# CVEs published 2021-03-22

51 CVEs were published on March 22, 2021: 0 critical, 1 high. Days are UTC.

- [CVE-2021-21348](https://cve.now/CVE-2021-21348.md): XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) (CVSS 5.3, x-stream xstream · activemq +1)
- [CVE-2021-21349](https://cve.now/CVE-2021-21349.md): A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host (CVSS 6.1, x-stream xstream · activemq +1)
- [CVE-2021-21350](https://cve.now/CVE-2021-21350.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 5.3, x-stream xstream · activemq +1)
- [CVE-2021-21351](https://cve.now/CVE-2021-21351.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 5.4, x-stream xstream · activemq +1)
- [CVE-2021-21341](https://cve.now/CVE-2021-21341.md): XStream can cause a Denial of Service (CVSS 7.5, x-stream xstream · activemq +1)
- [CVE-2021-21342](https://cve.now/CVE-2021-21342.md): A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host (CVSS 5.3, x-stream xstream · activemq +1)
- [CVE-2021-21343](https://cve.now/CVE-2021-21343.md): XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights (CVSS 5.3, x-stream xstream · activemq +1)
- [CVE-2021-21344](https://cve.now/CVE-2021-21344.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 5.3, x-stream xstream · activemq +1)
- [CVE-2021-21345](https://cve.now/CVE-2021-21345.md): XStream is vulnerable to a Remote Command Execution attack (CVSS 5.8, x-stream xstream · activemq +1)
- [CVE-2021-21346](https://cve.now/CVE-2021-21346.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 6.1, x-stream xstream · activemq +1)
- [CVE-2021-21347](https://cve.now/CVE-2021-21347.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 6.1, x-stream xstream · activemq +1)
- [CVE-2021-25922](https://cve.now/CVE-2021-25922.md): In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. (no CVSS, openemr)
- [CVE-2021-25917](https://cve.now/CVE-2021-25917.md): In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and r (CVSS 4.8, openemr)
- [CVE-2021-25918](https://cve.now/CVE-2021-25918.md): In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and r (CVSS 4.8, openemr)
- [CVE-2021-25920](https://cve.now/CVE-2021-25920.md): In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user (CVSS 6.5, openemr)
- [CVE-2021-25921](https://cve.now/CVE-2021-25921.md): In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly i (CVSS 5.4, openemr)
- [CVE-2021-25919](https://cve.now/CVE-2021-25919.md): In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. (CVSS 4.8, openemr)
- [CVE-2021-22314](https://cve.now/CVE-2021-22314.md): There is a local privilege escalation vulnerability in some versions of ManageOne. (no CVSS, ManageOne)
- [CVE-2021-22321](https://cve.now/CVE-2021-22321.md): There is a use-after-free vulnerability in a Huawei product. (no CVSS, NIP6600;NIP6800;S12700;S1700;S2700;S5700;S6700;S7700;S9700;…)
- [CVE-2021-22311](https://cve.now/CVE-2021-22311.md): There is an improper permission assignment vulnerability in Huawei ManageOne product. (no CVSS, ManageOne)
- [CVE-2021-22320](https://cve.now/CVE-2021-22320.md): There is a denial of service vulnerability in Huawei products. (no CVSS, IPS Module;NGFW Module;NIP6600;NIP6800;Secospace USG6300;Se…)
- [CVE-2021-22310](https://cve.now/CVE-2021-22310.md): There is an information leakage vulnerability in some huawei products. (no CVSS, NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…)
- [CVE-2021-22309](https://cve.now/CVE-2021-22309.md): There is insecure algorithm vulnerability in Huawei products. (no CVSS, USG9500,USG9520,USG9560,USG9580)
- [CVE-2020-9213](https://cve.now/CVE-2020-9213.md): There is a denial of service vulnerability in some huawei products. (no CVSS, NGFW Module;NIP6300;NIP6600;NIP6800;Secospace USG6300;Secos…)
- [CVE-2020-9206](https://cve.now/CVE-2020-9206.md): The eUDC660 product has a resource management vulnerability. (no CVSS, eUDC660)
- [CVE-2020-9212](https://cve.now/CVE-2020-9212.md): There is a vulnerability in some version of USG9500 that the device improperly handles the information when a user logs in to device. (no CVSS, USG9500)
- [CVE-2021-25265](https://cve.now/CVE-2021-25265.md): A malicious website could execute code remotely in Sophos Connect Client before version 2.1. (no CVSS, Sophos Connect Client)
- [CVE-2021-26578](https://cve.now/CVE-2021-26578.md): A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5. (no CVSS, HPE Network Orchestrator)
- [CVE-2020-4882](https://cve.now/CVE-2020-4882.md): IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data (CVSS 6.1, IBM Planning Analytics)
- [CVE-2021-27594](https://cve.now/CVE-2021-27594.md): When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applicatio (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27596](https://cve.now/CVE-2021-27596.md): When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27595](https://cve.now/CVE-2021-27595.md): When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-27593](https://cve.now/CVE-2021-27593.md): When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, t (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-28971](https://cve.now/CVE-2021-28971.md): In intel\_pmu\_drain\_pebs\_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (s (no CVSS)
- [CVE-2021-28972](https://cve.now/CVE-2021-28972.md): In drivers/pci/hotplug/rpadlpar\_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow (no CVSS)
- [CVE-2021-28968](https://cve.now/CVE-2021-28968.md): An issue was discovered in PunBB before 1.4.6. (no CVSS)
- [CVE-2021-27308](https://cve.now/CVE-2021-27308.md): A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via (no CVSS)
- [CVE-2021-28148](https://cve.now/CVE-2021-28148.md): One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible (no CVSS)
- [CVE-2021-28147](https://cve.now/CVE-2021-28147.md): The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control iss (no CVSS)
- [CVE-2021-28146](https://cve.now/CVE-2021-28146.md): The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. (no CVSS)
- [CVE-2021-27962](https://cve.now/CVE-2021-27962.md): Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a (no CVSS)
- [CVE-2020-28501](https://cve.now/CVE-2020-28501.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, es6-crawler-detect)
- [CVE-2021-26295](https://cve.now/CVE-2021-26295.md): RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2021-21438](https://cve.now/CVE-2021-21438.md): FAQ articles are shown to users without permission (CVSS 3.5, OTRS AG FAQ · OTRS AG OTRS)
- [CVE-2021-21437](https://cve.now/CVE-2021-21437.md): Config Items are shown to users without permission (CVSS 3.5, OTRS AG OTRSCIsInCustomerFrontend · OTRS AG ITSMConfigurati…)
- [CVE-2021-28964](https://cve.now/CVE-2021-28964.md): A race condition was discovered in get\_old\_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. (no CVSS)
- [CVE-2021-28963](https://cve.now/CVE-2021-28963.md): Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. (no CVSS)
- [CVE-2021-28955](https://cve.now/CVE-2021-28955.md): git-bug before 0.7.2 has an Uncontrolled Search Path Element. (no CVSS, github.com/MichaelMure/git-bug)
- [CVE-2021-28956](https://cve.now/CVE-2021-28956.md): The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binarie (no CVSS)
- [CVE-2021-26069](https://cve.now/CVE-2021-26069.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-26070](https://cve.now/CVE-2021-26070.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked reso (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.