# CVEs published 2021-03-23

66 CVEs were published on March 23, 2021: 11 critical, 25 high. Days are UTC.

- [CVE-2021-21380](https://cve.now/CVE-2021-21380.md): Rating Script Service expose XWiki to SQL injection (CVSS 7.7, xwiki-platform · org.xwiki.platform:xwiki-platform-ratings-…)
- [CVE-2021-22864](https://cve.now/CVE-2021-22864.md): Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server (no CVSS, GitHub Enterprise Server)
- [CVE-2021-28099](https://cve.now/CVE-2021-28099.md): In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories w (no CVSS, Netflix OSS Hollow · com.netflix.hollow:hollow)
- [CVE-2021-28100](https://cve.now/CVE-2021-28100.md): Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. (no CVSS, Netflix OSS Priam · com.netflix.priam:priam)
- [CVE-2019-19343](https://cve.now/CVE-2019-19343.md): A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. (no CVSS, Undertow)
- [CVE-2021-3409](https://cve.now/CVE-2021-3409.md): The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access (no CVSS, QEMU)
- [CVE-2021-28824](https://cve.now/CVE-2021-28824.md): TIBCO ActiveSpaces Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO ActiveSpaces - Community Edition ·… +1)
- [CVE-2021-28823](https://cve.now/CVE-2021-28823.md): TIBCO eFTL Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO eFTL - Community Edition · TIBCO So… +1)
- [CVE-2021-28822](https://cve.now/CVE-2021-28822.md): TIBCO Enterprise Message Service Windows Platform Artifact Search vulnerability (CVSS 8.8, TIBCO Software TIBCO Enterprise Message Service)
- [CVE-2021-28821](https://cve.now/CVE-2021-28821.md): TIBCO Enterprise Message Service Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO Enterprise Message Service)
- [CVE-2021-28820](https://cve.now/CVE-2021-28820.md): TIBCO FTL Windows Platform Artifact Search vulnerability (CVSS 8.8, TIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1)
- [CVE-2021-28819](https://cve.now/CVE-2021-28819.md): TIBCO FTL Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1)
- [CVE-2021-28818](https://cve.now/CVE-2021-28818.md): TIBCO Rendezvous Windows Platform Artifact Search vulnerability (CVSS 8.8, TIBCO Software TIBCO Rendezvous)
- [CVE-2021-28817](https://cve.now/CVE-2021-28817.md): TIBCO Rendezvous Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO Rendezvous)
- [CVE-2021-21402](https://cve.now/CVE-2021-21402.md): Unauthenticated Arbitrary File Access in Jellyfin (CVSS 7.7, jellyfin)
- [CVE-2020-24994](https://cve.now/CVE-2020-24994.md): Stack overflow in the parse\_tag function in libass/ass\_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2021-27908](https://cve.now/CVE-2021-27908.md): In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user (CVSS 5.8, Mautic · mautic/core)
- [CVE-2021-3392](https://cve.now/CVE-2021-3392.md): A use-after-free flaw was found in the MegaRAID emulator of QEMU. (no CVSS, QEMU)
- [CVE-2021-21401](https://cve.now/CVE-2021-21401.md): Invalid free() call in Nanopb (CVSS 7.1, nanopb)
- [CVE-2021-3444](https://cve.now/CVE-2021-3444.md): Linux kernel bpf verifier incorrect mod32 truncation (CVSS 7.8, Linux kernel)
- [CVE-2021-23274](https://cve.now/CVE-2021-23274.md): TIBCO API Exchange Gateway Clickjack Vulnerability (CVSS 9.8, TIBCO Software TIBCO API Exchange Gateway)
- [CVE-2021-20270](https://cve.now/CVE-2021-20270.md): An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standa (no CVSS, python-pygments · pygments)
- [CVE-2021-20222](https://cve.now/CVE-2021-20222.md): A flaw was found in keycloak. (no CVSS, keycloak · org.keycloak:keycloak-parent)
- [CVE-2021-20219](https://cve.now/CVE-2021-20219.md): A denial of service vulnerability was found in n\_tty\_receive\_char\_special in drivers/tty/n\_tty.c of the Linux kernel. (no CVSS, kernel)
- [CVE-2021-23362](https://cve.now/CVE-2021-23362.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, hosted-git-info)
- [CVE-2020-12483](https://cve.now/CVE-2020-12483.md): AppStore Remote Download and Installation Vulnerability (CVSS 8.2, vivo appstore)
- [CVE-2020-7346](https://cve.now/CVE-2020-7346.md): Privilege escalation in McAfee DLP Endpoint for Windows (CVSS 7.8, McAfee Data Loss Prevention (DLP) Endpoint for Windows)
- [CVE-2021-21377](https://cve.now/CVE-2021-21377.md): Open Redirect in OMERO.web (CVSS 4.8, omero-web)
- [CVE-2021-21376](https://cve.now/CVE-2021-21376.md): Information Exposure in OMERO.web (CVSS 6.4, omero-web)
