Vulnerability Summary for the Week of March 1, 2021

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: • High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 • Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9 • Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9 Entries may include additional information provided by organizations and efforts sponsored by Ug-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of Ug-CERT analysis.

High Vulnerabilities

Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

Accellion FTA 9_12_432 and earlier is CVE-2021- affected by argument injection via a crafted 2021-03- accellion -- fta 7.5 27730 POST request to an admin endpoint. The 02 MISC fixed version is FTA_9_12_444 and later.

The fix for CVE-2020-9484 was incomplete. CVE-2021- When using Apache Tomcat 10.0.0-M1 to 25329 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 2021-03- MLIST apache -- tomcat 7.5 7.0.0. to 7.0.107 with a configuration edge 01 MLIST case that was highly unlikely to be used, the CONFIRM Tomcat instance was still vulnerable to CVE- MLIST Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

2020-9494. Note that both the previously MLIST published prerequisites for CVE-2020-9484 MLIST and the previously published mitigations for MLIST CVE-2020-9484 also apply to this issue.

An issue was discovered in the bam crate CVE-2021- before 0.1.3 for Rust. There is an integer 2021-03- bam_project -- bam 7.5 28027 underflow and out-of-bounds write during the 05 MISC loading of a bgzip block.

In bPanel 2.0, the administrative ajax endpoints (aka ajax/aj_*.php) are accessible CVE-2020- 2021-03- bittacora -- bpanel without authentication and allow SQL 7.5 28657 02 injections, which could lead to platform MISC compromise.

An issue was discovered in the byte_struct CVE-2021- crate before 0.6.1 for Rust. There can be a 2021-03- byte_struct_project -- byte_struct 7.5 28033 drop of uninitialized memory if a certain 05 MISC deserialization method panics.

SQL injection in admin.php in doctor CVE-2021- doctor_appointment_system_project 2021-03- appointment system 1.0 allows an 7.5 27314 -- doctor_appointment_system 05 unauthenticated attacker to insert malicious MISC Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

SQL queries via username parameter at login page.

CVE-2021- EPrints 3.4.2 allows remote attackers to read 26703 arbitrary files and possibly execute 2021-03- eprints -- eprints 7.5 CONFIRM commands via crafted JSON/XML input to a 01 CONFIRM cgi/ajax/phrase URI. MISC

CVE-2021- EPrints 3.4.2 allows remote attackers to 2021-03- 26476 eprints -- eprints execute OS commands via crafted LaTeX 7.5 01 CONFIRM input to a cgi/cal?year= URI. MISC

Prototype pollution vulnerability in 'object- CVE-2021- collider' versions 1.0.0 through 1.0.3 allows 2021-03- 25914 fireblink -- object-collider 7.5 attacker to cause a denial of service and may 01 MISC lead to remote code execution. MISC

In performance driver, there is a possible out of bounds write due to a missing bounds CVE-2021- check. This could lead to local escalation of 2021-02- google -- android 7.2 0405 privilege with System execution privileges 26 MISC needed. User interaction is not needed for exploitation. Product: Android; Versions: Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

Android-10, Android-11; Patch ID: ALPS05466547.

In jpeg, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege CVE-2021- 2021-02- google -- android with System execution privileges needed. 7.2 0402 26 User interaction is not needed for MISC exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05433311.

In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of CVE-2021- privilege with System execution privileges 2021-02- google -- android 7.2 0406 needed. User interaction is not needed for 26 MISC exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05471418.

An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data CVE-2021- 2021-03- internment_project -- internment race that can cause memory corruption 7.5 28037 05 because of the unconditional implementation MISC of Sync for Intern. Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

CVE-2021- LMA ISIDA Retriever 5.2 allows SQL 2021-02- 26904 isida -- retriever 7.5 Injection. 26 MISC MISC

CVE-2021- 27804 JPEG XL (aka jpeg-xl) through 0.3.2 allows 2021-03- MISC jpeg -- jpeg_xl 7.5 writable memory corruption. 02 FULLDISC MISC MISC

CVE-2021- 25829 MISC An improper binary stream data handling MISC issue was found in the [core] module of MISC ONLYOFFICE DocumentServer v4.0.0-9- 2021-03- MISC onlyoffice -- document_server 7.8 v5.6.3. Using this bug, an attacker is able to 01 MISC produce a denial of service attack that can MISC eventually shut down the target server. MISC MISC MISC MISC Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

A SQL injection vulnerability in qcubed (all CVE-2020- versions including 3.1.1) in profile.php via 24913 the strQuery parameter allows an 2021-03- qcubed -- qcubed 7.5 MISC unauthenticated attacker to access the 04 MISC database by injecting SQL code via a crafted MISC POST request.

An issue was discovered in SaltStack Salt CVE-2021- before 3002.5. Sending crafted web requests 3148 to the Salt API can result in 2021-02- MISC saltstack -- salt salt.utils.thin.gen_thin() command injection 7.5 27 FEDORA because of different handling of single versus FEDORA double quotes. This is related to CONFIRM salt/utils/thin.py.

