CVEs published March 23, 2021
66 CVEs were published on March 23, 2021: 11 critical, 25 high.
- Published
- 66
- Critical
- 11
- High
- 25
- Medium
- 10
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- TYPO3.CMS · typo3/cms-core +1
- 3
- TYPO3.CMS · typo3/cms-form +2
- 3
- omero-web
- 2
- QEMU
- 2
- TIBCO Software TIBCO Enterprise Message Service
- 2
- TIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1
- 2
- TIBCO Software TIBCO Rendezvous
- 2
- TYPO3.CMS · typo3/cms-backend +2
- 2
- copy-props
- 1
- GitHub Enterprise Server
- 1
Critical 11
- CVE-2021-23274TIBCO API Exchange Gateway Clickjack VulnerabilityTIBCO Software TIBCO API Exchange Gateway
- CVE-2021-29065NETGEAR RBR850 devices before 3.2.10.11 are affected by authentication bypass.
- CVE-2021-29066Certain NETGEAR devices are affected by authentication bypass.
- CVE-2021-29067Certain NETGEAR devices are affected by authentication bypass.
- CVE-2021-29071Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2021-29076Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2021-29077Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2021-29078Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2021-29079Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2021-29082Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2021-29068Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
High 25
- CVE-2021-21380Rating Script Service expose XWiki to SQL injectionxwiki-platform · org.xwiki.platform:xwiki-platform-ratings-…
- CVE-2021-28824TIBCO ActiveSpaces Windows Platform Installation vulnerabilityTIBCO Software TIBCO ActiveSpaces - Community Edition ·… +1
- CVE-2021-28823TIBCO eFTL Windows Platform Installation vulnerabilityTIBCO Software TIBCO eFTL - Community Edition · TIBCO So… +1
- CVE-2021-28822TIBCO Enterprise Message Service Windows Platform Artifact Search vulnerabilityTIBCO Software TIBCO Enterprise Message Service
- CVE-2021-28821TIBCO Enterprise Message Service Windows Platform Installation vulnerabilityTIBCO Software TIBCO Enterprise Message Service
- CVE-2021-28820TIBCO FTL Windows Platform Artifact Search vulnerabilityTIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1
- CVE-2021-28819TIBCO FTL Windows Platform Installation vulnerabilityTIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1
- CVE-2021-28818TIBCO Rendezvous Windows Platform Artifact Search vulnerabilityTIBCO Software TIBCO Rendezvous
- CVE-2021-28817TIBCO Rendezvous Windows Platform Installation vulnerabilityTIBCO Software TIBCO Rendezvous
- CVE-2021-21402Unauthenticated Arbitrary File Access in Jellyfinjellyfin
- CVE-2021-21401Invalid free() call in Nanopbnanopb
- CVE-2021-3444Linux kernel bpf verifier incorrect mod32 truncationLinux kernel
- CVE-2020-12483AppStore Remote Download and Installation Vulnerabilityvivo appstore
- CVE-2020-7346Privilege escalation in McAfee DLP Endpoint for WindowsMcAfee Data Loss Prevention (DLP) Endpoint for Windows
- CVE-2020-28503Prototype Pollutioncopy-props
- CVE-2021-29069Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2021-29070Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2021-29072Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2021-29073Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2021-29074Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2021-29075Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2021-29080Certain NETGEAR devices are affected by password reset by an unauthenticated attacker.
- CVE-2021-29081Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2021-21355Unrestricted File Upload in Form FrameworkTYPO3.CMS · typo3/cms-form +2
- CVE-2021-21357Broken Access Control in Form FrameworkTYPO3.CMS · typo3/cms-form +2
Medium, low and unrated 30
- CVE-2021-22864Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise ServerGitHub Enterprise Server
- CVE-2021-28099In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories wNetflix OSS Hollow · com.netflix.hollow:hollow
- CVE-2021-28100Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--.Netflix OSS Priam · com.netflix.priam:priam
- CVE-2019-19343A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4.Undertow
- CVE-2021-3409The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access QEMU
- CVE-2020-24994Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service
- CVE-2021-27908In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user Mautic · mautic/core
- CVE-2021-3392A use-after-free flaw was found in the MegaRAID emulator of QEMU.QEMU
- CVE-2021-20270An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standapython-pygments · pygments
- CVE-2021-20222A flaw was found in keycloak.keycloak · org.keycloak:keycloak-parent
- CVE-2021-20219A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel.kernel
- CVE-2021-23362Regular Expression Denial of Service (ReDoS)hosted-git-info
- CVE-2021-21377Open Redirect in OMERO.webomero-web
- CVE-2021-21376Information Exposure in OMERO.webomero-web
- CVE-2021-27309Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.
- CVE-2021-27310Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.
- CVE-2021-27969Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter.
- CVE-2021-27526A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter.
- CVE-2021-27527A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter.
- CVE-2021-27530A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.
- CVE-2021-27528A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter.
- CVE-2021-27531A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter.
- CVE-2021-27529A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter.
- CVE-2021-21359Denial of Service in Page Error HandlingTYPO3.CMS · typo3/cms-core +1
- CVE-2021-21370Cross-Site Scripting in Content Preview (CType menu)TYPO3.CMS · typo3/cms-backend +2
- CVE-2021-21339Cleartext storage of session identifierTYPO3.CMS · typo3/cms-core +1
- CVE-2021-21340Cross-Site Scripting in Content PreviewTYPO3.CMS · typo3/cms-backend +2
- CVE-2021-21358Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formTYPO3.CMS · typo3/cms-form +2
- CVE-2021-21338Open Redirection in Login HandlingTYPO3.CMS · typo3/cms-core +1
- CVE-2021-20227A flaw was found in SQLite's SELECT query functionality (src/select.c).sqlite