# CVEs published 2021-03-30

78 CVEs were published on March 30, 2021: 0 critical, 9 high. Days are UTC.

- [CVE-2021-21413](https://cve.now/CVE-2021-21413.md): Misuse of \`Reference\` and other transferable APIs may lead to access to nodejs isolate (CVSS 8.0, laverdet isolated-vm · isolated-vm)
- [CVE-2020-24995](https://cve.now/CVE-2020-24995.md): Buffer overflow vulnerability in sniff\_channel\_order function in aacdec\_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary co (no CVSS)
- [CVE-2020-24391](https://cve.now/CVE-2020-24391.md): mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. (no CVSS, mongodb-query-parser)
- [CVE-2021-29646](https://cve.now/CVE-2021-29646.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29647](https://cve.now/CVE-2021-29647.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29648](https://cve.now/CVE-2021-29648.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29649](https://cve.now/CVE-2021-29649.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29650](https://cve.now/CVE-2021-29650.md): An issue was discovered in the Linux kernel before 5.11.11. (no CVSS)
- [CVE-2021-29642](https://cve.now/CVE-2021-29642.md): GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens. (no CVSS)
- [CVE-2021-21412](https://cve.now/CVE-2021-21412.md): \[thi.ng/egf\] Potential arbitrary code execution of \`#gpg\`-tagged property values (CVSS 6.4, thi-ng egf · @thi.ng/egf)
- [CVE-2021-26579](https://cve.now/CVE-2021-26579.md): A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Ha (no CVSS, HPE Unified Data Management)
- [CVE-2021-20520](https://cve.now/CVE-2021-20520.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Engineering Li… +2)
- [CVE-2021-20518](https://cve.now/CVE-2021-20518.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Lifecycle Optimization · IBM Engineering… +2)
- [CVE-2021-20506](https://cve.now/CVE-2021-20506.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Lifecycle Optimization · IBM Engineering… +2)
- [CVE-2021-20504](https://cve.now/CVE-2021-20504.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert · IBM Rational Engineering Lif… +2)
- [CVE-2021-20503](https://cve.now/CVE-2021-20503.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Engineering Li… +2)
- [CVE-2021-20502](https://cve.now/CVE-2021-20502.md): IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Engineering Lifecycle Optimization · IBM Engineering… +2)
- [CVE-2021-20447](https://cve.now/CVE-2021-20447.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Engineering Lifecycle Manager · IBM Rationa… +2)
- [CVE-2021-20352](https://cve.now/CVE-2021-20352.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Engineering Li… +2)
- [CVE-2021-20482](https://cve.now/CVE-2021-20482.md): IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML dat (CVSS 7.1, IBM Cloud Pak for Automation)
- [CVE-2020-4944](https://cve.now/CVE-2020-4944.md): IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain te (CVSS 5.1, IBM UrbanCode Deploy)
- [CVE-2020-4884](https://cve.now/CVE-2020-4884.md): IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user. (CVSS 6.2, IBM UrbanCode Deploy)
- [CVE-2020-4848](https://cve.now/CVE-2020-4848.md): IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or compare process resources (CVSS 5.4, IBM UrbanCode Deploy)
- [CVE-2021-21398](https://cve.now/CVE-2021-21398.md): Possible XSS injection through DataColumn Grid class (CVSS 5.4, PrestaShop)
- [CVE-2021-21409](https://cve.now/CVE-2021-21409.md): Possible request smuggling in HTTP/2 due missing validation of content-length (CVSS 5.9, netty · io.netty:netty-codec-http2 +2)
- [CVE-2021-23363](https://cve.now/CVE-2021-23363.md): Arbitrary Command Injection (CVSS 6.3, kill-by-port)
- [CVE-2021-27271](https://cve.now/CVE-2021-27271.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27269](https://cve.now/CVE-2021-27269.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27270](https://cve.now/CVE-2021-27270.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27268](https://cve.now/CVE-2021-27268.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27266](https://cve.now/CVE-2021-27266.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27267](https://cve.now/CVE-2021-27267.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-27265](https://cve.now/CVE-2021-27265.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27263](https://cve.now/CVE-2021-27263.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27264](https://cve.now/CVE-2021-27264.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27262](https://cve.now/CVE-2021-27262.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2021-27261](https://cve.now/CVE-2021-27261.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2020-15075](https://cve.now/CVE-2020-15075.md): OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp (no CVSS, OpenVPN Connect)
- [CVE-2021-26810](https://cve.now/CVE-2021-26810.md): D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. (no CVSS)
- [CVE-2021-28935](https://cve.now/CVE-2021-28935.md): CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin \> My Preferences \> Titl (no CVSS)
- [CVE-2021-29343](https://cve.now/CVE-2021-29343.md): Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php. (no CVSS)
- [CVE-2021-21638](https://cve.now/CVE-2021-21638.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect t (no CVSS, Jenkins project Jenkins Team Foundation Server Plugin · org…)