CVE-2021- An issue was discovered in through SaltStack 25283 Salt before 3002.5. The jinja renderer does 2021-02- MISC saltstack -- salt 7.5 not protect against server side template 27 FEDORA injection attacks. FEDORA CONFIRM

CVE-2021- An issue was discovered in through SaltStack 2021-02- 25281 saltstack -- salt Salt before 3002.5. salt-api does not honor 7.5 27 MISC eauth credentials for the wheel_async client. FEDORA Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

Thus, an attacker can remotely run any wheel FEDORA modules on the master. CONFIRM MISC

CVE-2021- An issue was discovered in SaltStack Salt 3197 before 3002.5. The salt-api's ssh client is 2021-02- MISC saltstack -- salt vulnerable to a shell injection by including 7.5 27 FEDORA ProxyCommand in an argument, or via FEDORA ssh_options provided in an API request. CONFIRM

CVE-2021- In SaltStack Salt before 3002.5, eauth tokens 3144 can be used once after expiration. (They 2021-02- MISC saltstack -- salt 7.5 might be used to run command against the 27 FEDORA salt master or minions.) FEDORA CONFIRM

An issue was discovered in the scratchpad crate before 1.3.1 for Rust. The CVE-2021- 2021-03- scratchpad_project -- scratchpad move_elements function can have a double- 7.5 28031 05 free upon a panic in a user-provided f MISC function. Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a CVE-2019- 2021-02- scytl -- secure_vote payload over an event alias, because the 7.5 25022 27 application calls MISC Runtime.getRuntime().exec() without validation.

SerComm AG Combo VD625 AGSOT_2.1.0 CVE-2021- sercomm -- devices allow CRLF injection (for HTTP 2021-02- 27132 7.5 agcombo_vd625_firmware header injection) in the download function 27 MISC via the Content-Disposition header. MISC

An issue was discovered in the stack_dst CVE-2021- crate before 0.6.1 for Rust. Because of the 2021-03- stack_dst_project -- stack_dst 7.5 28034 push_inner behavior, a double free can occur 05 MISC upon a val.clone() panic.

An issue was discovered in the stack_dst CVE-2021- crate before 0.6.1 for Rust. Because of the 2021-03- stack_dst_project -- stack_dst 7.5 28035 push_inner behavior, a drop of uninitialized 05 MISC memory can occur upon a val.clone() panic. Primary CVSS Source & Description Published Vendor -- Product Score Patch Info

An issue was discovered in the toodee crate CVE-2021- 2021-03- toodee_project -- toodee before 0.3.0 for Rust. Row insertion can 7.5 28028 05 cause a double free upon an iterator panic. MISC

CVE-2021- The package total.js before 3.4.8 are 2021-03- 23344 totaljs -- total.js vulnerable to Remote Code Execution (RCE) 7.5 04 MISC via set. MISC

An issue was discovered in Visualware MyConnection Server through 11.0b build 5382. Unauthenticated Remote Code CVE-2021- Execution can occur via Arbitrary File 27198 Upload in the web service when using a 2021-02- MISC visualware -- myconnection_server 10 myspeed/sf?filename= URI. This application 26 MISC is written in Java and is thus cross-platform. MISC The Windows installation runs as SYSTEM, MISC which means that exploitation gives one Administrator privileges on the target system.

Medium Vulnerabilities CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing CVE- remote visibility of the PLC state. If a user 2020- attempts to login to the PLC while this 2021-02- abb -- pm554_firmware 5 24686 vulnerability is exploited, the PLC will show an 26 CONFIR error state and refuse connections to Automation M Builder. The execution of the PLC application is not affected by this vulnerability. This issue affects ABB AC500 V2 products with onboard Ethernet.

Accellion FTA 9_12_432 and earlier is affected by CVE- stored XSS via a crafted POST request to a user 2021-03- 2021- accellion -- fta 4.3 endpoint. The fixed version is FTA_9_12_444 and 02 27731 later. MISC

aiohttp is an asynchronous HTTP client/server CVE- framework for asyncio and Python. In aiohttp 2021- before version 3.7.4 there is an open redirect 21330 vulnerability. A maliciously crafted link to an 2021-02- MISC aiohttp_project -- aiohttp aiohttp-based web-server could redirect the 5.8 26 MISC browser to a different website. It is caused by a CONFIR bug in the M `aiohttp.web_middlewares.normalize_path_middle FEDORA ware` middleware. This security problem has been CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

fixed in 3.7.4. Upgrade your dependency using pip MISC as follows "pip install aiohttp >= 3.7.4". If DEBIAN upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middle ware` in your applications.

CVE- 2021- 25122 When responding to new h2c connection requests, MLIST Apache Tomcat versions 10.0.0-M1 to 10.0.0, CONFIR 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could M 2021-03- apache -- tomcat duplicate request headers and a limited amount of 5 MLIST 01 request body from one request to another meaning MLIST user A and user B could both see the results of user MLIST A's request. MLIST MLIST MLIST MLIST

The ResourceDownloadRewriteRule class in CVE- Crowd before version 4.0.4, and from version 4.1.0 2021-03- 2020- atlassian -- crowd 5 before 4.1.2 allowed unauthenticated remote 01 36240 attackers to read arbitrary files within WEB-INF MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

and META-INF directories via an incorrect path access check.

