CVE-2021 records published in March 2021
Page two of two: records 1,001 to 1,134 of the 1,134 published in March 2021, newest first. The first page carries the figures for March 2021.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2021-26027 | Joomla! CMS core ACL violation within com_content frontend editing | 5.3v3.1 | 0.9% | 2021-03-04 | Fix |
| CVE-2021-25348 | Samsung Mobile Samsung Internet improper permissions | 2.1CNA v3.1 | 0.3% | 2021-03-04 | Fix |
| CVE-2021-25347 | Samsung Mobile Devices improper authentication | 5.3CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25346 | Samsung Mobile Devices out-of-bounds write | 7.1CNA v3.1 | 1.3% | 2021-03-04 | Fix |
| CVE-2021-25345 | Samsung Mobile Devices kernel panic | 4.0CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25344 | Samsung Mobile Devices knox_custom service missing authorization | 6.2CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25343 | Samsung Mobile Samsung Members improper authentication | 4.0CNA v3.1 | 0.2% | 2021-03-04 | Fix |
| CVE-2021-25342 | Samsung Mobile SMP sdk improper authentication | 4.0CNA v3.1 | 0.2% | 2021-03-04 | Fix |
| CVE-2021-25341 | Samsung Mobile S Assistant improper authentication | 4.0CNA v3.1 | 0.2% | 2021-03-04 | Fix |
| CVE-2021-25340 | Samsung Mobile Devices Samsung keyboard version improper access control | 5.1CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25339 | Samsung Mobile Devices improper input validation | 4.4CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25338 | Samsung Mobile Devices improper input validation | 4.4CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25337 | Samsung Mobile Devices improper access control | 4.4CNA v3.1 | 2.8% | 2021-03-04 | KEVExploit codeKCVFix |
| CVE-2021-25336 | Samsung Mobile Devices NotificationManagerService improper access control | 2.8CNA v3.1 | 0.2% | 2021-03-04 | Fix |
| CVE-2021-25335 | Samsung Mobile Devices improper exception handling | 2.5CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25334 | Samsung Mobile Devices denial of service | 5.5CNA v3.1 | 0.1% | 2021-03-04 | Fix |
| CVE-2021-25333 | Samsung Mobile Samsung Pay Mini improper access control | 3.2CNA v3.1 | 0.3% | 2021-03-04 | Fix |
| CVE-2021-25332 | Samsung Mobile Samsung Pay Mini improper access control | 3.2CNA v3.1 | 0.3% | 2021-03-04 | Fix |
| CVE-2021-25331 | Samsung Mobile Samsung Pay Mini improper access control | 3.2CNA v3.1 | 0.3% | 2021-03-04 | Fix |
| CVE-2021-24032 | Facebook Zstandard insecure inherited permissions | 4.7NVD v3.1 | 0.3% | 2021-03-04 | Fix |
| CVE-2021-24031 | Facebook Zstandard insecure inherited permissions | 5.5v3.1 | 0.4% | 2021-03-04 | Fix |
| CVE-2021-23346 | html-parse-stringify regular expression denial of service (ReDoS) | 5.3v3.1 | 2.1% | 2021-03-04 | Fix |
| CVE-2021-23344 | total.js remote code execution (RCE) | 9.8v3.1 | 4.9% | 2021-03-04 | Fix |
| CVE-2021-23132 | Joomla! CMS core com_media allowed paths that are not intended for image uploads | 7.5v3.1 | 6.5% | 2021-03-04 | Exploit codeFix |
