CVE-2021-3109

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-31109.8The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_proCVE-2021-31114.8The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/expressCVE-2021-31137.5Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSessioCVE-2021-31146.5In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowestCVE-2021-31157.5Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" cCVE-2021-311528.8Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, cCVE-2021-311533.3please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locationsCVE-2021-311547.8pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain CVE-2021-311557.8Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at lCVE-2021-311567.5Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data.CVE-2021-311586.5In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user'CVE-2021-311595.3Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the
CVE-2021-3109: Medium severity, CVSS 4.8 | Vulnix