CVEs published March 26, 2021
72 CVEs were published on March 26, 2021: 0 critical, 8 high. 5 are now in CISA KEV.
- Published
- 72
- Critical
- 0
- High
- 8
- Medium
- 15
- Low
- 1
- Unrated
- 48
- Now in CISA KEV
- 5
- Fix available
- 26
Most affected products
- FreeBSD
- 11
- GitLab
- 4
- Samsung Mobile Devices
- 4
- baserCMS Users Community baserCMS · baserproject/basercms
- 3
- McAfee ePolicy Orchestrator
- 3
- Mulesoft
- 3
- nim-lang security
- 3
- Access Manager.
- 2
- binutils
- 2
- matrix-org synapse · matrix-synapse
- 2
High 8
- CVE-2021-21373Nimble falls back to insecure http url when fetching packagesnim-lang security
- CVE-2021-21374Nimble fails to validate certificates due to insecure httpClient defaultsnim-lang security
- CVE-2021-21372Nimble arbitrary code execution for specially crafted package metadatanim-lang security
- CVE-2021-21389BuddyPress privilege escalation via REST APIBuddyPress · buddypress/buddypress
- CVE-2021-21403Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/serverkongchuanhujiao server · github.com/kongchuanhujiao/server
- CVE-2021-22506Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to versioAccess Manager.
- CVE-2021-28248CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts.
- CVE-2021-28246CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library.
Medium, low and unrated 64
- CVE-2021-29249BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.
- CVE-2021-21396Bulk list client endpoint exposes too much metadata about a clientwireapp wire-server
- CVE-2021-29264An issue was discovered in the Linux kernel through 5.11.10.
- CVE-2021-29265An issue was discovered in the Linux kernel before 5.11.7.
- CVE-2021-29266An issue was discovered in the Linux kernel before 5.11.9.
- CVE-2021-20206An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.containernetworking-cni · github.com/containernetworking/cni
- CVE-2020-7464In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before FreeBSD
- CVE-2021-21411Incorrect authorization in OAuth2-Proxyoauth2-proxy · github.com/oauth2-proxy/oauth2-proxy +1
- CVE-2020-7461In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before pFreeBSD
- CVE-2020-7463In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before pFreeBSD
- CVE-2020-7462In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-free bug by sending IFreeBSD
- CVE-2020-25579In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before pFreeBSD
- CVE-2020-25578In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before pFreeBSD
- CVE-2020-25582In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such asFreeBSD
- CVE-2020-25581In FreeBSD 12.2-STABLE before r369312, 11.4-STABLE before r369313, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 due to a race conditionFreeBSD
- CVE-2020-25580In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the logFreeBSD
- CVE-2020-7468In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before pFreeBSD
- CVE-2020-7467In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before pFreeBSD
- CVE-2021-21333HTML injection in email and account expiry notificationsmatrix-org synapse · matrix-synapse
- CVE-2021-21332Cross-site scripting (XSS) vulnerability in the password reset endpointmatrix-org synapse · matrix-synapse
- CVE-2021-22184An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive informatGitLab
- CVE-2021-22180An issue has been discovered in GitLab affecting all versions starting from 13.4.GitLab
- CVE-2021-22194In all versions of GitLab, marshalled session keys were being stored in Redis.GitLab
- CVE-2021-22172Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releasesGitLab
- CVE-2021-25372An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.Samsung Mobile Devices
- CVE-2021-25371A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.Samsung Mobile Devices
- CVE-2021-25370An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kSamsung Mobile Devices
- CVE-2021-25369An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.Samsung Mobile Devices
- CVE-2021-22886Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a rRocket.Chat
- CVE-2021-29255MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007.
- CVE-2020-28695Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log
- CVE-2020-27829A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45.ImageMagick
- CVE-2021-20197There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranbinutils
- CVE-2020-35508A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identkernel
- CVE-2020-35518When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not.389-ds-base
- CVE-2021-20193A flaw was found in the src/list.c of tar 1.33 and earlier.tar
- CVE-2021-20284A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due binutils
- CVE-2021-20285A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96.upx
- CVE-2021-20289A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final.resteasy · org.jboss.resteasy:resteasy-core
- CVE-2021-1629Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.Tableau
- CVE-2021-1628MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CMulesoft
- CVE-2021-1627MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect bothMulesoft
- CVE-2021-1626MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudMulesoft
- CVE-2020-35856SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.
- CVE-2021-3109The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator
- CVE-2020-19625Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbit
- CVE-2020-19626Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settcraftcms/cms
- CVE-2020-25840Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0.Access Manager.
- CVE-2021-3275Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access P
- CVE-2021-23890McAfee ePO Information Leak vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2021-23888McAfee ePO unvalidated URL redirect vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2021-23889McAfee ePO Cross-site Scripting vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2021-20683Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticbaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2021-20682baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified baserCMS Users Community baserCMS · baserproject/basercms
- CVE-2021-20681Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attbaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2021-20677UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, NEC Platforms UNIVERGE Aspire series PBX
- CVE-2021-28250CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file.
- CVE-2021-28249CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library.
- CVE-2021-28247CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS).
- CVE-2020-28346ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference.
- CVE-2021-3153HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to
- CVE-2021-3027app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection.
- CVE-2020-23517Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary
- CVE-2021-20271A flaw was found in RPM's signature check functionality when reading a package file.rpm