| CVE-2021-23131 | Joomla! CMS core Input validation within the template manager | 7.5v3.1 | 1.3% | 2021-03-04 | Fix |
| CVE-2021-23130 | Joomla! CMS core XSS within the feed parser library | 6.1v3.1 | 0.8% | 2021-03-04 | Fix |
| CVE-2021-23129 | Joomla! CMS core XSS within alert messages showed to users | 6.1v3.1 | 0.8% | 2021-03-04 | Fix |
| CVE-2021-23128 | Joomla! CMS core potential Insecure FOFEncryptRandval | 9.1v3.1 | 1.3% | 2021-03-04 | Fix |
| CVE-2021-23127 | Joomla! CMS core Insecure randomness within 2FA secret generation | 9.1v3.1 | 1.3% | 2021-03-04 | Fix |
| CVE-2021-23126 | Joomla! CMS core Insecure randomness within 2FA secret generation | 5.3v3.1 | 1.1% | 2021-03-04 | Fix |
| CVE-2021-22189 | GitLab improper certificate validation | 5.9CNA v3.1 | 0.7% | 2021-03-04 | Fix |
| CVE-2021-22183 | GitLab cross-site scripting | 4.1CNA v3.1 | 0.8% | 2021-03-04 | Fix |
| CVE-2021-22128 | Fortinet FortiProxy An improper access control | 7.1CNA v3.1 | 1.0% | 2021-03-04 | Fix |
| CVE-2021-20351 | IBM Rational Team Concert cross-site scripting | 5.4CNA v3.0 | 0.6% | 2021-03-04 | Fix |
| CVE-2021-20350 | IBM Rational Quality Manager cross-site scripting | 5.4CNA v3.0 | 0.6% | 2021-03-04 | Fix |
| CVE-2021-20340 | IBM Rational DOORS Next Generation cross-site scripting | 5.4CNA v3.0 | 0.6% | 2021-03-04 | Fix |
| CVE-2021-3404 | ytnef heap-based buffer overflow | 7.8NVD v3.1 | 1.9% | 2021-03-04 | Fix |
| CVE-2021-3403 | ytnef use-after-free | 7.8NVD v3.1 | 1.8% | 2021-03-04 | Fix |
| CVE-2021-27940 | Openark/Orchestrator cross-site scripting | 6.1v3.1 | 1.2% | 2021-03-03 | Fix |
| CVE-2021-27935 | AdGuardHome insufficiently protected credentials | 7.5v3.1 | 5.0% | 2021-03-03 | |
| CVE-2021-27931 | Lumis Experience Platform XML external entity injection | 9.1v3.1 | 18.6% | 2021-03-03 | Nuclei |
| CVE-2021-27927 | Zabbix cross-site request forgery | 8.8v3.1 | 2.2% | 2021-03-03 | Fix |
| CVE-2021-27923 | Pillow denial of service by uncontrolled resource consumption | 7.5v3.1 | 3.1% | 2021-03-03 | Fix |
| CVE-2021-27922 | Pillow uncontrolled resource consumption | 7.5v3.1 | 4.9% | 2021-03-03 | Fix |
| CVE-2021-27921 | Pillow denial of service by uncontrolled resource consumption | 7.5v3.1 | 3.1% | 2021-03-03 | Fix |
| CVE-2021-27839 | BigProf Online Invoicing System A CSV injection | 4.4v3.1 | 0.7% | 2021-03-03 | Fix |
| CVE-2021-27215 | Genuagate missing authentication | 9.8v3.1 | 2.3% | 2021-03-03 | Fix |
| CVE-2021-26813 | Markdown2 regular expression denial of service | 7.5v3.1 | 2.2% | 2021-03-03 | Fix |
| CVE-2021-25315 | SaltStack Salt salt-api unauthenticated remote code execution | 9.8CNA v3.1 | 2.3% | 2021-03-03 | Fix |
| CVE-2021-25252 | Trend Micro Virus Scan API (VSAPI) Engine resource exhaustion | 5.5v3.1 | 0.6% | 2021-03-03 | Fix |
| CVE-2021-23347 | github.com/argoproj/argo-cd/cmd cross-site scripting (XSS) | 4.8v3.1 | 0.5% | 2021-03-03 | Fix |
