CVEs published March 31, 2021
56 CVEs were published on March 31, 2021: 5 critical, 1 high. 3 are now in CISA KEV.
- Published
- 56
- Critical
- 5
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 3
- Fix available
- 12
Most affected products
- BIG-IP
- 9
- BIG-IQ
- 5
- Mozilla Firefox
- 4
- Mozilla Firefox ESR · Mozilla Firefox +1
- 4
- Accusoft
- 3
- BIG-IP Advanced WAF and BIG-IP ASM
- 3
- OpenEXR
- 3
- VMware vRealize Operations
- 2
- Apache Software Foundation Apache Tika · org.apache.tika:ti…
- 1
- BIG-IP Advanced WAF or BIG-IP ASM
- 1
Critical 5
- CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network accessVMware vRealize Operations
- CVE-2021-22991On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3,BIG-IP
- CVE-2021-22986On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 BIG-IP; BIG-IQ
- CVE-2021-21782An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8.Accusoft
- CVE-2021-21776An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8.Accusoft
High 1
Medium, low and unrated 50
- CVE-2021-29349Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server.
- CVE-2021-28994kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1
- CVE-2021-27220An issue was discovered in PRTG Network Monitor before 21.1.66.1623.
- CVE-2021-27349Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.
- CVE-2020-24550An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirec
- CVE-2021-22538Privilege escalation in RBAC systemGoogle Exposure Notifications Verification Server · github.…
- CVE-2021-26943The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory loc
- CVE-2020-35308CONQUEST DICOM SERVER before 1.5.0 has a code execution vulnerability which can be exploited by attackers to execute malicious code.
- CVE-2021-29663CourseMS (aka Course Registration Management System) 2.1 is affected by cross-site scripting (XSS).
- CVE-2021-21983Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actVMware vRealize Operations
- CVE-2021-22993On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6,BIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23006On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability.BIG-IQ
- CVE-2021-23007On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may stBIG-IP
- CVE-2021-23005On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ doBIG-IQ
- CVE-2021-23004On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP
- CVE-2021-23001On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.xBIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-22998On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP
- CVE-2021-22997On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clusteriBIG-IQ
- CVE-2021-21418Potential XSS injection in the newsletter conditions fieldPrestaShop ps_emailsubscription · prestashop/ps_emailsubscr…
- CVE-2021-22996On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an uBIG-IQ
- CVE-2021-23002When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.xBIG-IP APM and Edge Client
- CVE-2021-22999On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x serverBIG-IP
- CVE-2021-29662The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address
- CVE-2021-23003On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP
- CVE-2021-23000On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host BIG-IP
- CVE-2021-22994On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP
- CVE-2021-29658The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a
- CVE-2021-22989On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP Advanced WAF or BIG-IP ASM in Appliance Mode
- CVE-2021-22992On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-22995On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not impleBIG-IQ
- CVE-2021-22990On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP Advanced WAF or BIG-IP ASM
- CVE-2021-22987On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP Appliance Mode
- CVE-2021-23348Arbitrary Command Injectionportprocesses
- CVE-2021-22988On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, andBIG-IP
- CVE-2021-3470A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemredis
- CVE-2021-23981A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memoMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2021-23982Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as sMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2021-23983By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memoMozilla Firefox
- CVE-2021-23984A malicious extension could have opened a popup window lacking an address bar.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2021-23985If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugMozilla Firefox
- CVE-2021-23986A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL.Mozilla Firefox
- CVE-2021-23987Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2021-23988Mozilla developers reported memory safety bugs present in Firefox 86.Mozilla Firefox
- CVE-2021-28245PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information throu
- CVE-2020-28173Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a m
- CVE-2020-28172A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mecha
- CVE-2021-28657Infinite loop in Apache Tika's MP3 parserApache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2021-3477There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta.OpenEXR
- CVE-2021-3478There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta.OpenEXR
- CVE-2021-3479There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta.OpenEXR