CVE- best it Amazon Pay Plugin before 9.4.2 for 2020- 2021-02- bestit -- amazon_pay Shopware exposes Sensitive Information to an 6.4 28199 26 Unauthorized Actor. MISC MISC

CVE- courier_management_system_pro Courier Management System 1.0 1.0 is affected by 2021-03- 2020- ject -- 4 SQL Injection via 'MULTIPART street '. 04 35329 courier_management_system MISC

CVE- In Dataiku DSS before 8.0.6, insufficient access 2021- control in the Jupyter notebooks integration allows 2021-03- 27225 dataiku -- data_science_studio users (who have coding permissions) to read and 5.5 01 CONFIR overwrite notebooks in projects that they are not M authorized to access. MISC

In Eclipse Jetty 9.4.6.v20170531 to 2021-02- CVE- eclipse -- jetty 5 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 26 2020- CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

when Jetty handles a request containing multiple 27223 Accept headers with a large number of “quality” CONFIR (i.e. q) parameters, the server may enter a denial of M service (DoS) state due to high CPU usage CONFIR processing those quality values, resulting in M minutes of CPU time exhausted processing those MLIST quality values. MLIST MLIST MLIST MLIST MLIST MISC MLIST MLIST MLIST MLIST MLIST MLIST MLIST MLIST MLIST MLIST MLIST MLIST MISC MLIST CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

MLIST MLIST

CVE- 2021- EPrints 3.4.2 allows remote attackers to read 3342 arbitrary files and possibly execute commands via 2021-03- CONFIR eprints -- eprints 6.8 crafted LaTeX input to a cgi/latex2png?latex= 01 M URI. CONFIR M MISC

CVE- 2021- EPrints 3.4.2 exposes a reflected XSS opportunity 2021-03- 26475 eprints -- eprints 4.3 in the via a cgi/cal URI. 01 CONFIR M MISC

CVE- EPrints 3.4.2 exposes a reflected XSS opportunity 2021-03- 2021- eprints -- eprints in the dataset parameter to the 4.3 01 26702 cgi/dataset_dictionary URI. CONFIR CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

M MISC

CVE- 2021- 26704 EPrints 3.4.2 allows remote attackers to execute 2021-03- CONFIR eprints -- eprints arbitrary commands via crafted input to the verb 6.5 01 M parameter in a cgi/toolbox/toolbox URI. CONFIR M MISC

In vpu, there is a possible memory corruption due to a race condition. This could lead to local CVE- escalation of privilege with System execution 2021-02- 2021- google -- android privileges needed. User interaction is not needed 6.9 26 0367 for exploitation. Product: Android; Versions: MISC Android-10, Android-11; Patch ID: ALPS05371580; Issue ID: ALPS05379085.

In vow, there is a possible memory corruption due CVE- to a race condition. This could lead to local 2021-02- 2021- google -- android 6.9 escalation of privilege with System execution 26 0401 privileges needed. User interaction is needed for MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

exploitation. Product: Android; Versions: Android- 10, Android-11; Patch ID: ALPS05418265.

In vpu, there is a possible memory corruption due to a race condition. This could lead to local CVE- escalation of privilege with System execution 2021-02- 2021- google -- android privileges needed. User interaction is not needed 6.9 26 0366 for exploitation. Product: Android; Versions: MISC Android-10, Android-11; Patch ID: ALPS05371580; Issue ID: ALPS05379093.

CVE- 2021- LMA ISIDA Retriever 5.2 is vulnerable to XSS via 2021-02- isida -- retriever 4.3 26903 query['text']. 26 MISC MISC

CVE- An issue was discovered in Joomla! 3.2.0 through 2021-03- 2021- joomla -- joomla\! 3.9.24. Usage of the insecure rand() function 5 04 23126 within the process of generating the 2FA secret. MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CVE- An issue was discovered in Joomla! 3.2.0 through 2021-03- 2021- joomla -- joomla\! 3.9.24. Missing input validation within the 5 04 23131 template manager. MISC

CVE- An issue was discovered in Joomla! 3.0.0 through 2021-03- 2021- joomla -- joomla\! 3.9.24. com_media allowed paths that are not 5 04 23132 intended for image uploads MISC

CVE- An issue was discovered in Joomla! 2.5.0 through 2021-03- 2021- joomla -- joomla\! 3.9.24. Missing filtering of feed fields could lead 4.3 04 23130 to xss issues. MISC

CVE- An issue was discovered in Joomla! 2.5.0 through 2021-03- 2021- joomla -- joomla\! 3.9.24. Missing filtering of messages showed to 4.3 04 23129 users that could lead to xss issues. MISC

An issue was discovered in Joomla! 3.2.0 through 2021-03- CVE- joomla -- joomla\! 3.9.24. The core shipped but unused randval 6.4 04 2021- implementation within FOF (FOFEncryptRandval) CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

used an potential insecure implemetation. That has 23128 now been replaced with a call to 'random_bytes()' MISC and its backport that is shipped within random_compat.

