Skip to content
OpenAdvisories

Archive

March 2021

Vulnerabilities first published in this month (UTC), newest first.

← February 2021 2021 / March April 2021 →
  1. 130
  2. 239
  3. 357
  4. 467
  5. 561
  6. 61
  7. 76
  8. 826
  9. 990
  10. 10102
  11. 11121
  12. 1247
  13. 135
  14. 14 
  15. 1565
  16. 1622
  17. 1739
  18. 1896
  19. 1942
  20. 206
  21. 216
  22. 2251
  23. 2366
  24. 2486
  25. 2571
  26. 2672
  27. 272
  28. 28 
  29. 2945
  30. 3078
  31. 3156
All Critical High Medium Low Exploited only Public exploit

1,455 results · Feed

  • Unscored —
    CVE-2021-26935

    In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers …

  • Unscored —
    CVE-2021-27306

    An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated user…

  • Unscored —
    CVE-2021-28133 EPSS 20%

    Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the pa…

  • Unscored —
    CVE-2021-26237

    FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user op…

  • Unscored —
    CVE-2021-26235

    FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when…

  • Unscored —
    CVE-2021-26234

    FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d8a, triggered when a user op…

  • Unscored —
    CVE-2021-26233

    FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfcb, triggered when…

  • Medium 4.3
    CVE-2021-21626

    Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

    Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attack…

    Jenkins Project Jenkins Warnings Next Generation Plugin io.jenkins.plugins:warnings-ng Web / CMS Maven
  • High 8.8
    CVE-2021-21627

    CSRF vulnerability in Jenkins Libvirt Agents Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains.

    Jenkins Project Jenkins Libvirt Agents Plugin org.jenkins-ci.plugins:libvirt-slave Web / CMS Maven
  • Medium 4.3
    CVE-2021-21625

    Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs

    Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circ…

    Jenkins Project Jenkins CloudBees AWS Credentials Plugin org.jenkins-ci.plugins:aws-credentials Web / CMS Maven
  • Medium 4.3
    CVE-2021-21624

    Incorrect permission checks in Jenkins Role-based Authorization Strategy Plugin may allow accessing some items

    An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

    Jenkins Project Jenkins Role-based Authorization Strategy Plugin org.jenkins-ci.plugins:role-strategy Web / CMS Maven
  • Medium 6.5
    CVE-2021-21623

    Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items

    An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

    Jenkins Project Jenkins Matrix Authorization Strategy Plugin org.jenkins-ci.plugins:matrix-auth Web / CMS Maven
  • Unscored —
    CVE-2021-26236

    FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file pars…

  • High 7.5
    CVE-2021-23359

    Arbitrary Command Injection

    This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC wi…

    port-killer npm
  • Unscored —
    CVE-2021-28420 Public exploit

    A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and t…

  • Unscored —
    CVE-2021-28419 Public exploit EPSS 11%

    The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which lead…

  • Unscored —
    CVE-2021-28418 Public exploit

    A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and…

  • Unscored —
    CVE-2021-28417 Public exploit

    A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and …

  • High 7.0
    CVE-2021-22848

    HGiga MailSherlock - SQL Injection-2

    HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege.

    HGiga MailSherlock MSR45/SSR45
  • Unscored —
    CVE-2021-3141

    In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be access…

  • Medium 5.3
    CVE-2021-28681

    In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication

    Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't al…

    github.com/pion/webrtc/v3 Go
  • Unscored —
    CVE-2021-28667

    StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. Th…

  • Unscored —
    CVE-2021-20676

    M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) v…

    M-System M-System DL8 series
  • Unscored —
    CVE-2021-20678

    SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers t…

    Stranger Studios Paid Memberships Pro
  • Unscored —
    CVE-2021-20675

    M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) v…

    M-System M-System DL8 series
  • Unscored —
    CVE-2021-20634

    Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20632

    Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20633

    Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to by…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20631

    Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker t…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20629

    Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arb…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20630

    Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20628

    Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject …

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20627

    Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject …

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20626

    Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to b…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20625

    Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attac…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2021-20624

    Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker t…

    Cybozu Cybozu Office
  • High 7.5
    CVE-2020-27827

    A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when a…

    openvswitch openvswitch openvswitch lldpd Debian Ubuntu Azure Linux Alpine
  • Unscored —
    DRUPAL-CONTRIB-2021-005

    The [Fast Autocomplete module](https://www.drupal.org/project/fac) provides fast IMDB-like suggestions below a text inp…

    drupal/fac Packagist
  • Unscored —
    CVE-2019-18235

    Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the …

  • Unscored —
    CVE-2019-18231

    Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may…