# CVEs published 2021-03-26

72 CVEs were published on March 26, 2021: 0 critical, 8 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2021-29249](https://cve.now/CVE-2021-29249.md): BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability. (no CVSS)
- [CVE-2021-21396](https://cve.now/CVE-2021-21396.md): Bulk list client endpoint exposes too much metadata about a client (CVSS 6.5, wireapp wire-server)
- [CVE-2021-29264](https://cve.now/CVE-2021-29264.md): An issue was discovered in the Linux kernel through 5.11.10. (no CVSS)
- [CVE-2021-29265](https://cve.now/CVE-2021-29265.md): An issue was discovered in the Linux kernel before 5.11.7. (no CVSS)
- [CVE-2021-29266](https://cve.now/CVE-2021-29266.md): An issue was discovered in the Linux kernel before 5.11.9. (no CVSS)
- [CVE-2021-20206](https://cve.now/CVE-2021-20206.md): An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. (no CVSS, containernetworking-cni · github.com/containernetworking/cni)
- [CVE-2021-21373](https://cve.now/CVE-2021-21373.md): Nimble falls back to insecure http url when fetching packages (CVSS 7.5, nim-lang security)
- [CVE-2021-21374](https://cve.now/CVE-2021-21374.md): Nimble fails to validate certificates due to insecure httpClient defaults (CVSS 8.1, nim-lang security)
- [CVE-2021-21372](https://cve.now/CVE-2021-21372.md): Nimble arbitrary code execution for specially crafted package metadata (CVSS 8.3, nim-lang security)
- [CVE-2020-7464](https://cve.now/CVE-2020-7464.md): In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before (no CVSS, FreeBSD)
- [CVE-2021-21411](https://cve.now/CVE-2021-21411.md): Incorrect authorization in OAuth2-Proxy (CVSS 5.5, oauth2-proxy · github.com/oauth2-proxy/oauth2-proxy +1)
- [CVE-2020-7461](https://cve.now/CVE-2020-7461.md): In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2020-7463](https://cve.now/CVE-2020-7463.md): In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2020-7462](https://cve.now/CVE-2020-7462.md): In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-free bug by sending I (no CVSS, FreeBSD)
- [CVE-2020-25579](https://cve.now/CVE-2020-25579.md): In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2020-25578](https://cve.now/CVE-2020-25578.md): In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2020-25582](https://cve.now/CVE-2020-25582.md): In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as (no CVSS, FreeBSD)
- [CVE-2020-25581](https://cve.now/CVE-2020-25581.md): In FreeBSD 12.2-STABLE before r369312, 11.4-STABLE before r369313, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 due to a race condition (no CVSS, FreeBSD)
- [CVE-2020-25580](https://cve.now/CVE-2020-25580.md): In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the log (no CVSS, FreeBSD)
- [CVE-2020-7468](https://cve.now/CVE-2020-7468.md): In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2020-7467](https://cve.now/CVE-2020-7467.md): In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2021-21389](https://cve.now/CVE-2021-21389.md): BuddyPress privilege escalation via REST API (CVSS 8.1, BuddyPress · buddypress/buddypress)
- [CVE-2021-21333](https://cve.now/CVE-2021-21333.md): HTML injection in email and account expiry notifications (CVSS 6.1, matrix-org synapse · matrix-synapse)
- [CVE-2021-21332](https://cve.now/CVE-2021-21332.md): Cross-site scripting (XSS) vulnerability in the password reset endpoint (CVSS 6.9, matrix-org synapse · matrix-synapse)
- [CVE-2021-22184](https://cve.now/CVE-2021-22184.md): An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive informat (CVSS 6.2, GitLab)
- [CVE-2021-22180](https://cve.now/CVE-2021-22180.md): An issue has been discovered in GitLab affecting all versions starting from 13.4. (CVSS 4.3, GitLab)
- [CVE-2021-22194](https://cve.now/CVE-2021-22194.md): In all versions of GitLab, marshalled session keys were being stored in Redis. (CVSS 5.7, GitLab)
- [CVE-2021-22172](https://cve.now/CVE-2021-22172.md): Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases (CVSS 4.3, GitLab)
- [CVE-2021-25372](https://cve.now/CVE-2021-25372.md): An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. (CVSS 6.1, KEV, Samsung Mobile Devices)
- [CVE-2021-25371](https://cve.now/CVE-2021-25371.md): A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. (CVSS 6.1, KEV, Samsung Mobile Devices)
- [CVE-2021-25370](https://cve.now/CVE-2021-25370.md): An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to k (CVSS 6.1, KEV, Samsung Mobile Devices)
- [CVE-2021-25369](https://cve.now/CVE-2021-25369.md): An improper access control vulnerability in sec\_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. (CVSS 6.2, KEV, Samsung Mobile Devices)
- [CVE-2021-22886](https://cve.now/CVE-2021-22886.md): Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a r (no CVSS, Rocket.Chat)
- [CVE-2021-29255](https://cve.now/CVE-2021-29255.md): MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. (no CVSS)
- [CVE-2021-21403](https://cve.now/CVE-2021-21403.md): Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server (CVSS 7.5, kongchuanhujiao server · github.com/kongchuanhujiao/server)