An issue was discovered in Joomla! 3.2.0 through CVE- 3.9.24. Usage of an insufficient length for the 2FA 2021-03- 2021- joomla -- joomla\! 6.4 secret accoring to RFC 4226 of 10 bytes vs 20 04 23127 bytes. MISC

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue CVE- Disk (KRD) and was trusted by the Authentication 2020- Agent of Full Disk Encryption in Kaspersky 2021-02- kaspersky -- endpoint_security 4.6 26200 Endpoint Security (KES). This issue allowed to 26 MISC bypass the UEFI Secure Boot security feature. An MISC attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a CVE- malicious homeserver could redirect requests to 2021- their .well-known file to a large file. This can lead 21274 to a denial of service attack where homeservers 2021-02- MISC matrix -- synapse will consume significantly more resources when 4.3 26 MISC requesting the .well-known file of a malicious MISC homeserver. This affects any server which accepts CONFIR federation requests from untrusted servers. Issue is M resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

Synapse is a Matrix reference homeserver written CVE- in python (pypi package matrix-synapse). Matrix is 2021- an ecosystem for open federated Instant Messaging 21273 and VoIP. In Synapse before version 1.25.0, 2021-02- MISC matrix -- synapse requests to user provided domains were not 5.8 26 MISC restricted to external IP addresses when calculating MISC the key validity for third-party invite events and CONFIR sending push notifications. This could cause M Synapse to make requests to internal infrastructure. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.

CVE- Micro Focus Solutions Business Manager versions microfocus -- 2021-02- 2019- prior to 11.7.1 are vulnerable to XML External 5.2 solutions_business_manager 26 18943 Entity Processing (XXE) on certain operations. MISC

CVE- Micro Focus Solutions Business Manager 2019- microfocus -- 2021-02- Application Repository versions prior to 11.7.1 are 5.2 18945 solutions_business_manager 26 vulnerable to privilege escalation vulnerability. CONFIR M

Mozilla developers reported memory safety bugs 2021-02- CVE- mozilla -- firefox 6.8 present in Firefox 85. Some of these bugs showed 26 2021- CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

evidence of memory corruption and we presume 23979 that with enough effort some of these could have MISC been exploited to run arbitrary code. This MISC vulnerability affects Firefox < 86.

CVE- Using the new logical assignment operators in a 2021- JavaScript switch statement could have caused a 23954 type confusion, leading to a memory corruption 2021-02- mozilla -- firefox 6.8 MISC and a potentially exploitable crash. This 26 MISC vulnerability affects Firefox < 85, Thunderbird < MISC 78.7, and Firefox ESR < 78.7. MISC

CVE- Performing garbage collection on re-declared 2021- JavaScript variables resulted in a user-after-poison, 23960 2021-02- mozilla -- firefox and a potentially exploitable crash. This 6.8 MISC 26 vulnerability affects Firefox < 85, Thunderbird < MISC 78.7, and Firefox ESR < 78.7. MISC MISC

If a user clicked into a specifically crafted PDF, the CVE- 2021-02- mozilla -- firefox PDF reader could be confused into leaking cross- 4.3 2021- 26 origin information, when said information is 23953 CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

served as chunked data. This vulnerability affects MISC Firefox < 85, Thunderbird < 78.7, and Firefox ESR MISC < 78.7. MISC MISC

CVE- The browser could have been confused into 2021- transferring a pointer lock state into another tab, 2021-02- mozilla -- firefox 4.3 23955 which could have lead to clickjacking attacks. This 26 MISC vulnerability affects Firefox < 85. MISC

CVE- Incorrect use of the '' 2021- method could have led to a user-after-poison and a 2021-02- mozilla -- firefox 6.8 23962 potentially exploitable crash. This vulnerability 26 MISC affects Firefox < 85. MISC

Mozilla developers reported memory safety bugs CVE- present in Firefox 84 and Firefox ESR 78.6. Some 2021- of these bugs showed evidence of memory 23964 2021-02- mozilla -- firefox corruption and we presume that with enough effort 6.8 MISC 26 some of these could have been exploited to run MISC arbitrary code. This vulnerability affects Firefox < MISC 85, Thunderbird < 78.7, and Firefox ESR < 78.7. MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

Mozilla developers reported memory safety bugs CVE- present in Firefox 84. Some of these bugs showed 2021- evidence of memory corruption and we presume 2021-02- mozilla -- firefox 6.8 23965 that with enough effort some of these could have 26 MISC been exploited to run arbitrary code. This MISC vulnerability affects Firefox < 85.

One phishing tactic on the web is to provide a link with HTTP Auth. For example CVE- 'https://[email protected]'. To 2021- mitigate this type of attack, Firefox will display a 2021-02- mozilla -- firefox 6.8 23972 warning dialog; however, this warning dialog 26 MISC would not have been displayed if evil.com used a MISC redirect that was cached by the browser. This vulnerability affects Firefox < 86.

An ambiguous file picker design could have CVE- confused users who intended to select and upload a 2021- 2021-02- mozilla -- firefox single file into uploading a whole directory. This 4.3 23956 26 was addressed by adding a new prompt. This MISC vulnerability affects Firefox < 85. MISC

Mozilla developers reported memory safety bugs 2021-02- CVE- mozilla -- firefox 6.8 present in Firefox 85 and Firefox ESR 78.7. Some 26 2021- CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

of these bugs showed evidence of memory 23978 corruption and we presume that with enough effort MISC some of these could have been exploited to run MLIST arbitrary code. This vulnerability affects Firefox < DEBIAN 86, Thunderbird < 78.8, and Firefox ESR < 78.8. MISC MISC MISC

As specified in the W3C Content Security Policy draft, when creating a violation report, "User CVE- agents need to ensure that the source file is the 2021- URL requested by the page, pre-redirects. If that’s 23969 not possible, user agents need to strip the URL MISC down to an origin to avoid unintentional leakage." 2021-02- mozilla -- firefox 4.3 MLIST Under certain types of redirects, Firefox 26 DEBIAN incorrectly set the source file to be the destination MISC of the redirects. This was fixed to be the redirect MISC destination's origin. This vulnerability affects MISC Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

The developer page about:memory has a Measure CVE- function for exploring what object types the 2021-02- mozilla -- firefox 4.3 2021- browser has allocated and their sizes. When this 26 23975 function was invoked we incorrectly called the CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

sizeof function, instead of using the API method MISC that checks for invalid pointers. This vulnerability MISC affects Firefox < 86.