| CVE-2021-22884 | Node.js DNS rebinding protection vulnerability | 7.5v3.1 | 36.8% | 2021-03-03 | Fix |
| CVE-2021-22883 | Node.js Node denial of service | 7.5v3.1 | 77.4% | 2021-03-03 | Fix |
| CVE-2021-22878 | Nextcloud Server cross-site scripting | 4.8v3.1 | 1.1% | 2021-03-03 | Fix |
| CVE-2021-22877 | Nextcloud Server improper access control | 6.5v3.1 | 1.7% | 2021-03-03 | Fix |
| CVE-2021-22863 | GitHub Enterprise Server GraphQL API improper access control | 8.1v3.1 | 1.0% | 2021-03-03 | Fix |
| CVE-2021-22862 | GitHub Enterprise Server Actions secrets information disclosure | 6.5v3.1 | 0.8% | 2021-03-03 | Fix |
| CVE-2021-22861 | GitHub Enterprise Server pull request API improper access control | 6.5v3.1 | 0.9% | 2021-03-03 | Fix |
| CVE-2021-22683 | Fatek FvDesigner out-of-bounds write | 7.8v3.1 | 1.0% | 2021-03-03 | |
| CVE-2021-22681 | Rockwell Multiple Products insufficiently protected credentials | 9.8v3.1 | 63.6% | 2021-03-03 | KEVExploit code |
| CVE-2021-22670 | Fatek FvDesigner An uninitialized pointer use | 7.8v3.1 | 1.0% | 2021-03-03 | |
| CVE-2021-22666 | Fatek FvDesigner stack-based buffer overflow | 7.8v3.1 | 1.1% | 2021-03-03 | |
| CVE-2021-22662 | Fatek FvDesigner use-after-free | 7.8v3.1 | 1.1% | 2021-03-03 | |
| CVE-2021-22638 | Fatek FvDesigner out-of-bounds read | 7.8v3.1 | 1.0% | 2021-03-03 | |
| CVE-2021-22188 | GitLab branch logs vulnerability | 5.3CNA v3.1 | 1.5% | 2021-03-03 | Fix |
| CVE-2021-22182 | GitLab cross-site scripting | 3.5CNA v3.1 | 1.0% | 2021-03-03 | Fix |
| CVE-2021-21979 | Bitnami Containers hard-coded credentials | 7.3v3.1 | 0.6% | 2021-03-03 | |
| CVE-2021-21978 | VMware View Planner missing authorization | 9.8v3.1 | 99.0% | 2021-03-03 | NucleiMetasploitEmerging ThreatsExploit codeFix |
| CVE-2021-21353 | Remote code execution in pug | 6.8CNA v3.1 | 4.3% | 2021-03-03 | Exploit codeFix |
| CVE-2021-21352 | anuko timetracker predictable tokens used for password resets | 6.8CNA v3.1 | 1.5% | 2021-03-03 | Fix |
| CVE-2021-21331 | DataDog API client contains a local information disclosure | 3.0CNA v3.1 | 0.6% | 2021-03-03 | Fix |
| CVE-2021-21314 | GLPI cross-site scripting | 5.4CNA v3.1 | 0.6% | 2021-03-03 | Fix |
| CVE-2021-21313 | GLPI common.tabs.php cross-site scripting | 4.9CNA v3.1 | 0.9% | 2021-03-03 | Fix |
| CVE-2021-21312 | glpi stored XSS on documents | 5.4CNA v3.1 | 0.6% | 2021-03-03 | Fix |
| CVE-2021-20442 | IBM Security Verify Bridge hard-coded credentials | 5.9CNA v3.0 | 1.0% | 2021-03-03 | Fix |
| CVE-2021-20441 | IBM Security Verify Bridge weak cryptographic algorithm | 5.9CNA v3.0 | 0.8% | 2021-03-03 | Fix |
| CVE-2021-20233 | grub2 out-of-bounds write | 8.2NVD v3.1 | 0.6% | 2021-03-03 | Fix |
| CVE-2021-20225 | grub2 out-of-bounds write | 6.7NVD v3.1 | 1.0% | 2021-03-03 | Fix |
| CVE-2021-20076 | Tenable.sc deserialization of untrusted data | 8.8NVD v3.1 | 2.1% | 2021-03-03 | |
| CVE-2021-2138 | Vulnerability in the Oracle Cloud Infrastructure Data Science Notebook Sessions. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Cloud Infrastructure Data Science Notebook Sessions executes to | 4.6CNA v3.1 | 0.5% | 2021-03-03 | |
