CVEs published March 25, 2021
71 CVEs were published on March 25, 2021: 1 critical, 11 high.
- Published
- 71
- Critical
- 1
- High
- 11
- Medium
- 8
- Low
- 6
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- privoxy
- 9
- Esri ArcGIS Server
- 3
- MU320E
- 3
- Reason DR60
- 3
- Esri ArcReader · Esri ArcGIS Desktop +2
- 2
- https://github.com/revive-adserver/revive-adserver
- 2
- jasper
- 2
- OpenSSL · node +2
- 2
- Samsung Mobile Samsung Account
- 2
- Samsung Mobile Samsung Internet
- 2
Critical 1
High 11
- CVE-2021-29098ArcGIS general raster security update: uninitialized pointerEsri ArcReader · Esri ArcGIS Desktop +2
- CVE-2021-29097ArcGIS general raster security update: buffer overflowEsri ArcReader · Esri ArcGIS Desktop +2
- CVE-2021-29096ArcGIS general raster security update: use-after-freeEsri ArcReader · Esri ArcGIS Desktop +1
- CVE-2021-22659Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus paRockwell Automation MicroLogix
- CVE-2020-6790Uncontrolled Search Path Element in Bosch Video Streaming Gateway InstallerBosch Video Streaming Gateway
- CVE-2020-6789Uncontrolled Search Path Element in Bosch Monitor Wall InstallerBosch Monitor Wall
- CVE-2020-6788Uncontrolled Search Path Element in Bosch Configuration Manager InstallerBosch Configuration Manager
- CVE-2020-6787Uncontrolled Search Path Element in Bosch Video Client installerBosch Video Client
- CVE-2020-6786Uncontrolled Search Path Element in Bosch Video Recording Manager InstallerBosch Video Recording Manager
- CVE-2020-6785Uncontrolled Search Path Element in Bosch BVMS and BVMS ViewerBosch BVMS · Bosch DIVAR IP 7000 R2 +1
- CVE-2020-6771Uncontrolled Search Path Element in Bosch IP HelperBosch IP Helper
Medium, low and unrated 59
- CVE-2021-3119Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqli
- CVE-2021-27372Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permis
- CVE-2021-29095ArcGIS Server image service and raster analytics security update: uninitialized pointerEsri ArcGIS Server
- CVE-2021-29094ArcGIS Server image service and raster analytics security update: buffer overflowEsri ArcGIS Server
- CVE-2021-29093ArcGIS Server image service and raster analytics security update: use-after-freeEsri ArcGIS Server
- CVE-2020-10579A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to lis
- CVE-2020-10580A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated a
- CVE-2020-10581Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management (ADM) through 5.0 all
- CVE-2020-10582A SQL injection on the /admin/display_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to e
- CVE-2020-10583The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitr
- CVE-2020-10584A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to
- CVE-2021-22889Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly othttps://github.com/revive-adserver/revive-adserver
- CVE-2021-22888Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php.https://github.com/revive-adserver/revive-adserver
- CVE-2021-27448A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versioMU320E
- CVE-2021-27454The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies thReason DR60
- CVE-2021-27450SSH server configuration file does not implement some best practices.MU320E
- CVE-2021-27440The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components Reason DR60
- CVE-2021-27438The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components Reason DR60
- CVE-2021-27452The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentiMU320E
- CVE-2021-29010A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" para
- CVE-2021-29009A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter.
- CVE-2021-29008A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time"
- CVE-2021-20217A flaw was found in Privoxy in versions before 3.0.31.privoxy
- CVE-2021-20216A flaw was found in Privoxy in versions before 3.0.31.privoxy
- CVE-2021-20215A flaw was found in Privoxy in versions before 3.0.29.privoxy
- CVE-2021-20214A flaw was found in Privoxy in versions before 3.0.29.privoxy
- CVE-2021-20213A flaw was found in Privoxy in versions before 3.0.29.privoxy
- CVE-2021-20212A flaw was found in Privoxy in versions before 3.0.29.privoxy
- CVE-2021-20211A flaw was found in Privoxy in versions before 3.0.29.privoxy
- CVE-2021-20210A flaw was found in Privoxy in versions before 3.0.29.privoxy
- CVE-2020-35502A flaw was found in Privoxy in versions before 3.0.29.privoxy
- CVE-2021-26596An issue was discovered in Nokia NetAct 18A.
- CVE-2021-26597An issue was discovered in Nokia NetAct 18A.
- CVE-2021-3467A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 imagejasper
- CVE-2021-3446A flaw was found in libtpms in versions before 0.8.2.libtpms
- CVE-2021-3443A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decojasper
- CVE-2021-27195Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic.
- CVE-2021-27194Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to ga
- CVE-2021-27193Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacke
- CVE-2021-27192Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain admini
- CVE-2021-25368Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed.Samsung Mobile Samsung Cloud
- CVE-2021-25367Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission.Samsung Mobile Samsung Notes
- CVE-2021-25366Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass the secret mode's autSamsung Mobile Samsung Internet
- CVE-2021-25355Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijSamsung Mobile Samsung Notes
- CVE-2021-25354Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via Samsung Mobile Samsung Internet
- CVE-2021-25353Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of GalSamsung Mobile Galaxy Themes
- CVE-2021-25352Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijackinSamsung Mobile Bixby Voice
- CVE-2021-25351Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackeSamsung Mobile Samsung Account
- CVE-2021-25350Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user informaSamsung Mobile Samsung Account
- CVE-2021-25349Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission viaSamsung Mobile Slow Motion Editor
- CVE-2021-22496Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3.Access Manager
- CVE-2021-1492Duo Authentication Proxy Installer Denial of Service VulnerabilityCisco Duo Authentication Proxy
- CVE-2021-3450CA certificate check bypass with X509_V_FLAG_X509_STRICTOpenSSL · node +2
- CVE-2021-3449NULL pointer deref in signature_algorithms processingOpenSSL · node +2
- CVE-2020-1946Apache SpamAssassin has an OS Command Injection vulnerabilityApache Software Foundation Apache SpamAssassin
- CVE-2021-29156ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.
- CVE-2021-26715The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability.org.mitre:openid-connect-server
- CVE-2021-20679Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, AFuji Xerox Co. Fuji Xerox multifunction devices and printers
- CVE-2021-3466A flaw was found in libmicrohttpd.libmicrohttpd