Skip to content
OpenAdvisories

Archive

March 2021

Vulnerabilities first published in this month (UTC), newest first.

← February 2021 2021 / March April 2021 →
  1. 130
  2. 239
  3. 357
  4. 467
  5. 561
  6. 61
  7. 76
  8. 826
  9. 990
  10. 10102
  11. 11121
  12. 1247
  13. 135
  14. 14 
  15. 1565
  16. 1622
  17. 1739
  18. 1896
  19. 1942
  20. 206
  21. 216
  22. 2251
  23. 2366
  24. 2486
  25. 2571
  26. 2672
  27. 272
  28. 28 
  29. 2945
  30. 3078
  31. 3156
All Critical High Medium Low Exploited only Public exploit

1,455 results · Feed

  • Unscored —
    CVE-2021-27318

    Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to i…

  • Medium 5.3
    CVE-2021-22114

    Path Traversal in Spring-integration-zip

    Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z),…

    org.springframework.integration:spring-integration-zip Maven
  • Critical 9.8
    CVE-2021-25914

    Prototype Pollution Vulnerability in object-collider

    Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.

    object-collider npm
  • Unscored —
    CVE-2020-36240

    The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauth…

    Atlassian Crowd
  • Medium 4.9
    CVE-2018-25004

    Invariant failure when explaining a find with a UUID

    A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2020-7929

    Specially crafted regex query can cause DoS

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.

    MongoDB MongoDB Server mongodb Ubuntu
  • Unscored —
    CVE-2020-9479

    unzip directory traversal

    When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e…

    Apache Software Foundation Apache AsterixDB
  • Unscored —
    CVE-2021-25833 EPSS 44%

    A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file…

  • Unscored —
    CVE-2021-25832 EPSS 13%

    A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentSe…

  • Unscored —
    CVE-2021-25831 EPSS 12%

    A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker mu…

  • Unscored —
    CVE-2021-25830 EPSS 12%

    A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attack…

  • Unscored —
    CVE-2021-25829

    An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6…

  • High 7.0
    CVE-2021-25329

    Incomplete fix for CVE-2020-9484

    The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CV…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2021-25122 EPSS 18%

    Apache Tomcat h2c request mix-up

    When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 5.4
    CVE-2021-27225

    In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have co…