| CVE-2021-27904 | MISP sharing groups vulnerability | 5.5v3.1 | 0.3% | 2021-03-02 | |
| CVE-2021-27901 | An issue was discovered on LG mobile devices with Android OS 11 software. They mishandle fingerprint recognition because local high beam mode (LHBM) does not function properly during bright illumination. The LG ID is LVE-SMP-210001 (March 2021). | 6.8v3.1 | 0.1% | 2021-03-02 | |
| CVE-2021-27888 | ZendTo cross-site scripting | 6.1v3.1 | 0.6% | 2021-03-02 | Fix |
| CVE-2021-27886 | Docker Dashboard OS command injection | 9.8v3.1 | 45.6% | 2021-03-02 | |
| CVE-2021-27885 | e107 cross-site request forgery | 8.8v3.1 | 3.2% | 2021-03-02 | Exploit codeFix |
| CVE-2021-27804 | libjxl out-of-bounds write | 9.8v3.1 | 4.0% | 2021-03-02 | |
| CVE-2021-27731 | Accellion FTA cross-site scripting | 6.1v3.1 | 0.7% | 2021-03-02 | |
| CVE-2021-27730 | Accellion FTA argument injection | 9.8v3.1 | 1.4% | 2021-03-02 | |
| CVE-2021-27078 | Microsoft Exchange Server remote code execution | 9.1CNA v3.1 | 21.6% | 2021-03-02 | Fix |
| CVE-2021-27065 | Microsoft Exchange Server remote code execution | 7.8CNA v3.1 | 99.9% | 2021-03-02 | KEVMetasploitEmerging ThreatsSnortExploit codeKCVFix |
| CVE-2021-26858 | Microsoft Exchange Server remote code execution | 7.8CNA v3.1 | 93.7% | 2021-03-02 | KEVKCVFix |
| CVE-2021-26857 | Microsoft Exchange Server remote code execution | 7.8CNA v3.1 | 95.8% | 2021-03-02 | KEVExploit codeKCVFix |
| CVE-2021-26855 | Microsoft Exchange Server remote code execution | 9.1CNA v3.1 | 100.0% | 2021-03-02 | KEVNucleiMetasploitExploit codeKCVFix |
| CVE-2021-26854 | Microsoft Exchange Server remote code execution | 6.6CNA v3.1 | 24.7% | 2021-03-02 | Fix |
| CVE-2021-26412 | Microsoft Exchange Server remote code execution | 9.1CNA v3.1 | 33.8% | 2021-03-02 | Fix |
| CVE-2021-25330 | Samsung Mobile Devices unauthorized access | 7.5v3.1 | 0.4% | 2021-03-02 | Fix |
| CVE-2021-25309 | Gigaset DX600A missing brute-force protection | 9.8v3.1 | 1.3% | 2021-03-02 | |
| CVE-2021-25306 | Gigaset DX600A AT command interface buffer overflow | 7.5v3.1 | 1.5% | 2021-03-02 | |
| CVE-2021-22296 | HarmonyOS denial of service | 5.5v3.1 | 0.2% | 2021-03-02 | Fix |
| CVE-2021-22294 | HarmonyOS insecure permissions | 3.3v3.1 | 0.2% | 2021-03-02 | |
| CVE-2021-22187 | GitLab resource exhaustion | 4.3CNA v3.1 | 1.0% | 2021-03-02 | Fix |
| CVE-2021-21514 | Dell OpenManage Server Administrator path traversal | 4.9CNA v3.1 | 5.4% | 2021-03-02 | Fix |
| CVE-2021-21513 | Dell OpenManage Server Administrator improper authentication | 8.6CNA v3.1 | 5.9% | 2021-03-02 | Fix |
| CVE-2021-21322 | fastify-http-proxy proxy prefix vulnerability | 10.0CNA v3.1 | 1.6% | 2021-03-02 | Fix |
| CVE-2021-21321 | fastify-reply-from proxy prefix vulnerability | 10.0CNA v3.1 | 1.8% | 2021-03-02 | Fix |
| CVE-2021-21320 | matrix-org matrix-react-sdk user content sandbox can be confused into opening arbitrary documents | 2.6CNA v3.1 | 0.9% | 2021-03-02 | Fix |
