# CVEs published 2021-03-24

86 CVEs were published on March 24, 2021: 8 critical, 17 high. Days are UTC.

- [CVE-2020-7852](https://cve.now/CVE-2020-7852.md): DaviewIndy Heap Overflow Vulnerabilities (CVSS 7.8, HumanTalk DaviewIndy)
- [CVE-2020-7853](https://cve.now/CVE-2020-7853.md): TOBESOFT XPLATFORM Out-of-Bounds Read/Write Vulnerabilities (CVSS 5.5, Tobesoft Xplatform)
- [CVE-2021-21386](https://cve.now/CVE-2021-21386.md): Improper Neutralization of Argument Delimiters in a Decompiling Package Process (CVSS 9.3, dwisiswant0 apkleaks · apkleaks)
- [CVE-2021-21385](https://cve.now/CVE-2021-21385.md): Disabled hostname verification and accepting self-signed certificates (CVSS 8.8, openMF mifos-mobile)
- [CVE-2020-26283](https://cve.now/CVE-2020-26283.md): Control character injection in console output (CVSS 6.8, go-ipfs · github.com/ipfs/go-ipfs)
- [CVE-2021-1423](https://cve.now/CVE-2021-1423.md): Cisco Aironet Access Points Arbitrary File Overwrite Vulnerability (CVSS 4.4, Cisco Aironet Access Point Software)
- [CVE-2021-1418](https://cve.now/CVE-2021-1418.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2021-1417](https://cve.now/CVE-2021-1417.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2021-1411](https://cve.now/CVE-2021-1411.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2021-1381](https://cve.now/CVE-2021-1381.md): Cisco IOS XE Software Active Debug Code Vulnerability (CVSS 6.1, Cisco IOS XE Software)
- [CVE-2020-26279](https://cve.now/CVE-2020-26279.md): Path traversal (CVSS 7.7, go-ipfs · github.com/ipfs/go-ipfs)
- [CVE-2021-1220](https://cve.now/CVE-2021-1220.md): Cisco IOS XE Software Web UI Denial of Service Vulnerabilities (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2021-1281](https://cve.now/CVE-2021-1281.md): Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability (CVSS 5.1, Cisco IOS XE Software)
- [CVE-2021-1352](https://cve.now/CVE-2021-1352.md): Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2021-1356](https://cve.now/CVE-2021-1356.md): Cisco IOS XE Software Web UI Denial of Service Vulnerabilities (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2021-1371](https://cve.now/CVE-2021-1371.md): Cisco IOS XE SD-WAN Software Console Privilege Escalation Vulnerability (CVSS 6.6, Cisco IOS XE Software)
- [CVE-2021-1373](https://cve.now/CVE-2021-1373.md): Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-1374](https://cve.now/CVE-2021-1374.md): Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco IOS XE Software)
- [CVE-2021-1375](https://cve.now/CVE-2021-1375.md): Cisco IOS XE Software Fast Reload Vulnerabilities (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2021-1376](https://cve.now/CVE-2021-1376.md): Cisco IOS XE Software Fast Reload Vulnerabilities (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2021-1377](https://cve.now/CVE-2021-1377.md): Cisco IOS and IOS XE Software ARP Resource Management Exhaustion Denial of Service Vulnerability (CVSS 5.8, Cisco IOS)
- [CVE-2021-1382](https://cve.now/CVE-2021-1382.md): Cisco IOS XE SD-WAN Software Command Injection Vulnerability (CVSS 6.0, Cisco IOS XE Software)
- [CVE-2021-1383](https://cve.now/CVE-2021-1383.md): Cisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities (CVSS 6.0, Cisco IOS XE Software)
- [CVE-2021-1384](https://cve.now/CVE-2021-1384.md): Cisco IOx for IOS XE Software Command Injection Vulnerability (CVSS 6.5, Cisco IOS XE Software)
- [CVE-2021-1385](https://cve.now/CVE-2021-1385.md): Cisco IOx Application Environment Path Traversal Vulnerability (CVSS 6.5, Cisco IOS)
- [CVE-2021-1390](https://cve.now/CVE-2021-1390.md): Cisco IOS XE Software Local Privilege Escalation Vulnerability (CVSS 5.1, Cisco IOS XE Software)
- [CVE-2021-1391](https://cve.now/CVE-2021-1391.md): Cisco IOS and IOS XE Software Privilege Escalation Vulnerability (CVSS 5.1, Cisco IOS)
- [CVE-2021-1392](https://cve.now/CVE-2021-1392.md): Cisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability (CVSS 7.8, Cisco IOS)
