# CVEs published 2021-03-29 45 CVEs were published on March 29, 2021: 1 critical, 10 high. Days are UTC. - [CVE-2021-25149](https://cve.now/CVE-2021-25149.md): A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: (no CVSS, Aruba Instant Access Points) - [CVE-2021-25148](https://cve.now/CVE-2021-25148.md): A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Ins (no CVSS, Aruba Instant Access Points) - [CVE-2021-25145](https://cve.now/CVE-2021-25145.md): A remote unauthorized disclosure of information vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s) (no CVSS, Aruba Instant Access Points) - [CVE-2021-29424](https://cve.now/CVE-2021-29424.md): The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address strin (no CVSS) - [CVE-2021-27244](https://cve.now/CVE-2021-27244.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. (CVSS 6.5, Parallels Desktop) - [CVE-2021-27245](https://cve.now/CVE-2021-27245.md): This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)\_V5\_210125 and Archer A7(US (CVSS 8.1, TP-Link Archer A7) - [CVE-2021-27243](https://cve.now/CVE-2021-27243.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. (CVSS 8.8, Parallels Desktop) - [CVE-2021-27241](https://cve.now/CVE-2021-27241.md): This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Bui (CVSS 6.1, Avast Premium Security) - [CVE-2021-27242](https://cve.now/CVE-2021-27242.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. (CVSS 8.8, Parallels Desktop) - [CVE-2021-27240](https://cve.now/CVE-2021-27240.md): This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. (CVSS 7.8, SolarWinds Patch Manager) - [CVE-2021-27239](https://cve.now/CVE-2021-27239.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware (CVSS 8.8, NETGEAR Multiple Routers) - [CVE-2021-27276](https://cve.now/CVE-2021-27276.md): This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System (CVSS 7.1, NETGEAR ProSAFE Network Management System) - [CVE-2021-27275](https://cve.now/CVE-2021-27275.md): This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR (CVSS 8.3, NETGEAR ProSAFE Network Management System) - [CVE-2021-27273](https://cve.now/CVE-2021-27273.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System (CVSS 8.8, NETGEAR ProSAFE Network Management System) - [CVE-2021-27274](https://cve.now/CVE-2021-27274.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System (CVSS 9.8, NETGEAR ProSAFE Network Management System) - [CVE-2021-27272](https://cve.now/CVE-2021-27272.md): This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System (CVSS 7.1, NETGEAR ProSAFE Network Management System) - [CVE-2021-28671](https://cve.now/CVE-2021-28671.md): Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65. (no CVSS) - [CVE-2021-28672](https://cve.now/CVE-2021-28672.md): Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65. (no CVSS) - [CVE-2020-25583](https://cve.now/CVE-2020-25583.md): In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p (no CVSS, FreeBSD) - [CVE-2020-25577](https://cve.now/CVE-2020-25577.md): In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p (no CVSS, FreeBSD) - [CVE-2021-3391](https://cve.now/CVE-2021-3391.md): MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing (no CVSS) - [CVE-2020-35138](https://cve.now/CVE-2020-35138.md): The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/ (no CVSS) - [CVE-2021-28668](https://cve.now/CVE-2021-28668.md): Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 1 (no CVSS) - [CVE-2021-28669](https://cve.now/CVE-2021-28669.md): Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 1 (no CVSS) - [CVE-2021-26714](https://cve.now/CVE-2021-26714.md): The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and fold (no CVSS) - [CVE-2020-24636](https://cve.now/CVE-2020-24636.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba (no CVSS, Aruba Instant Access Points) - [CVE-2021-25144](https://cve.now/CVE-2021-25144.md): A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: (no CVSS, Aruba Instant Access Points) - [CVE-2020-24635](https://cve.now/CVE-2020-24635.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba (no CVSS, Aruba Instant Access Points) - [CVE-2021-25143](https://cve.now/CVE-2021-25143.md): A remote denial of service (dos) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant (no CVSS, Aruba Instant Access Points) - [CVE-2021-28673](https://cve.now/CVE-2021-28673.md): Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61. (no CVSS) - [CVE-2021-29417](https://cve.now/CVE-2021-29417.md): gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal. (no CVSS, github.com/liamg/gitjacker) - [CVE-2021-29416](https://cve.now/CVE-2021-29416.md): An issue was discovered in PortSwigger Burp Suite before 2021.2. (no CVSS) - [CVE-2021-28670](https://cve.now/CVE-2021-28670.md): Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 be (no CVSS) - [CVE-2020-25217](https://cve.now/CVE-2020-25217.md): Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface. (no CVSS) - [CVE-2020-25218](https://cve.now/CVE-2020-25218.md): Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface. (no CVSS) - [CVE-2019-5317](https://cve.now/CVE-2019-5317.md): A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6. (no CVSS, Aruba Instant Access Points) - [CVE-2020-7850](https://cve.now/CVE-2020-7850.md): Douzone ActiveX File Download and Execution Vulnerability (CVSS 7.8, DOUZONE ICT GROUP. NBBDownloader.ocx) - [CVE-2021-21727](https://cve.now/CVE-2021-21727.md): A ZTE product has a DoS vulnerability. (no CVSS, \) - [CVE-2021-27352](https://cve.now/CVE-2021-27352.md): An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login. (no CVSS) - [CVE-2021-29267](https://cve.now/CVE-2021-29267.md): Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staf (no CVSS) - [CVE-2021-23358](https://cve.now/CVE-2021-23358.md): Arbitrary Code Injection (CVSS 3.3, underscore) - [CVE-2021-28936](https://cve.now/CVE-2021-28936.md): The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted (no CVSS) - [CVE-2021-28937](https://cve.now/CVE-2021-28937.md): The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrato (no CVSS) - [CVE-2021-29274](https://cve.now/CVE-2021-29274.md): Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip. (no CVSS) - [CVE-2020-35137](https://cve.now/CVE-2020-35137.md): The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS disco (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-03-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.