| CVE-2021-21258 | glpi XSS injection in ajax/kanban | 6.8CNA v3.1 | 0.7% | 2021-03-02 | Fix |
| CVE-2021-21255 | glpi entities switch IDOR | 5.8CNA v3.1 | 0.9% | 2021-03-02 | |
| CVE-2021-3384 | Stormshield Network Security ARP and NDP table management vulnerability | 5.3v3.1 | 1.0% | 2021-03-02 | Fix |
| CVE-2021-27884 | Ymfe Yapi Weak JSON Web Token in yapi-vendor | 5.1v3.1 | 0.3% | 2021-03-01 | Fix |
| CVE-2021-27878 | Veritas Backup Exec Agent command execution | 8.8v3.1 | 24.0% | 2021-03-01 | KEVMetasploitExploit codeKCVFix |
| CVE-2021-27877 | Veritas Backup Exec Agent improper authentication | 9.8v3.1 | 64.9% | 2021-03-01 | KEVNucleiMetasploitExploit codeFix |
| CVE-2021-27876 | Veritas Backup Exec Agent arbitrary file access | 8.1v3.1 | 13.5% | 2021-03-01 | KEVMetasploitExploit codeKCVFix |
| CVE-2021-27318 | Doctor Appointment System contactus.php cross-site scripting | 6.1v3.1 | 1.5% | 2021-03-01 | |
| CVE-2021-27317 | Doctor Appointment System contactus.php cross-site scripting | 6.1v3.1 | 1.3% | 2021-03-01 | |
| CVE-2021-27225 | Dataiku DATA Science Studio incorrect authorization | 5.4v3.1 | 0.5% | 2021-03-01 | Fix |
| CVE-2021-26704 | Eprints OS command injection | 8.8v3.1 | 3.1% | 2021-03-01 | Fix |
| CVE-2021-26703 | Eprints XML external entity injection | 9.8v3.1 | 4.0% | 2021-03-01 | Fix |
| CVE-2021-26702 | Eprints cross-site scripting | 6.1v3.1 | 3.1% | 2021-03-01 | NucleiFix |
| CVE-2021-26476 | Eprints OS command injection | 9.8v3.1 | 3.1% | 2021-03-01 | Fix |
| CVE-2021-26475 | Eprints cross-site scripting | 6.1v3.1 | 7.3% | 2021-03-01 | NucleiFix |
| CVE-2021-25914 | Prototype pollution vulnerability in object-collider | 9.8v3.1 | 3.7% | 2021-03-01 | Fix |
| CVE-2021-25833 | ONLYOFFICE Document Server path traversal | 9.8v3.1 | 43.5% | 2021-03-01 | |
| CVE-2021-25832 | ONLYOFFICE Document Server out-of-bounds write | 9.8v3.1 | 12.6% | 2021-03-01 | |
| CVE-2021-25831 | ONLYOFFICE Document Server remote code execution | 9.8v3.1 | 11.5% | 2021-03-01 | |
| CVE-2021-25830 | ONLYOFFICE Document Server remote code execution | 9.8v3.1 | 11.8% | 2021-03-01 | |
| CVE-2021-25829 | ONLYOFFICE Document Server denial of service | 7.5v3.1 | 7.4% | 2021-03-01 | |
| CVE-2021-25329 | Potential remote code execution in Apache Tomcat | 7.0NVD v3.1 | 9.5% | 2021-03-01 | Fix |
| CVE-2021-25122 | Apache Tomcat h2c request mix-up | 7.5NVD v3.1 | 18.1% | 2021-03-01 | Fix |
| CVE-2021-22114 | Spring Integration Zip extension path traversal in Spring-integration-zip | 5.3v3.1 | 1.0% | 2021-03-01 | Fix |
| CVE-2021-21517 | Dell SRS Policy Manager XML external entity injection | 7.2CNA v3.1 | 1.5% | 2021-03-01 | Fix |
| CVE-2021-21515 | Dell SourceOne cross-site scripting | 9.0CNA v3.1 | 0.8% | 2021-03-01 | Fix |
| CVE-2021-3342 | Eprints OS command injection | 9.8v3.1 | 4.2% | 2021-03-01 | Fix |
| CVE-2021-3332 | Wpserveur WPS Hide Login improper authentication | 5.3v3.1 | 1.8% | 2021-03-01 |