- [CVE-2021-1394](https://cve.now/CVE-2021-1394.md): Cisco IOS XE Software for Network Convergence System 520 Routers Denial of Service Vulnerability (CVSS 5.3, Cisco IOS XE Software)
- [CVE-2021-1398](https://cve.now/CVE-2021-1398.md): Cisco IOS XE Software Arbitrary Code Execution Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2021-1403](https://cve.now/CVE-2021-1403.md): Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2021-1471](https://cve.now/CVE-2021-1471.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2021-1469](https://cve.now/CVE-2021-1469.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2021-1460](https://cve.now/CVE-2021-1460.md): Cisco IOx Application Framework Denial of Service Vulnerability (CVSS 5.3, Cisco IOS)
- [CVE-2021-1454](https://cve.now/CVE-2021-1454.md): Cisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities (CVSS 6.0, Cisco IOS XE Software)
- [CVE-2021-1453](https://cve.now/CVE-2021-1453.md): Cisco IOS XE Software for the Catalyst 9000 Family Arbitrary Code Execution Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2021-1452](https://cve.now/CVE-2021-1452.md): Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability (CVSS 6.8, Cisco IOS XE ROMMON Software)
- [CVE-2021-1451](https://cve.now/CVE-2021-1451.md): Cisco IOS XE Software Easy Virtual Switching System Arbitrary Code Execution Vulnerability (CVSS 8.1, Cisco IOS XE Software)
- [CVE-2021-1449](https://cve.now/CVE-2021-1449.md): Cisco Access Point Software Arbitrary Code Execution Vulnerability (CVSS 6.7, Cisco Aironet Access Point Software)
- [CVE-2021-1446](https://cve.now/CVE-2021-1446.md): Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-1443](https://cve.now/CVE-2021-1443.md): Cisco IOS XE Software Web UI OS Command Injection Vulnerability (CVSS 5.5, Cisco IOS XE Software)
- [CVE-2021-1441](https://cve.now/CVE-2021-1441.md): Cisco IOS XE Software Hardware Initialization Routines Arbitrary Code Execution Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2021-1442](https://cve.now/CVE-2021-1442.md): Cisco IOS XE Software Plug-and-Play Privilege Escalation Vulnerability (CVSS 7.0, Cisco IOS XE Software)
- [CVE-2021-1439](https://cve.now/CVE-2021-1439.md): Cisco Aironet Access Points FlexConnect Multicast DNS Denial of Service Vulnerability (CVSS 7.4, Cisco Aironet Access Point Software)
- [CVE-2021-1437](https://cve.now/CVE-2021-1437.md): Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability (CVSS 7.5, Cisco Aironet Access Point Software)
- [CVE-2021-1436](https://cve.now/CVE-2021-1436.md): Cisco IOS XE SD-WAN Software Path Traversal Vulnerability (CVSS 4.4, Cisco IOS XE Software)
- [CVE-2021-1435](https://cve.now/CVE-2021-1435.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 6.6, Cisco IOS XE Software)
- [CVE-2021-1434](https://cve.now/CVE-2021-1434.md): Cisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability (CVSS 4.4, Cisco IOS XE Software)
- [CVE-2021-1433](https://cve.now/CVE-2021-1433.md): Cisco IOS XE SD-WAN Software vDaemon Buffer Overflow Vulnerability (CVSS 8.1, Cisco IOS XE Software)
- [CVE-2021-1432](https://cve.now/CVE-2021-1432.md): Cisco IOS XE SD-WAN Software Arbitrary Command Execution Vulnerability (CVSS 7.3, Cisco IOS XE Software)
- [CVE-2021-1431](https://cve.now/CVE-2021-1431.md): Cisco IOS XE SD-WAN Software vDaemon Denial of Service Vulnerability (CVSS 7.5, Cisco IOS XE Software)
- [CVE-2021-22169](https://cve.now/CVE-2021-22169.md): An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages. (CVSS 4.3, GitLab)
- [CVE-2021-22178](https://cve.now/CVE-2021-22178.md): An issue has been discovered in GitLab affecting all versions starting from 13.2. (CVSS 5.0, GitLab)
- [CVE-2021-22193](https://cve.now/CVE-2021-22193.md): An issue has been discovered in GitLab affecting all versions starting with 7.1. (CVSS 3.5, GitLab)
- [CVE-2020-15809](https://cve.now/CVE-2020-15809.md): spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. (no CVSS)
- [CVE-2021-22179](https://cve.now/CVE-2021-22179.md): A vulnerability was discovered in GitLab versions before 12.2. (CVSS 5.4, GitLab)
