# CVEs published 2021-03-31

56 CVEs were published on March 31, 2021: 5 critical, 1 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-29349](https://cve.now/CVE-2021-29349.md): Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. (no CVSS)
- [CVE-2021-28994](https://cve.now/CVE-2021-28994.md): kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 (no CVSS)
- [CVE-2021-27220](https://cve.now/CVE-2021-27220.md): An issue was discovered in PRTG Network Monitor before 21.1.66.1623. (no CVSS)
- [CVE-2021-27349](https://cve.now/CVE-2021-27349.md): Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727. (no CVSS)
- [CVE-2020-24550](https://cve.now/CVE-2020-24550.md): An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the \_t\_redirec (no CVSS)
- [CVE-2021-22538](https://cve.now/CVE-2021-22538.md): Privilege escalation in RBAC system (CVSS 6.3, Google Exposure Notifications Verification Server · github.…)
- [CVE-2021-26943](https://cve.now/CVE-2021-26943.md): The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory loc (no CVSS)
- [CVE-2020-35308](https://cve.now/CVE-2020-35308.md): CONQUEST DICOM SERVER before 1.5.0 has a code execution vulnerability which can be exploited by attackers to execute malicious code. (no CVSS)
- [CVE-2021-29663](https://cve.now/CVE-2021-29663.md): CourseMS (aka Course Registration Management System) 2.1 is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2021-21975](https://cve.now/CVE-2021-21975.md): Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access (CVSS 9.8, KEV, VMware vRealize Operations)
- [CVE-2021-21983](https://cve.now/CVE-2021-21983.md): Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious act (no CVSS, VMware vRealize Operations)
- [CVE-2021-22993](https://cve.now/CVE-2021-22993.md): On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23006](https://cve.now/CVE-2021-23006.md): On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. (no CVSS, BIG-IQ)
- [CVE-2021-23007](https://cve.now/CVE-2021-23007.md): On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may st (no CVSS, BIG-IP)
- [CVE-2021-23005](https://cve.now/CVE-2021-23005.md): On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ do (no CVSS, BIG-IQ)
- [CVE-2021-23004](https://cve.now/CVE-2021-23004.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP)
- [CVE-2021-23001](https://cve.now/CVE-2021-23001.md): On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-22998](https://cve.now/CVE-2021-22998.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP)
- [CVE-2021-22997](https://cve.now/CVE-2021-22997.md): On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clusteri (no CVSS, BIG-IQ)
- [CVE-2021-21418](https://cve.now/CVE-2021-21418.md): Potential XSS injection in the newsletter conditions field (CVSS 4.6, PrestaShop ps\_emailsubscription · prestashop/ps\_emailsubscr…)
- [CVE-2021-22996](https://cve.now/CVE-2021-22996.md): On all 7.x versions (fixed in 8.0.0), when set up for auto failover, a BIG-IQ Data Collection Device (DCD) cluster member that receives an u (no CVSS, BIG-IQ)
- [CVE-2021-23002](https://cve.now/CVE-2021-23002.md): When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x (no CVSS, BIG-IP APM and Edge Client)
- [CVE-2021-22999](https://cve.now/CVE-2021-22999.md): On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x server (no CVSS, BIG-IP)
- [CVE-2021-29662](https://cve.now/CVE-2021-29662.md): The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address (no CVSS)
- [CVE-2021-23003](https://cve.now/CVE-2021-23003.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP)
- [CVE-2021-23000](https://cve.now/CVE-2021-23000.md): On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host (no CVSS, BIG-IP)
- [CVE-2021-22994](https://cve.now/CVE-2021-22994.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP)
- [CVE-2021-22991](https://cve.now/CVE-2021-22991.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, (CVSS 9.8, KEV, BIG-IP)
- [CVE-2021-29658](https://cve.now/CVE-2021-29658.md): The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a (no CVSS)
- [CVE-2021-22989](https://cve.now/CVE-2021-22989.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP Advanced WAF or BIG-IP ASM in Appliance Mode)
- [CVE-2021-22992](https://cve.now/CVE-2021-22992.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-22995](https://cve.now/CVE-2021-22995.md): On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not imple (no CVSS, BIG-IQ)
- [CVE-2021-22990](https://cve.now/CVE-2021-22990.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP Advanced WAF or BIG-IP ASM)
- [CVE-2021-22987](https://cve.now/CVE-2021-22987.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP Appliance Mode)
- [CVE-2021-23348](https://cve.now/CVE-2021-23348.md): Arbitrary Command Injection (CVSS 6.3, portprocesses)
- [CVE-2021-22986](https://cve.now/CVE-2021-22986.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 (CVSS 9.8, KEV, BIG-IP; BIG-IQ)
- [CVE-2021-22988](https://cve.now/CVE-2021-22988.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and (no CVSS, BIG-IP)
- [CVE-2021-21782](https://cve.now/CVE-2021-21782.md): An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2021-21776](https://cve.now/CVE-2021-21776.md): An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2021-21773](https://cve.now/CVE-2021-21773.md): An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. (CVSS 8.1, Accusoft)
- [CVE-2021-3470](https://cve.now/CVE-2021-3470.md): A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jem (no CVSS, redis)
- [CVE-2021-23981](https://cve.now/CVE-2021-23981.md): A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memo (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2021-23982](https://cve.now/CVE-2021-23982.md): Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as s (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2021-23983](https://cve.now/CVE-2021-23983.md): By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memo (no CVSS, Mozilla Firefox)
- [CVE-2021-23984](https://cve.now/CVE-2021-23984.md): A malicious extension could have opened a popup window lacking an address bar. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2021-23985](https://cve.now/CVE-2021-23985.md): If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debug (no CVSS, Mozilla Firefox)
- [CVE-2021-23986](https://cve.now/CVE-2021-23986.md): A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. (no CVSS, Mozilla Firefox)
- [CVE-2021-23987](https://cve.now/CVE-2021-23987.md): Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2021-23988](https://cve.now/CVE-2021-23988.md): Mozilla developers reported memory safety bugs present in Firefox 86. (no CVSS, Mozilla Firefox)
- [CVE-2021-28245](https://cve.now/CVE-2021-28245.md): PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information throu (no CVSS)
- [CVE-2020-28173](https://cve.now/CVE-2020-28173.md): Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save\_settings when uploading a m (no CVSS)
- [CVE-2020-28172](https://cve.now/CVE-2020-28172.md): A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mecha (no CVSS)
- [CVE-2021-28657](https://cve.now/CVE-2021-28657.md): Infinite loop in Apache Tika's MP3 parser (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2021-3477](https://cve.now/CVE-2021-3477.md): There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. (no CVSS, OpenEXR)
- [CVE-2021-3478](https://cve.now/CVE-2021-3478.md): There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. (no CVSS, OpenEXR)
- [CVE-2021-3479](https://cve.now/CVE-2021-3479.md): There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. (no CVSS, OpenEXR)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.