# CVEs published 2021-03-25

71 CVEs were published on March 25, 2021: 1 critical, 11 high. Days are UTC.

- [CVE-2021-3119](https://cve.now/CVE-2021-3119.md): Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher\_export in crypto.c and sqlite3StrICmp in sqli (no CVSS)
- [CVE-2021-27372](https://cve.now/CVE-2021-27372.md): Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permis (no CVSS)
- [CVE-2021-29098](https://cve.now/CVE-2021-29098.md): ArcGIS general raster security update: uninitialized pointer (CVSS 7.8, Esri ArcReader · Esri ArcGIS Desktop +2)
- [CVE-2021-29097](https://cve.now/CVE-2021-29097.md): ArcGIS general raster security update: buffer overflow (CVSS 7.8, Esri ArcReader · Esri ArcGIS Desktop +2)
- [CVE-2021-29095](https://cve.now/CVE-2021-29095.md): ArcGIS Server image service and raster analytics security update: uninitialized pointer (CVSS 6.4, Esri ArcGIS Server)
- [CVE-2021-29094](https://cve.now/CVE-2021-29094.md): ArcGIS Server image service and raster analytics security update: buffer overflow (CVSS 6.4, Esri ArcGIS Server)
- [CVE-2021-29093](https://cve.now/CVE-2021-29093.md): ArcGIS Server image service and raster analytics security update: use-after-free (CVSS 6.4, Esri ArcGIS Server)
- [CVE-2020-10579](https://cve.now/CVE-2020-10579.md): A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to lis (no CVSS)
- [CVE-2020-10580](https://cve.now/CVE-2020-10580.md): A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated a (no CVSS)
- [CVE-2020-10581](https://cve.now/CVE-2020-10581.md): Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management (ADM) through 5.0 all (no CVSS)
- [CVE-2020-10582](https://cve.now/CVE-2020-10582.md): A SQL injection on the /admin/display\_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to e (no CVSS)
- [CVE-2020-10583](https://cve.now/CVE-2020-10583.md): The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitr (no CVSS)
- [CVE-2020-10584](https://cve.now/CVE-2020-10584.md): A directory traversal on the /admin/search\_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to (no CVSS)
- [CVE-2021-22889](https://cve.now/CVE-2021-22889.md): Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the \`statsBreakdown\` parameter of stats.php (and possibly ot (no CVSS, https://github.com/revive-adserver/revive-adserver)
- [CVE-2021-22888](https://cve.now/CVE-2021-22888.md): Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the \`status\` parameter of campaign-zone-zones.php. (no CVSS, https://github.com/revive-adserver/revive-adserver)
- [CVE-2021-27448](https://cve.now/CVE-2021-27448.md): A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versio (no CVSS, MU320E)
- [CVE-2021-27454](https://cve.now/CVE-2021-27454.md): The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies th (no CVSS, Reason DR60)
- [CVE-2021-27450](https://cve.now/CVE-2021-27450.md): SSH server configuration file does not implement some best practices. (no CVSS, MU320E)
- [CVE-2021-27440](https://cve.now/CVE-2021-27440.md): The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components (no CVSS, Reason DR60)
- [CVE-2021-27438](https://cve.now/CVE-2021-27438.md): The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components (no CVSS, Reason DR60)
- [CVE-2021-27452](https://cve.now/CVE-2021-27452.md): The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credenti (no CVSS, MU320E)
- [CVE-2021-29010](https://cve.now/CVE-2021-29010.md): A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report\_type" para (no CVSS)
- [CVE-2021-29009](https://cve.now/CVE-2021-29009.md): A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter. (no CVSS)
- [CVE-2021-29008](https://cve.now/CVE-2021-29008.md): A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to\_time" (no CVSS)
- [CVE-2021-20217](https://cve.now/CVE-2021-20217.md): A flaw was found in Privoxy in versions before 3.0.31. (no CVSS, privoxy)
- [CVE-2021-20216](https://cve.now/CVE-2021-20216.md): A flaw was found in Privoxy in versions before 3.0.31. (no CVSS, privoxy)
- [CVE-2021-20215](https://cve.now/CVE-2021-20215.md): A flaw was found in Privoxy in versions before 3.0.29. (no CVSS, privoxy)
- [CVE-2021-20214](https://cve.now/CVE-2021-20214.md): A flaw was found in Privoxy in versions before 3.0.29. (no CVSS, privoxy)
- [CVE-2021-20213](https://cve.now/CVE-2021-20213.md): A flaw was found in Privoxy in versions before 3.0.29. (no CVSS, privoxy)
- [CVE-2021-20212](https://cve.now/CVE-2021-20212.md): A flaw was found in Privoxy in versions before 3.0.29. (no CVSS, privoxy)
- [CVE-2021-20211](https://cve.now/CVE-2021-20211.md): A flaw was found in Privoxy in versions before 3.0.29. (no CVSS, privoxy)
- [CVE-2021-20210](https://cve.now/CVE-2021-20210.md): A flaw was found in Privoxy in versions before 3.0.29. (no CVSS, privoxy)
- [CVE-2020-35502](https://cve.now/CVE-2020-35502.md): A flaw was found in Privoxy in versions before 3.0.29. (no CVSS, privoxy)
- [CVE-2021-26596](https://cve.now/CVE-2021-26596.md): An issue was discovered in Nokia NetAct 18A. (no CVSS)
- [CVE-2021-26597](https://cve.now/CVE-2021-26597.md): An issue was discovered in Nokia NetAct 18A. (no CVSS)
- [CVE-2021-3467](https://cve.now/CVE-2021-3467.md): A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image (no CVSS, jasper)
