CVEs published March 30, 2021
78 CVEs were published on March 30, 2021: 0 critical, 9 high.
- Published
- 78
- Critical
- 0
- High
- 9
- Medium
- 14
- Low
- 5
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Aruba Instant Access Points
- 11
- Foxit PhantomPDF
- 11
- IBM Engineering Lifecycle Optimization · IBM Engineering… +2
- 3
- IBM Engineering Workflow Management · IBM Engineering Li… +2
- 3
- IBM UrbanCode Deploy
- 3
- Jenkins project Jenkins Team Foundation Server Plugin · org…
- 3
- OpenEXR
- 3
- Jenkins project Jenkins Build With Parameters Plugin · org.…
- 2
- Jenkins project Jenkins OWASP Dependency-Track Plugin · org…
- 2
- Apache Software Foundation Apache Druid · org.apache.druid:…
- 1
High 9
- CVE-2021-21413Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolatelaverdet isolated-vm · isolated-vm
- CVE-2021-20502IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Engineering Lifecycle Optimization · IBM Engineering… +2
- CVE-2021-20482IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML datIBM Cloud Pak for Automation
- CVE-2021-27271This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27269This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27270This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27268This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27267This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27261This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
Medium, low and unrated 69
- CVE-2020-24995Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary co
- CVE-2020-24391mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way.mongodb-query-parser
- CVE-2021-29646An issue was discovered in the Linux kernel before 5.11.11.
- CVE-2021-29647An issue was discovered in the Linux kernel before 5.11.11.
- CVE-2021-29648An issue was discovered in the Linux kernel before 5.11.11.
- CVE-2021-29649An issue was discovered in the Linux kernel before 5.11.11.
- CVE-2021-29650An issue was discovered in the Linux kernel before 5.11.11.
- CVE-2021-29642GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.
- CVE-2021-21412[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property valuesthi-ng egf · @thi.ng/egf
- CVE-2021-26579A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of HaHPE Unified Data Management
- CVE-2021-20520IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Engineering Workflow Management · IBM Engineering Li… +2
- CVE-2021-20518IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Engineering Lifecycle Optimization · IBM Engineering… +2
- CVE-2021-20506IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Engineering Lifecycle Optimization · IBM Engineering… +2
- CVE-2021-20504IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Rational Team Concert · IBM Rational Engineering Lif… +2
- CVE-2021-20503IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Engineering Workflow Management · IBM Engineering Li… +2
- CVE-2021-20447IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Rational Engineering Lifecycle Manager · IBM Rationa… +2
- CVE-2021-20352IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Engineering Workflow Management · IBM Engineering Li… +2
- CVE-2020-4944IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain teIBM UrbanCode Deploy
- CVE-2020-4884IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user.IBM UrbanCode Deploy
- CVE-2020-4848IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or compare process resourcesIBM UrbanCode Deploy
- CVE-2021-21398Possible XSS injection through DataColumn Grid classPrestaShop
- CVE-2021-21409Possible request smuggling in HTTP/2 due missing validation of content-lengthnetty · io.netty:netty-codec-http2 +2
- CVE-2021-23363Arbitrary Command Injectionkill-by-port
- CVE-2021-27266This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27265This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27263This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27264This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2021-27262This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527.Foxit PhantomPDF
- CVE-2020-15075OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmpOpenVPN Connect
- CVE-2021-26810D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability.
- CVE-2021-28935CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Titl
- CVE-2021-29343Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php.
- CVE-2021-21638A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect tJenkins project Jenkins Team Foundation Server Plugin · org…
- CVE-2021-21637A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to conJenkins project Jenkins Team Foundation Server Plugin · org…
- CVE-2021-21636A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enuJenkins project Jenkins Team Foundation Server Plugin · org…
- CVE-2021-21635Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a storeJenkins project Jenkins REST List Parameter Plugin · io.jen…
- CVE-2021-21634Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the JenkJenkins project Jenkins Jabber (XMPP) notifier and control…
- CVE-2021-21633A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to Jenkins project Jenkins OWASP Dependency-Track Plugin · org…
- CVE-2021-21632A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to conneJenkins project Jenkins OWASP Dependency-Track Plugin · org…
- CVE-2021-21631Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReJenkins project Jenkins Cloud Statistics Plugin · org.jenki…
- CVE-2021-21630Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-sJenkins project Jenkins Extra Columns Plugin · org.jenkins-…
- CVE-2021-21629A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a projecJenkins project Jenkins Build With Parameters Plugin · org.…
- CVE-2021-21628Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scriJenkins project Jenkins Build With Parameters Plugin · org.…
- CVE-2021-26919Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.Apache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2021-29376ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim fr
- CVE-2021-29418The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9.netmask
- CVE-2020-19643Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page
- CVE-2020-19642An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B.
- CVE-2020-19641An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B.
- CVE-2020-19640An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B.
- CVE-2020-19639Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.
- CVE-2020-20545Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSala
- CVE-2018-1110A flaw was found in knot-resolver before version 2.3.0.knot-resolver
- CVE-2018-1109A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1.nodejs-braces · braces
- CVE-2018-1107It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to havnodejs-is-my-json-valid · is-my-json-valid
- CVE-2019-5319A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: Aruba Instant Access Points
- CVE-2021-25161A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InstAruba Instant Access Points
- CVE-2021-25162A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): ArubaAruba Instant Access Points
- CVE-2021-25160A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InsAruba Instant Access Points
- CVE-2021-25159A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InsAruba Instant Access Points
- CVE-2021-25157A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4Aruba Instant Access Points
- CVE-2021-25158A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5Aruba Instant Access Points
- CVE-2021-25156A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InstAruba Instant Access Points
- CVE-2021-25155A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InsAruba Instant Access Points
- CVE-2021-25150A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): ArubaAruba Instant Access Points
- CVE-2021-25146A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): ArubaAruba Instant Access Points
- CVE-2021-3474There's a flaw in OpenEXR in versions before 3.0.0-beta.OpenEXR
- CVE-2021-3475There is a flaw in OpenEXR in versions before 3.0.0-beta.OpenEXR
- CVE-2021-3476A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta.OpenEXR