- [CVE-2021-22176](https://cve.now/CVE-2021-22176.md): An issue has been discovered in GitLab affecting all versions starting with 3.0.1. (CVSS 4.3, GitLab)
- [CVE-2021-22186](https://cve.now/CVE-2021-22186.md): An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restric (CVSS 4.9, GitLab)
- [CVE-2021-22185](https://cve.now/CVE-2021-22185.md): Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerabi (CVSS 5.4, GitLab)
- [CVE-2021-22192](https://cve.now/CVE-2021-22192.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute (CVSS 9.9, GitLab)
- [CVE-2020-7839](https://cve.now/CVE-2020-7839.md): MarkAny MaEPSBroker Command Injection Vulnerability (CVSS 8.8, MarkAny MaEPSBroker)
- [CVE-2019-19354](https://cve.now/CVE-2019-19354.md): An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. (no CVSS, operator-framework/hadoop)
- [CVE-2019-19353](https://cve.now/CVE-2019-19353.md): An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. (no CVSS, operator-framework/hive)
- [CVE-2019-19352](https://cve.now/CVE-2019-19352.md): An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. (no CVSS, operator-framework/presto)
- [CVE-2020-35337](https://cve.now/CVE-2020-35337.md): ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows (no CVSS)
- [CVE-2019-19350](https://cve.now/CVE-2019-19350.md): An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Opens (no CVSS, openshift/ansible-service-broker)
- [CVE-2019-19349](https://cve.now/CVE-2019-19349.md): An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in (no CVSS, operator-framework/operator-metering)
- [CVE-2020-36283](https://cve.now/CVE-2020-36283.md): HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). (CVSS 9.6)
- [CVE-2021-29002](https://cve.now/CVE-2021-29002.md): A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site\_title" parameter (no CVSS, plone)
- [CVE-2020-5015](https://cve.now/CVE-2020-5015.md): IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause (CVSS 7.5, IBM Elastic Storage Server)
- [CVE-2021-28362](https://cve.now/CVE-2021-28362.md): An issue was discovered in Contiki through 3.0. (no CVSS)
- [CVE-2021-27320](https://cve.now/CVE-2021-27320.md): Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via (no CVSS)
- [CVE-2021-27319](https://cve.now/CVE-2021-27319.md): Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via (no CVSS)
- [CVE-2021-27316](https://cve.now/CVE-2021-27316.md): Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via (no CVSS)
- [CVE-2021-27315](https://cve.now/CVE-2021-27315.md): Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via (no CVSS)
- [CVE-2021-29033](https://cve.now/CVE-2021-29033.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/edit (no CVSS)
- [CVE-2021-29032](https://cve.now/CVE-2021-29032.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/preference (no CVSS)
- [CVE-2021-29031](https://cve.now/CVE-2021-29031.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/user (no CVSS)
- [CVE-2021-29030](https://cve.now/CVE-2021-29030.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/inde (no CVSS)
- [CVE-2021-29029](https://cve.now/CVE-2021-29029.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/edit\_perso (no CVSS)
- [CVE-2021-29028](https://cve.now/CVE-2021-29028.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/user (no CVSS)
- [CVE-2021-29027](https://cve.now/CVE-2021-29027.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/index.php (no CVSS)
- [CVE-2021-29026](https://cve.now/CVE-2021-29026.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/perm (no CVSS)
- [CVE-2021-29025](https://cve.now/CVE-2021-29025.md): A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/my\_images. (no CVSS)
- [CVE-2021-29133](https://cve.now/CVE-2021-29133.md): Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents o (no CVSS)
- [CVE-2021-28967](https://cve.now/CVE-2021-28967.md): The unofficial MATLAB extension before 2.0.1 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace becau (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.