- [CVE-2021-3446](https://cve.now/CVE-2021-3446.md): A flaw was found in libtpms in versions before 0.8.2. (no CVSS, libtpms)
- [CVE-2021-3443](https://cve.now/CVE-2021-3443.md): A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format deco (no CVSS, jasper)
- [CVE-2021-29096](https://cve.now/CVE-2021-29096.md): ArcGIS general raster security update: use-after-free (CVSS 7.8, Esri ArcReader · Esri ArcGIS Desktop +1)
- [CVE-2021-27195](https://cve.now/CVE-2021-27195.md): Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic. (no CVSS)
- [CVE-2021-27194](https://cve.now/CVE-2021-27194.md): Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to ga (no CVSS)
- [CVE-2021-27193](https://cve.now/CVE-2021-27193.md): Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacke (no CVSS)
- [CVE-2021-27192](https://cve.now/CVE-2021-27192.md): Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain admini (no CVSS)
- [CVE-2021-25368](https://cve.now/CVE-2021-25368.md): Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed. (CVSS 3.3, Samsung Mobile Samsung Cloud)
- [CVE-2021-25367](https://cve.now/CVE-2021-25367.md): Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission. (CVSS 3.7, Samsung Mobile Samsung Notes)
- [CVE-2021-25366](https://cve.now/CVE-2021-25366.md): Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass the secret mode's aut (CVSS 3.2, Samsung Mobile Samsung Internet)
- [CVE-2021-25355](https://cve.now/CVE-2021-25355.md): Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hij (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2021-25354](https://cve.now/CVE-2021-25354.md): Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via (CVSS 3.3, Samsung Mobile Samsung Internet)
- [CVE-2021-25353](https://cve.now/CVE-2021-25353.md): Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Gal (CVSS 5.5, Samsung Mobile Galaxy Themes)
- [CVE-2021-25352](https://cve.now/CVE-2021-25352.md): Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijackin (CVSS 5.5, Samsung Mobile Bixby Voice)
- [CVE-2021-25351](https://cve.now/CVE-2021-25351.md): Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attacke (CVSS 3.2, Samsung Mobile Samsung Account)
- [CVE-2021-25350](https://cve.now/CVE-2021-25350.md): Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user informa (CVSS 2.0, Samsung Mobile Samsung Account)
- [CVE-2021-25349](https://cve.now/CVE-2021-25349.md): Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via (CVSS 5.5, Samsung Mobile Slow Motion Editor)
- [CVE-2021-21783](https://cve.now/CVE-2021-21783.md): A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. (CVSS 9.8, Genivia)
- [CVE-2021-22659](https://cve.now/CVE-2021-22659.md): Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus pa (CVSS 7.5, Rockwell Automation MicroLogix)
- [CVE-2021-22496](https://cve.now/CVE-2021-22496.md): Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. (no CVSS, Access Manager)
- [CVE-2020-6790](https://cve.now/CVE-2020-6790.md): Uncontrolled Search Path Element in Bosch Video Streaming Gateway Installer (CVSS 7.8, Bosch Video Streaming Gateway)
- [CVE-2020-6789](https://cve.now/CVE-2020-6789.md): Uncontrolled Search Path Element in Bosch Monitor Wall Installer (CVSS 7.8, Bosch Monitor Wall)
- [CVE-2020-6788](https://cve.now/CVE-2020-6788.md): Uncontrolled Search Path Element in Bosch Configuration Manager Installer (CVSS 7.8, Bosch Configuration Manager)
- [CVE-2020-6787](https://cve.now/CVE-2020-6787.md): Uncontrolled Search Path Element in Bosch Video Client installer (CVSS 7.8, Bosch Video Client)
- [CVE-2020-6786](https://cve.now/CVE-2020-6786.md): Uncontrolled Search Path Element in Bosch Video Recording Manager Installer (CVSS 7.8, Bosch Video Recording Manager)
- [CVE-2020-6785](https://cve.now/CVE-2020-6785.md): Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer (CVSS 7.8, Bosch BVMS · Bosch DIVAR IP 7000 R2 +1)
- [CVE-2020-6771](https://cve.now/CVE-2020-6771.md): Uncontrolled Search Path Element in Bosch IP Helper (CVSS 7.8, Bosch IP Helper)
- [CVE-2021-1492](https://cve.now/CVE-2021-1492.md): Duo Authentication Proxy Installer Denial of Service Vulnerability (CVSS 6.6, Cisco Duo Authentication Proxy)
- [CVE-2021-3450](https://cve.now/CVE-2021-3450.md): CA certificate check bypass with X509\_V\_FLAG\_X509\_STRICT (no CVSS, OpenSSL · node +2)
- [CVE-2021-3449](https://cve.now/CVE-2021-3449.md): NULL pointer deref in signature\_algorithms processing (no CVSS, OpenSSL · node +2)
- [CVE-2020-1946](https://cve.now/CVE-2020-1946.md): Apache SpamAssassin has an OS Command Injection vulnerability (no CVSS, Apache Software Foundation Apache SpamAssassin)
- [CVE-2021-29156](https://cve.now/CVE-2021-29156.md): ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. (no CVSS)
- [CVE-2021-26715](https://cve.now/CVE-2021-26715.md): The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. (no CVSS, org.mitre:openid-connect-server)
- [CVE-2021-20679](https://cve.now/CVE-2021-20679.md): Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, A (no CVSS, Fuji Xerox Co. Fuji Xerox multifunction devices and printers)
- [CVE-2021-3466](https://cve.now/CVE-2021-3466.md): A flaw was found in libmicrohttpd. (no CVSS, libmicrohttpd)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.