- [CVE-2020-28695](https://cve.now/CVE-2020-28695.md): Askey Fiber Router RTF3505VW-N1 BR\_SV\_g000\_R3505VWN1001\_s32\_7 devices allow Remote Code Execution and retrieval of admin credentials to log (no CVSS)
- [CVE-2020-27829](https://cve.now/CVE-2020-27829.md): A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45. (no CVSS, ImageMagick)
- [CVE-2021-20197](https://cve.now/CVE-2021-20197.md): There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ran (CVSS 6.3, binutils)
- [CVE-2020-35508](https://cve.now/CVE-2020-35508.md): A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process ident (no CVSS, kernel)
- [CVE-2020-35518](https://cve.now/CVE-2020-35518.md): When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. (no CVSS, 389-ds-base)
- [CVE-2021-20193](https://cve.now/CVE-2021-20193.md): A flaw was found in the src/list.c of tar 1.33 and earlier. (no CVSS, tar)
- [CVE-2021-20284](https://cve.now/CVE-2021-20284.md): A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in \_bfd\_elf\_slurp\_secondary\_reloc\_section in elf.c due (no CVSS, binutils)
- [CVE-2021-20285](https://cve.now/CVE-2021-20285.md): A flaw was found in upx canPack in p\_lx\_elf.cpp in UPX 3.96. (no CVSS, upx)
- [CVE-2021-20289](https://cve.now/CVE-2021-20289.md): A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. (no CVSS, resteasy · org.jboss.resteasy:resteasy-core)
- [CVE-2021-1629](https://cve.now/CVE-2021-1629.md): Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users. (no CVSS, Tableau)
- [CVE-2021-1628](https://cve.now/CVE-2021-1628.md): MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both C (no CVSS, Mulesoft)
- [CVE-2021-1627](https://cve.now/CVE-2021-1627.md): MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both (no CVSS, Mulesoft)
- [CVE-2021-1626](https://cve.now/CVE-2021-1626.md): MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both Cloud (no CVSS, Mulesoft)
- [CVE-2020-35856](https://cve.now/CVE-2020-35856.md): SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page. (no CVSS)
- [CVE-2021-3109](https://cve.now/CVE-2021-3109.md): The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator (no CVSS)
- [CVE-2020-19625](https://cve.now/CVE-2020-19625.md): Remote Code Execution Vulnerability in tests/support/stores/test\_grid\_filter.php in oria gridx 1.3, allows remote attackers to execute arbit (no CVSS)
- [CVE-2020-19626](https://cve.now/CVE-2020-19626.md): Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/sett (no CVSS, craftcms/cms)
- [CVE-2020-25840](https://cve.now/CVE-2020-25840.md): Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. (no CVSS, Access Manager.)
- [CVE-2021-22506](https://cve.now/CVE-2021-22506.md): Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to versio (CVSS 7.5, KEV, Access Manager.)
- [CVE-2021-3275](https://cve.now/CVE-2021-3275.md): Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access P (no CVSS)
- [CVE-2021-23890](https://cve.now/CVE-2021-23890.md): McAfee ePO Information Leak vulnerability (CVSS 6.5, McAfee ePolicy Orchestrator)
- [CVE-2021-23888](https://cve.now/CVE-2021-23888.md): McAfee ePO unvalidated URL redirect vulnerability (CVSS 6.3, McAfee ePolicy Orchestrator)
- [CVE-2021-23889](https://cve.now/CVE-2021-23889.md): McAfee ePO Cross-site Scripting vulnerability (CVSS 3.5, McAfee ePolicy Orchestrator)
- [CVE-2021-20683](https://cve.now/CVE-2021-20683.md): Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authentic (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2021-20682](https://cve.now/CVE-2021-20682.md): baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2021-20681](https://cve.now/CVE-2021-20681.md): Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated att (no CVSS, baserCMS Users Community baserCMS · baserproject/basercms)
- [CVE-2021-20677](https://cve.now/CVE-2021-20677.md): UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, (no CVSS, NEC Platforms UNIVERGE Aspire series PBX)
- [CVE-2021-28250](https://cve.now/CVE-2021-28250.md): CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. (no CVSS)
- [CVE-2021-28248](https://cve.now/CVE-2021-28248.md): CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. (CVSS 7.5)
- [CVE-2021-28249](https://cve.now/CVE-2021-28249.md): CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. (no CVSS)
- [CVE-2021-28247](https://cve.now/CVE-2021-28247.md): CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). (no CVSS)
- [CVE-2021-28246](https://cve.now/CVE-2021-28246.md): CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. (CVSS 7.8)
- [CVE-2020-28346](https://cve.now/CVE-2020-28346.md): ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference. (no CVSS)
- [CVE-2021-3153](https://cve.now/CVE-2021-3153.md): HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to (no CVSS)
- [CVE-2021-3027](https://cve.now/CVE-2021-3027.md): app/views\_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. (no CVSS)
- [CVE-2020-23517](https://cve.now/CVE-2020-23517.md): Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2021-20271](https://cve.now/CVE-2021-20271.md): A flaw was found in RPM's signature check functionality when reading a package file. (no CVSS, rpm)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.