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- x-stream xstream · activemq +1
- 11
- openemr
- 6
- SAP SE SAP 3D Visual Enterprise Viewer
- 4
- Atlassian Jira Server · Atlassian Jira Data Center
- 2
- ManageOne
- 2
- Apache Software Foundation Apache OFBiz
- 1
- es6-crawler-detect
- 1
- eUDC660
- 1
- github.com/MichaelMure/git-bug
- 1
- HPE Network Orchestrator
- 1
High 1
Medium, low and unrated 50
- CVE-2021-21348XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)x-stream xstream · activemq +1
- CVE-2021-21349A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostx-stream xstream · activemq +1
- CVE-2021-21350XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2021-21351XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2021-21342A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostx-stream xstream · activemq +1
- CVE-2021-21343XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsx-stream xstream · activemq +1
- CVE-2021-21344XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2021-21345XStream is vulnerable to a Remote Command Execution attackx-stream xstream · activemq +1
- CVE-2021-21346XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2021-21347XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · activemq +1
- CVE-2021-25922In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly.openemr
- CVE-2021-25917In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and ropenemr
- CVE-2021-25918In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and ropenemr
- CVE-2021-25920In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious useropenemr
- CVE-2021-25921In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly iopenemr
- CVE-2021-25919In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly.openemr
- CVE-2021-22314There is a local privilege escalation vulnerability in some versions of ManageOne.ManageOne
- CVE-2021-22321There is a use-after-free vulnerability in a Huawei product.NIP6600;NIP6800;S12700;S1700;S2700;S5700;S6700;S7700;S9700;…
- CVE-2021-22311There is an improper permission assignment vulnerability in Huawei ManageOne product.ManageOne
- CVE-2021-22320There is a denial of service vulnerability in Huawei products.IPS Module;NGFW Module;NIP6600;NIP6800;Secospace USG6300;Se…
- CVE-2021-22310There is an information leakage vulnerability in some huawei products.NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…
- CVE-2021-22309There is insecure algorithm vulnerability in Huawei products.USG9500,USG9520,USG9560,USG9580
- CVE-2020-9213There is a denial of service vulnerability in some huawei products.NGFW Module;NIP6300;NIP6600;NIP6800;Secospace USG6300;Secos…
- CVE-2020-9206The eUDC660 product has a resource management vulnerability.eUDC660
- CVE-2020-9212There is a vulnerability in some version of USG9500 that the device improperly handles the information when a user logs in to device.USG9500
- CVE-2021-25265A malicious website could execute code remotely in Sophos Connect Client before version 2.1.Sophos Connect Client
- CVE-2021-26578A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5.HPE Network Orchestrator
- CVE-2020-4882IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data IBM Planning Analytics
- CVE-2021-27594When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applicatioSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27596When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer,SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27595When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-27593When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, tSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-28971In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (s
- CVE-2021-28972In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow
- CVE-2021-28968An issue was discovered in PunBB before 1.4.6.
- CVE-2021-27308A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via
- CVE-2021-28148One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible
- CVE-2021-28147The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control iss
- CVE-2021-28146The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue.
- CVE-2021-27962Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a
- CVE-2020-28501Regular Expression Denial of Service (ReDoS)es6-crawler-detect
- CVE-2021-26295RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMIApache Software Foundation Apache OFBiz
- CVE-2021-21438FAQ articles are shown to users without permissionOTRS AG FAQ · OTRS AG OTRS
- CVE-2021-21437Config Items are shown to users without permissionOTRS AG OTRSCIsInCustomerFrontend · OTRS AG ITSMConfigurati…
- CVE-2021-28964A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8.
- CVE-2021-28963Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.
- CVE-2021-28955git-bug before 0.7.2 has an Uncontrolled Search Path Element.github.com/MichaelMure/git-bug
- CVE-2021-28956The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binarie
- CVE-2021-26069Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-26070Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resoAtlassian Jira Server · Atlassian Jira Data Center