CVE- The DOMParser API did not properly process 2021- '

CVE- If Content Security Policy blocked frame 2021- navigation, the full destination of a redirect served 23968 in the frame was reported in the violation report; as MISC 2021-02- mozilla -- firefox opposed to the original frame URI. This could be 4.3 MLIST 26 used to leak sensitive information contained in DEBIAN such URIs. This vulnerability affects Firefox < 86, MISC Thunderbird < 78.8, and Firefox ESR < 78.8. MISC MISC

The browser could have been confused into CVE- transferring a screen sharing state into another tab, 2021-02- mozilla -- firefox 4.3 2021- which would leak unintended information. This 26 23958 vulnerability affects Firefox < 85. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

MISC MISC

An XSS bug in internal error pages could have led CVE- to various spoofing attacks, including other error 2021- pages and the address bar. Note: This issue only 2021-02- mozilla -- firefox 4.3 23959 affected Firefox for Android. Other operating 26 MISC systems are unaffected. This vulnerability affects MISC Firefox < 85.

CVE- 2021- When trying to load a cross-origin resource in an 23973 audio/video context a decoding error may have MISC resulted, and the content of that error may have 2021-02- mozilla -- firefox 4.3 MLIST revealed information about the resource. This 26 DEBIAN vulnerability affects Firefox < 86, Thunderbird < MISC 78.8, and Firefox ESR < 78.8. MISC MISC

When accepting a malicious intent from other CVE- installed apps, Firefox for Android accepted 2021-02- mozilla -- firefox 5.8 2021- manifests from arbitrary file paths and allowed 26 23976 declaring webapp manifests for other origins. This CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

could be used to gain fullscreen access for UI MISC spoofing and could also lead to cross-origin attacks MISC on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.

When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the CVE- redirect's Referrer-Policy. This would have 2021- 2021-02- mozilla -- firefox potentially resulted in more information than 4.3 23971 26 intended by the original origin being provided to MISC the destination of the redirect. This vulnerability MISC affects Firefox < 86.

Further techniques that built on the slipstream CVE- research combined with a malicious webpage 2021- 2021-02- mozilla -- firefox could have exposed both an internal network's 4.3 23961 26 hosts as well as services running on the user's local MISC machine. This vulnerability affects Firefox < 85. MISC

When sharing geolocation during an active CVE- 2021-02- mozilla -- firefox WebRTC share, Firefox could have reset the 4.3 2021- 26 webRTC sharing state in the user interface, leading 23963 CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

to loss of control over the currently granted MISC permission. This vulnerability affects Firefox < 85. MISC

CVE- Context-specific code was included in a shared 2021- jump table; resulting in assertions being triggered 2021-02- mozilla -- firefox 4.3 23970 in multithreaded wasm code. This vulnerability 26 MISC affects Firefox < 86. MISC

Navigations through the Android-specific `intent` CVE- URL scheme could have been misused to escape 2021- 2021-02- mozilla -- firefox iframe sandbox. Note: This issue only affected 4.3 23957 26 Firefox for Android. Other operating systems are MISC unaffected. This vulnerability affects Firefox < 85. MISC

Node-Red is a low-code programming for event- CVE- driven applications built using nodejs. Node-RED 2021- 1.2.7 and earlier contains a Prototype Pollution 21297 vulnerability in the admin API. A badly formed 2021-02- MISC nodered -- node-red 4 request can modify the prototype of the default 26 CONFIR JavaScript Object with the potential to affect the M default behaviour of the Node-RED runtime. The MISC vulnerability is patched in the 1.2.8 release. A MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

workaround is to ensure only authorized users are able to access the editor url.

CVE- A file extension handling issue was found in [core] 2021- module of ONLYOFFICE DocumentServer 25830 v4.2.0.236-v5.6.4.13. An attacker must request the MISC conversion of the crafted file from DOCT into 2021-03- onlyoffice -- document_server 6.8 MISC DOCX format. Using the chain of two other bugs 01 MISC related to improper string handling, an attacker can MISC achieve remote code execution on MISC DocumentServer. MISC

CVE- A file extension handling issue was found in [core] 2021- module of ONLYOFFICE DocumentServer 25831 v4.0.0-9-v5.6.3. An attacker must request the MISC conversion of the crafted file from PPTT into 2021-03- onlyoffice -- document_server 6.8 MISC PPTX format. Using the chain of two other bugs 01 MISC related to improper string handling, a remote MISC attacker can obtain remote code execution on MISC DocumentServer. MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CVE- 2021- A heap buffer overflow vulnerability inside of 25832 BMP image processing was found at [core] module MISC of ONLYOFFICE DocumentServer v4.0.0-9- 2021-03- MISC onlyoffice -- document_server 6.8 v6.0.0. Using this vulnerability, an attacker is able 01 MISC to gain remote code executions on MISC DocumentServer. MISC MISC MISC

