CVE-2021-21638 - A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, captu... read CVE-2021-21638
Published: March 30, 2021; 8:16:10 AM -0400

V3.1: 8.8 HIGH
V2.0: 6.8 MEDIUM

CVE-2021-27349 - Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.
Published: March 31, 2021; 6:15:14 PM -0400

V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2020-19618 - Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
Published: April 01, 2021; 4:15:11 PM -0400

V3.1: 5.4 MEDIUM
V2.0: 3.5 LOW

CVE-2020-19617 - Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
Published: April 01, 2021; 3:15:13 PM -0400

V3.1: 5.4 MEDIUM
V2.0: 3.5 LOW

CVE-2020-19616 - Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
Published: April 01, 2021; 3:15:13 PM -0400

V3.1: 5.4 MEDIUM
V2.0: 3.5 LOW

CVE-2021-29642 - GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.
Published: March 30, 2021; 3:15:15 PM -0400

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2021-23348 - This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function with... read CVE-2021-23348
Published: March 31, 2021; 11:15:15 AM -0400

V3.1: 8.8 HIGH
V2.0: 6.5 MEDIUM

CVE-2020-19619 - Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
Published: April 01, 2021; 4:15:11 PM -0400

V3.1: 5.4 MEDIUM
V2.0: 3.5 LOW

CVE-2020-35137 - The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in com/mobileiron/registration/Re... read CVE-2020-35137
Published: March 29, 2021; 4:15:13 PM -0400

V3.1: 6.5 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2020-25580 - In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. Thi... read CVE-2020-25580
Published: March 26, 2021; 5:15:12 PM -0400

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2020-25579 - In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak... read CVE-2020-25579
Published: March 26, 2021; 5:15:12 PM -0400

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2020-25578 - In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file systems were not properly initializing the d_off field of the dirent structures returned by ... read CVE-2020-25578
Published: March 26, 2021; 5:15:12 PM -0400

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2021-26579 - A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptographic Key in a product). HPE has provided updates to versions 1.2009.0 and 1.2101.0 of HPE... read CVE-2021-26579
Published: March 30, 2021; 2:15:15 PM -0400

V3.1: 5.5 MEDIUM
V2.0: 2.1 LOW

CVE-2020-7461 - In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a ... read CVE-2020-7461
Published: March 26, 2021; 5:15:13 PM -0400

V3.1: 7.3 HIGH
V2.0: 7.5 HIGH

CVE-2021-21412 - Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse function... read CVE-2021-21412
Published: March 30, 2021; 2:15:15 PM -0400

V3.1: 8.8 HIGH
V2.0: 6.5 MEDIUM

CVE-2021-21398 - PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
Published: March 30, 2021; 12:15:15 PM -0400

V3.1: 5.4 MEDIUM
V2.0: 3.5 LOW

CVE-2020-25582 - In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as jexec(8) or killall(1), calls jail_attach(2) to enter a jail, the jailed root can attach to it using ptrac... read CVE-2020-25582
Published: March 26, 2021; 5:15:12 PM -0400

V3.1: 8.7 HIGH
V2.0: 8.5 HIGH

CVE-2020-25581 - In FreeBSD 12.2-STABLE before r369312, 11.4-STABLE before r369313, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 due to a race condition in the jail_remove(2) implementation, it may fail to kill some of the processes.
Published: March 26, 2021; 5:15:12 PM -0400

V3.1: 7.5 HIGH
V2.0: 8.5 HIGH

CVE-2020-28173 - Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/.
Published: March 31, 2021; 9:15:13 AM -0400

V3.1: 7.2 HIGH
V2.0: 6.5 MEDIUM

CVE-2020-7462 - In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-free bug by sending IPv6 Hop-by-Hop options over the loopback interface. The use-after-free situation may result in unintended k... read CVE-2020-7462
Published: March 26, 2021; 5:15:13 PM -0400

V3.1: 5.5 MEDIUM
V2.0: 4.9 MEDIUM