CVEs published March 29, 2021
45 CVEs were published on March 29, 2021: 1 critical, 10 high.
- Published
- 45
- Critical
- 1
- High
- 10
- Medium
- 2
- Low
- 1
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Aruba Instant Access Points
- 8
- NETGEAR ProSAFE Network Management System
- 5
- Parallels Desktop
- 3
- FreeBSD
- 2
- <ZXHN F623>
- 1
- Avast Premium Security
- 1
- DOUZONE ICT GROUP. NBBDownloader.ocx
- 1
- github.com/liamg/gitjacker
- 1
- NETGEAR Multiple Routers
- 1
- SolarWinds Patch Manager
- 1
Critical 1
High 10
- CVE-2021-27245This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(USTP-Link Archer A7
- CVE-2021-27243This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919.Parallels Desktop
- CVE-2021-27242This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919.Parallels Desktop
- CVE-2021-27240This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1.SolarWinds Patch Manager
- CVE-2021-27239This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmwareNETGEAR Multiple Routers
- CVE-2021-27276This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System NETGEAR ProSAFE Network Management System
- CVE-2021-27275This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEARNETGEAR ProSAFE Network Management System
- CVE-2021-27273This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System NETGEAR ProSAFE Network Management System
- CVE-2021-27272This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System NETGEAR ProSAFE Network Management System
- CVE-2020-7850Douzone ActiveX File Download and Execution VulnerabilityDOUZONE ICT GROUP. NBBDownloader.ocx
Medium, low and unrated 34
- CVE-2021-25149A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: Aruba Instant Access Points
- CVE-2021-25148A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InsAruba Instant Access Points
- CVE-2021-25145A remote unauthorized disclosure of information vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s)Aruba Instant Access Points
- CVE-2021-29424The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address strin
- CVE-2021-27244This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919.Parallels Desktop
- CVE-2021-27241This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (BuiAvast Premium Security
- CVE-2021-28671Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.
- CVE-2021-28672Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.
- CVE-2020-25583In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before pFreeBSD
- CVE-2020-25577In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before pFreeBSD
- CVE-2021-3391MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing
- CVE-2020-35138The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/
- CVE-2021-28668Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 1
- CVE-2021-28669Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 1
- CVE-2021-26714The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and fold
- CVE-2020-24636A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): ArubaAruba Instant Access Points
- CVE-2021-25144A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: Aruba Instant Access Points
- CVE-2020-24635A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): ArubaAruba Instant Access Points
- CVE-2021-25143A remote denial of service (dos) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InstantAruba Instant Access Points
- CVE-2021-28673Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61.
- CVE-2021-29417gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.github.com/liamg/gitjacker
- CVE-2021-29416An issue was discovered in PortSwigger Burp Suite before 2021.2.
- CVE-2021-28670Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 be
- CVE-2020-25217Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.
- CVE-2020-25218Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface.
- CVE-2019-5317A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.Aruba Instant Access Points
- CVE-2021-21727A ZTE product has a DoS vulnerability.<ZXHN F623>
- CVE-2021-27352An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login.
- CVE-2021-29267Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staf
- CVE-2021-23358Arbitrary Code Injectionunderscore
- CVE-2021-28936The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted
- CVE-2021-28937The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrato
- CVE-2021-29274Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
- CVE-2020-35137The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS disco