CVE- A file extension handling issue was found in 2021- [server] module of ONLYOFFICE 25833 DocumentServer v4.2.0.71-v5.6.0.21. The file MISC 2021-03- onlyoffice -- document_server extension is controlled by an attacker through the 6.8 MISC 01 request data and leads to arbitrary file overwriting. MISC Using this vulnerability, a remote attacker can MISC obtain remote code execution on DocumentServer. MISC MISC

ownCloud owncloud/client before 2.7 allows DLL CVE- Injection. The desktop client loaded development 2021-02- owncloud -- owncloud 4.4 2020- plugins from certain directories when they were 26 28646 present. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

MISC MISC

CVE- PrestaShop is a fully scalable open source e- 2021- commerce solution. In PrestaShop before version 21308 1.7.2 the soft logout system is not complete and an 2021-02- prestashop -- prestashop 6.4 MISC attacker is able to foreign request and executes 26 MISC customer commands. The problem is fixed in CONFIR 1.7.7.2 M

CVE- PrestaShop is a fully scalable open source e- 2021- commerce solution. In PrestaShop before version 21302 2021-02- prestashop -- prestashop 1.7.2 there is a CSV Injection vulnerability 6.5 MISC 26 possible by using shop search keywords via the MISC admin panel. The problem is fixed in 1.7.7.2 CONFIR M

Changing the password on the module webpage CVE- does not require the user to type in the current prosoft-technology -- icx35-hwc- 2021-02- 2021- password first. Thus, the password could be 5 a_firmware 26 22661 changed by a user or external process without MISC knowledge of the current password on the ICX35- CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

HWC-A and ICX35-HWC-E (Versions 1.9.62 and prior).

An issue was discovered in the quinn crate before CVE- 0.7.0 for Rust. It may have invalid memory access 2021-03- 2021- quinn_project -- quinn for certain versions of the standard library because 5 05 28036 it relies on a direct cast of std::net::SocketAddrV4 MISC and std::net::SocketAddrV6 data structures.

CVE- 2020- An issue was discovered in SaltStack Salt before 28243 3002.5. The minion's restartcheck is vulnerable to MISC command injection via a crafted process name. 2021-02- saltstack -- salt 4.6 FEDORA This allows for a local privilege escalation by any 27 FEDORA user able to create a files on the minion in a non- CONFIR blacklisted directory. M MISC

CVE- In SaltStack Salt before 3002.5, authentication to 2020- VMware vcenter, vsphere, and esxi servers (in the 2021-02- saltstack -- salt 4.3 28972 vmware.py files) does not always validate the 27 FEDORA SSL/TLS certificate. FEDORA CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CONFIR M

CVE- 2020- In SaltStack Salt before 3002.5, when 35662 2021-02- saltstack -- salt authenticating to services using certain modules, 5.8 FEDORA 27 the SSL certificate is not always validated. FEDORA CONFIR M

CVE- 2021- 25282 An issue was discovered in through SaltStack Salt 2021-02- MISC saltstack -- salt before 3002.5. The salt.wheel.pillar_roots.write 6.4 27 FEDORA method is vulnerable to directory traversal. FEDORA CONFIR M

CVE- An issue was discovered in Scytl sVote 2.1. 2021-02- 2019- scytl -- secure_vote Because the sdm-ws-rest API does not require 5 27 25020 authentication, an attacker can retrieve the MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI.

An issue was discovered in Scytl sVote 2.1. CVE- Because the IP address from an X-Forwarded-For 2021-02- 2019- scytl -- secure_vote header (which can be manipulated client-side) is 6.4 27 25023 used for the internal application logs, an attacker MISC can inject wrong IP addresses into these logs.

An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an CVE- attacker can access the OrientDB by providing 2021-02- 2019- scytl -- secure_vote 5 admin as the admin password. A different 27 25021 password cannot be set because of the MISC implementation in code.

Cleartext transmission of sensitive information CVE- vulnerability in synoagentregisterd in Synology 2021- 2021-02- synology -- diskstation_manager DiskStation Manager (DSM) before 6.2.3-25426-3 4.3 26560 26 allows man-in-the-middle attackers to spoof CONFIR servers via an HTTP session. M CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

Cleartext transmission of sensitive information CVE- vulnerability in synorelayd in Synology 2021- 2021-02- synology -- diskstation_manager DiskStation Manager (DSM) before 6.2.3-25426-3 4.3 26565 26 allows man-in-the-middle attackers to obtain CONFIR sensitive information via an HTTP session. M

Cleartext transmission of sensitive information CVE- vulnerability in synorelayd in Synology 2021- 2021-02- synology -- diskstation_manager DiskStation Manager (DSM) before 6.2.3-25426-3 4.3 26564 26 allows man-in-the-middle attackers to spoof CONFIR servers via an HTTP session. M

Use of unmaintained third party components CVE- vulnerability in faad in Synology DiskStation 2021- 2021-02- synology -- diskstation_manager Manager (DSM) before 6.2.3-25426-3 allows 6.5 26567 26 remote authenticated users to execute arbitrary CONFIR code via a crafted file path. M