- [CVE-2021-27309](https://cve.now/CVE-2021-27309.md): Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter. (no CVSS)
- [CVE-2021-27310](https://cve.now/CVE-2021-27310.md): Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter. (no CVSS)
- [CVE-2021-27969](https://cve.now/CVE-2021-27969.md): Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter. (no CVSS)
- [CVE-2021-27526](https://cve.now/CVE-2021-27526.md): A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter. (no CVSS)
- [CVE-2021-27527](https://cve.now/CVE-2021-27527.md): A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter. (no CVSS)
- [CVE-2021-27530](https://cve.now/CVE-2021-27530.md): A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php. (no CVSS)
- [CVE-2021-27528](https://cve.now/CVE-2021-27528.md): A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter. (no CVSS)
- [CVE-2021-27531](https://cve.now/CVE-2021-27531.md): A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter. (no CVSS)
- [CVE-2021-27529](https://cve.now/CVE-2021-27529.md): A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter. (no CVSS)
- [CVE-2020-28503](https://cve.now/CVE-2020-28503.md): Prototype Pollution (CVSS 7.3, copy-props)
- [CVE-2021-29065](https://cve.now/CVE-2021-29065.md): NETGEAR RBR850 devices before 3.2.10.11 are affected by authentication bypass. (CVSS 9.6)
- [CVE-2021-29066](https://cve.now/CVE-2021-29066.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 9.6)
- [CVE-2021-29067](https://cve.now/CVE-2021-29067.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 9.6)
- [CVE-2021-29069](https://cve.now/CVE-2021-29069.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 7.3)
- [CVE-2021-29070](https://cve.now/CVE-2021-29070.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 8.4)
- [CVE-2021-29071](https://cve.now/CVE-2021-29071.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 9.6)
- [CVE-2021-29072](https://cve.now/CVE-2021-29072.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 8.4)
- [CVE-2021-29073](https://cve.now/CVE-2021-29073.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 7.6)
- [CVE-2021-29074](https://cve.now/CVE-2021-29074.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 8.4)
- [CVE-2021-29075](https://cve.now/CVE-2021-29075.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 8.4)
- [CVE-2021-29076](https://cve.now/CVE-2021-29076.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 9.6)
- [CVE-2021-29077](https://cve.now/CVE-2021-29077.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 9.6)
- [CVE-2021-29078](https://cve.now/CVE-2021-29078.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 9.6)
- [CVE-2021-29079](https://cve.now/CVE-2021-29079.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 9.6)
- [CVE-2021-29080](https://cve.now/CVE-2021-29080.md): Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. (CVSS 8.1)
- [CVE-2021-29081](https://cve.now/CVE-2021-29081.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.4)
- [CVE-2021-29082](https://cve.now/CVE-2021-29082.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 9.6)
- [CVE-2021-29068](https://cve.now/CVE-2021-29068.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 9.9)
- [CVE-2021-21359](https://cve.now/CVE-2021-21359.md): Denial of Service in Page Error Handling (CVSS 5.9, TYPO3.CMS · typo3/cms-core +1)
- [CVE-2021-21370](https://cve.now/CVE-2021-21370.md): Cross-Site Scripting in Content Preview (CType menu) (CVSS 5.4, TYPO3.CMS · typo3/cms-backend +2)
- [CVE-2021-21339](https://cve.now/CVE-2021-21339.md): Cleartext storage of session identifier (CVSS 5.9, TYPO3.CMS · typo3/cms-core +1)
- [CVE-2021-21340](https://cve.now/CVE-2021-21340.md): Cross-Site Scripting in Content Preview (CVSS 5.4, TYPO3.CMS · typo3/cms-backend +2)
- [CVE-2021-21355](https://cve.now/CVE-2021-21355.md): Unrestricted File Upload in Form Framework (CVSS 8.6, TYPO3.CMS · typo3/cms-form +2)
- [CVE-2021-21357](https://cve.now/CVE-2021-21357.md): Broken Access Control in Form Framework (CVSS 8.3, TYPO3.CMS · typo3/cms-form +2)
- [CVE-2021-21358](https://cve.now/CVE-2021-21358.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form (CVSS 5.4, TYPO3.CMS · typo3/cms-form +2)
- [CVE-2021-21338](https://cve.now/CVE-2021-21338.md): Open Redirection in Login Handling (CVSS 4.7, TYPO3.CMS · typo3/cms-core +1)
- [CVE-2021-20227](https://cve.now/CVE-2021-20227.md): A flaw was found in SQLite's SELECT query functionality (src/select.c). (no CVSS, sqlite)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.