- [CVE-2021-21637](https://cve.now/CVE-2021-21637.md): A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to con (no CVSS, Jenkins project Jenkins Team Foundation Server Plugin · org…)
- [CVE-2021-21636](https://cve.now/CVE-2021-21636.md): A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enu (no CVSS, Jenkins project Jenkins Team Foundation Server Plugin · org…)
- [CVE-2021-21635](https://cve.now/CVE-2021-21635.md): Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a store (no CVSS, Jenkins project Jenkins REST List Parameter Plugin · io.jen…)
- [CVE-2021-21634](https://cve.now/CVE-2021-21634.md): Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenk (no CVSS, Jenkins project Jenkins Jabber (XMPP) notifier and control…)
- [CVE-2021-21633](https://cve.now/CVE-2021-21633.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to (no CVSS, Jenkins project Jenkins OWASP Dependency-Track Plugin · org…)
- [CVE-2021-21632](https://cve.now/CVE-2021-21632.md): A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to conne (no CVSS, Jenkins project Jenkins OWASP Dependency-Track Plugin · org…)
- [CVE-2021-21631](https://cve.now/CVE-2021-21631.md): Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Re (no CVSS, Jenkins project Jenkins Cloud Statistics Plugin · org.jenki…)
- [CVE-2021-21630](https://cve.now/CVE-2021-21630.md): Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-s (no CVSS, Jenkins project Jenkins Extra Columns Plugin · org.jenkins-…)
- [CVE-2021-21629](https://cve.now/CVE-2021-21629.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a projec (no CVSS, Jenkins project Jenkins Build With Parameters Plugin · org.…)
- [CVE-2021-21628](https://cve.now/CVE-2021-21628.md): Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scri (no CVSS, Jenkins project Jenkins Build With Parameters Plugin · org.…)
- [CVE-2021-26919](https://cve.now/CVE-2021-26919.md): Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. (no CVSS, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2021-29376](https://cve.now/CVE-2021-29376.md): ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim fr (no CVSS)
- [CVE-2021-29418](https://cve.now/CVE-2021-29418.md): The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. (no CVSS, netmask)
- [CVE-2020-19643](https://cve.now/CVE-2020-19643.md): Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page (no CVSS)
- [CVE-2020-19642](https://cve.now/CVE-2020-19642.md): An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. (no CVSS)
- [CVE-2020-19641](https://cve.now/CVE-2020-19641.md): An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. (no CVSS)
- [CVE-2020-19640](https://cve.now/CVE-2020-19640.md): An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. (no CVSS)
- [CVE-2020-19639](https://cve.now/CVE-2020-19639.md): Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI. (no CVSS)
- [CVE-2020-20545](https://cve.now/CVE-2020-20545.md): Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSala (no CVSS)
- [CVE-2018-1110](https://cve.now/CVE-2018-1110.md): A flaw was found in knot-resolver before version 2.3.0. (no CVSS, knot-resolver)
- [CVE-2018-1109](https://cve.now/CVE-2018-1109.md): A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. (no CVSS, nodejs-braces · braces)
- [CVE-2018-1107](https://cve.now/CVE-2018-1107.md): It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to hav (no CVSS, nodejs-is-my-json-valid · is-my-json-valid)
- [CVE-2019-5319](https://cve.now/CVE-2019-5319.md): A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25161](https://cve.now/CVE-2021-25161.md): A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Inst (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25162](https://cve.now/CVE-2021-25162.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25160](https://cve.now/CVE-2021-25160.md): A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Ins (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25159](https://cve.now/CVE-2021-25159.md): A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Ins (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25157](https://cve.now/CVE-2021-25157.md): A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4 (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25158](https://cve.now/CVE-2021-25158.md): A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5 (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25156](https://cve.now/CVE-2021-25156.md): A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Inst (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25155](https://cve.now/CVE-2021-25155.md): A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Ins (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25150](https://cve.now/CVE-2021-25150.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba (no CVSS, Aruba Instant Access Points)
- [CVE-2021-25146](https://cve.now/CVE-2021-25146.md): A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba (no CVSS, Aruba Instant Access Points)
- [CVE-2021-3474](https://cve.now/CVE-2021-3474.md): There's a flaw in OpenEXR in versions before 3.0.0-beta. (no CVSS, OpenEXR)
- [CVE-2021-3475](https://cve.now/CVE-2021-3475.md): There is a flaw in OpenEXR in versions before 3.0.0-beta. (no CVSS, OpenEXR)
- [CVE-2021-3476](https://cve.now/CVE-2021-3476.md): A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. (no CVSS, OpenEXR)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.