Stack-based buffer overflow vulnerability in CVE- synoagentregisterd in Synology DiskStation 2021- 2021-02- synology -- diskstation_manager Manager (DSM) before 6.2.3-25426-3 allows man- 6.8 26561 26 in-the-middle attackers to execute arbitrary code CONFIR via syno_finder_site HTTP header. M CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

Out-of-bounds write vulnerability in CVE- synoagentregisterd in Synology DiskStation 2021- 2021-02- synology -- diskstation_manager Manager (DSM) before 6.2.3-25426-3 allows man- 6.8 26562 26 in-the-middle attackers to execute arbitrary code CONFIR via syno_finder_site HTTP header. M

Insertion of sensitive information into sent data CVE- vulnerability in synorelayd in Synology 2021- DiskStation Manager (DSM) before 6.2.3-25426-3 2021-02- synology -- diskstation_manager 6.8 26566 allows man-in-the-middle attackers to execute 26 CONFIR arbitrary commands via inbound QuickConnect M traffic.

An issue was discovered in the toodee crate before CVE- 0.3.0 for Rust. The row-insertion feature allows 2021-03- 2021- toodee_project -- toodee 5 attackers to read the contents of uninitialized 05 28029 memory locations. MISC

CVE- Missing initialization of a variable in the TPM2 2020- tpm2_software_stack_project -- source may allow a privileged user to potentially 2021-02- 24455 4.6 tpm2_software_stack enable an escalation of privilege via local access. 26 CONFIR This affects tpm2-tss before 3.0.1 and before 2.4.3. M CONFIR CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

M CONFIR M

An issue was discovered in the truetype crate CVE- before 0.30.1 for Rust. Attackers can read the 2021-03- 2021- truetype_project -- truetype contents of uninitialized memory locations via a 5 05 28030 user-provided Read operation within MISC Tape::take_bytes.

Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their CVE- Vapor app. The following is the attack vector: 1. 2021- send unlimited requests against a vapor instance 21328 with different paths. this will create unlimited 2021-02- MISC vapor_project -- vapor counters and timers, which will eventually drain 5 26 MISC the system. 2. downstream services might suffer CONFIR from this attack as well by being spammed with M error paths. This has been patched in 4.40.1. The MISC `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CVE- 2021- A vulnerability was discovered in how 27803 p2p/p2p_pd.c in wpa_supplicant before 2.10 MLIST processes P2P (Wi-Fi Direct) provision discovery 2021-02- w1.fi -- wpa_supplicant 5.4 MLIST requests. It could result in denial of service or other 26 FEDORA impact (potentially execution of arbitrary code), MISC for an attacker within radio range. MISC MISC

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and CVE- C8030/C8035/C8045/C8055/C8070 multifunction 2019- printers with software releases before 2021-03- 18628 xerox -- altalink_b8045_firmware 4 101.00x.099.28200 allow a user with 04 MISC administrative privileges to turn off data CONFIR encryption on the device, thus leaving it open to M potential cryptographic information disclosure.

** DISPUTED ** Zenphoto through 1.5.7 is CVE- affected by authenticated arbitrary file upload, 2020- leading to remote code execution. The attacker 2021-02- 36079 zenphoto -- zenphoto 6.5 must navigate to the uploader plugin, check the 26 MISC elFinder box, and then drag and drop files into the MISC Files(elFinder) portion of the UI. This can, for MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site."

Low Vulnerabilities

CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CVE- courier_management_system_proj Courier Management System 1.0 - 'First Name' 2021-03- 2020- ect -- 3.5 Stored XSS 04 35328 courier_management_system MISC

An issue has been discovered in GitLab affecting CVE- 2021-03- gitlab -- gitlab all versions starting with 13.7. GitLab was 3.5 2021- 03 vulnerable to a stored XSS in merge request. 22182 CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CONFIR M MISC MISC

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing CVE- invalid multi-byte input sequences in IBM1364, 2020- IBM1371, IBM1388, IBM1390, and IBM1399 2021-02- gnu -- glibc 2.1 27618 encodings, fails to advance the input state, which 26 MISC could lead to an infinite loop in applications, MISC resulting in a denial of service, a different vulnerability from CVE-2016-10228.

In mobile_log_d, there is a possible information disclosure due to improper input validation. This CVE- could lead to local information disclosure with 2021-02- 2021- google -- android System execution privileges needed. User 2.1 26 0404 interaction is not needed for exploitation. MISC Product: Android; Versions: Android-11; Patch ID: ALPS05457039.

In netdiag, there is a possible information 2021-02- CVE- google -- android 2.1 disclosure due to a missing permission check. 26 2021- CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

This could lead to local information disclosure 0403 with System execution privileges needed. User MISC interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05475124.

i-doit before 1.16.0 is affected by Stored Cross- Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via CVE- C__MONITORING__CONFIG__TITLE, 2021- 2021-02- i-doit -- i-doit SM2__C__MONITORING__CONFIG__TITLE, 3.5 3151 27 C__MONITORING__CONFIG__PATH, MISC SM2__C__MONITORING__CONFIG__PATH, MISC C__MONITORING__CONFIG__ADDRESS, or SM2__C__MONITORING__CONFIG__ADDR ESS.

