Skip to content
OpenAdvisories

Archive

March 2021

Vulnerabilities first published in this month (UTC), newest first.

← February 2021 2021 / March April 2021 →
  1. 130
  2. 239
  3. 357
  4. 467
  5. 561
  6. 61
  7. 76
  8. 826
  9. 990
  10. 10102
  11. 11121
  12. 1247
  13. 135
  14. 14 
  15. 1565
  16. 1622
  17. 1739
  18. 1896
  19. 1942
  20. 206
  21. 216
  22. 2251
  23. 2366
  24. 2486
  25. 2571
  26. 2672
  27. 272
  28. 28 
  29. 2945
  30. 3078
  31. 3156
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.9
    CVE-2021-3449 Public exploit EPSS 64%

    NULL pointer deref in signature_algorithms processing

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io
  • Medium 6.1
    CVE-2021-21349 Public exploit EPSS 47%

    A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the…

    x-stream xstream libxstream-java libxstream-java Debian Ubuntu Maven
  • Medium 5.8
    CVE-2021-21345 Public exploit EPSS 72%

    XStream is vulnerable to a Remote Command Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 6.5
    CVE-2020-27838 Public exploit EPSS 18%

    Keycloak discloses information without authentication

    A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL l…

    org.keycloak:keycloak-core Maven
  • Medium 5.7
    CVE-2021-21337 Public exploit

    URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

    Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality c…

    zopefoundation Products.PluggableAuthService products-pluggableauthservice PyPI
  • Medium 6.7
    CVE-2020-5014 Public exploit

    IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary co…

    IBM DataPower Gateway
  • Medium 4.4
    CVE-2021-25337 Exploited Public exploit

    Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…

    Samsung Mobile Samsung Mobile Devices
    KEV Nov 8, 2022
  • Medium 6.8
    CVE-2021-21353 Public exploit

    Remote code execution in pug

    Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a reque…

    pugjs pug pug pug-code-gen npm
  • Medium 4.9
    CVE-2021-21514 Public exploit

    Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote…

    Dell Dell Open Manage Server Administrator