IBM Engineering products are vulnerable to CVE- stored cross-site scripting. This vulnerability 2020- allows users to embed arbitrary JavaScript code 2021-03- 4856 ibm -- doors_next in the Web UI thus altering the intended 3.5 04 XF functionality potentially leading to credentials CONFIR disclosure within a trusted session. IBM X-Force M ID: 190459. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

IBM Engineering products are vulnerable to CVE- stored cross-site scripting. This vulnerability 2020- allows users to embed arbitrary JavaScript code 2021-03- 4857 ibm -- doors_next in the Web UI thus altering the intended 3.5 04 XF functionality potentially leading to credentials CONFIR disclosure within a trusted session. IBM X-Force M ID: 190460.

IBM Engineering products are vulnerable to CVE- stored cross-site scripting. This vulnerability 2020- allows users to embed arbitrary JavaScript code 2021-03- 4863 ibm -- doors_next in the Web UI thus altering the intended 3.5 04 XF functionality potentially leading to credentials CONFIR disclosure within a trusted session. IBM X-Force M ID: 190566.

IBM Engineering products are vulnerable to CVE- cross-site scripting. This vulnerability allows 2020- users to embed arbitrary JavaScript code in the 2021-03- 4866 ibm -- doors_next Web UI thus altering the intended functionality 3.5 04 XF potentially leading to credentials disclosure CONFIR within a trusted session. IBM X-Force ID: M 190742. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

IBM Engineering products are vulnerable to CVE- cross-site scripting. This vulnerability allows 2021- users to embed arbitrary JavaScript code in the 2021-03- 20340 ibm -- doors_next Web UI thus altering the intended functionality 3.5 04 XF potentially leading to credentials disclosure CONFIR within a trusted session. IBM X-Force ID: M 194451.

IBM Engineering products are vulnerable to CVE- cross-site scripting. This vulnerability allows 2021- users to embed arbitrary JavaScript code in the 2021-03- 20350 ibm -- doors_next Web UI thus altering the intended functionality 3.5 04 XF potentially leading to credentials disclosure CONFIR within a trusted session. IBM X-Force ID: M 194707.

IBM Engineering products are vulnerable to CVE- cross-site scripting. This vulnerability allows 2021- users to embed arbitrary JavaScript code in the 2021-03- 20351 ibm -- doors_next Web UI thus altering the intended functionality 3.5 04 XF potentially leading to credentials disclosure CONFIR within a trusted session. IBM X-Force ID: M 194708. CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CVE- Micro Focus Solutions Business Manager 2019- microfocus -- 2021-02- Application Repository versions prior to 11.7.1 3.8 18946 solutions_business_manager 26 are vulnerable to session fixation. CONFIR M

CVE- Micro Focus Solutions Business Manager 2019- microfocus -- 2021-02- Application Repository versions prior to 11.7.1 2.7 18947 solutions_business_manager 26 are vulnerable to information disclosure. CONFIR M

CVE- Micro Focus Solutions Business Manager 2019- microfocus -- 2021-02- Application Repository versions prior to 11.7.1 2.3 18944 solutions_business_manager 26 are vulnerable to reflected XSS. CONFIR M

CVE- Micro Focus Solutions Business Manager 2019- microfocus -- versions prior to 11.7.1 are vulnerable to stored 2021-02- 2.3 18942 solutions_business_manager XSS. The application reflects previously stored 26 CONFIR user input without encoding. M CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

Firefox for Android suffered from a time-of- check-time-of-use vulnerability that allowed a CVE- malicious application to read sensitive data from 2021- 2021-02- mozilla -- firefox application directories. Note: This issue is only 2.6 23977 26 affected Firefox for Android. Other operating MISC systems are unaffected. This vulnerability affects MISC Firefox < 86.

There are multiple persistent cross-site scripting CVE- (XSS) vulnerabilities in the web interface of 2021- OpenText Content Server Version 20.3. The 2021-02- opentext -- content_server 3.5 3010 application allows a remote attacker to introduce 26 MISC arbitrary JavaScript by crafting malicious form MISC values that are later not sanitized.

CVE- 2021- 25284 An issue was discovered in through SaltStack 2021-02- MISC saltstack -- salt Salt before 3002.5. salt.modules.cmdmod can log 1.9 27 FEDORA credentials to the info or error log level. FEDORA CONFIR M CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

CVE- Improper permission grant check in Samsung 2021- Internet prior to version 13.0.1.60 allows access 2021-03- 25348 samsung -- internet 2.1 to files in internal storage without authorized 04 MISC STORAGE permission. CONFIR M

CVE- Calling of non-existent provider in S Assistant 2021- prior to version 6.5.01.22 allows unauthorized 2021-03- 25341 samsung -- s_assistant 2.1 actions including denial of service attack by 04 MISC hijacking the provider. CONFIR M

Improper access control vulnerability in CVE- synoagentregisterd in Synology DiskStation 2021- 2021-02- synology -- diskstation_manager Manager (DSM) before 6.2.3-25426-3 allows 2.1 26563 26 local users to obtain sensitive information via a CONFIR crafted kernel module. M

A ZTE product has a memory leak vulnerability. CVE- Due to the product's improper handling of 2021-02- 2021- zte -- zxr10_8900e_firmware 2.1 memory release in certain scenarios, a local 26 21724 attacker with device permissions repeatedly MISC CVS Source & Primary Publishe S Description Patch Vendor -- Product d Scor Info e

attenuated the optical signal to cause memory leak and abnormal service. This affects: ZXR10 8900E, all versions up to V3.03.20R2B30P1.