# CVEs published 2021-04-06

93 CVEs were published on April 6, 2021: 2 critical, 4 high. Days are UTC.

- [CVE-2020-36310](https://cve.now/CVE-2020-36310.md): An issue was discovered in the Linux kernel before 5.8. (no CVSS)
- [CVE-2021-30178](https://cve.now/CVE-2021-30178.md): An issue was discovered in the Linux kernel through 5.11.11. (no CVSS)
- [CVE-2020-36311](https://cve.now/CVE-2020-36311.md): An issue was discovered in the Linux kernel before 5.9. (no CVSS)
- [CVE-2020-36312](https://cve.now/CVE-2020-36312.md): An issue was discovered in the Linux kernel before 5.8.10. (no CVSS)
- [CVE-2020-36313](https://cve.now/CVE-2020-36313.md): An issue was discovered in the Linux kernel before 5.7. (no CVSS)
- [CVE-2021-27900](https://cve.now/CVE-2021-27900.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web… (no CVSS)
- [CVE-2021-22158](https://cve.now/CVE-2021-22158.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the… (no CVSS)
- [CVE-2021-27899](https://cve.now/CVE-2021-27899.md): The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM… (no CVSS)
- [CVE-2021-22157](https://cve.now/CVE-2021-22157.md): Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS. (no CVSS)
- [CVE-2020-13422](https://cve.now/CVE-2020-13422.md): OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/ administrative actions. (no CVSS)
- [CVE-2020-13421](https://cve.now/CVE-2020-13421.md): OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions. (no CVSS)
- [CVE-2020-13419](https://cve.now/CVE-2020-13419.md): OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task. (no CVSS)
- [CVE-2020-13418](https://cve.now/CVE-2020-13418.md): OpenIAM before 4.2.0.3 allows XSS in the Add New User feature. (no CVSS)
- [CVE-2020-13420](https://cve.now/CVE-2020-13420.md): OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script. (no CVSS)
- [CVE-2021-21404](https://cve.now/CVE-2021-21404.md): Crash due to malformed relay protocol message (CVSS 7.5, syncthing · github.com/syncthing/syncthing)
- [CVE-2021-25692](https://cve.now/CVE-2021-25692.md): Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version… (no CVSS, Teradici PCoIP Connection Manager and Security Gateway)
- [CVE-2021-21423](https://cve.now/CVE-2021-21423.md): Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen (CVSS 6.8, projen)
- [CVE-2021-28688](https://cve.now/CVE-2021-28688.md): The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. (no CVSS, Linux)
- [CVE-2020-36309](https://cve.now/CVE-2020-36309.md): ngx\_http\_lua\_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to… (no CVSS)
- [CVE-2021-20334](https://cve.now/CVE-2021-20334.md): Local privilege escalation in MongoDB Compass for Windows (CVSS 4.8, MongoDB Compass)
- [CVE-2021-24026](https://cve.now/CVE-2021-24026.md): A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business… (no CVSS, Facebook WhatsApp Business for iOS · Facebook WhatsApp f… +2)
- [CVE-2021-24027](https://cve.now/CVE-2021-24027.md): A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third… (no CVSS, Facebook WhatsApp Business for Android · Facebook WhatsApp…)
- [CVE-2021-29136](https://cve.now/CVE-2021-29136.md): Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink… (no CVSS, github.com/opencontainers/umoci)
- [CVE-2021-30146](https://cve.now/CVE-2021-30146.md): Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality." (no CVSS)
- [CVE-2021-30140](https://cve.now/CVE-2021-30140.md): LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. (CVSS 5.4)
- [CVE-2021-26833](https://cve.now/CVE-2021-26833.md): Cleartext Storage in a File or on Disk in TimelyBills \<= 1.7.0 for iOS and versions \<= 1.21.115 for Android allows attacker who can… (no CVSS)
- [CVE-2020-36285](https://cve.now/CVE-2020-36285.md): Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows… (no CVSS)
- [CVE-2020-36284](https://cve.now/CVE-2020-36284.md): Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows… (no CVSS)
- [CVE-2020-23533](https://cve.now/CVE-2020-23533.md): Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows… (no CVSS)
- [CVE-2021-28658](https://cve.now/CVE-2021-28658.md): In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with… (no CVSS, django)
- [CVE-2021-28142](https://cve.now/CVE-2021-28142.md): CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete." (no CVSS)
- [CVE-2021-30046](https://cve.now/CVE-2021-30046.md): VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read\_image\_band() function, in… (no CVSS)
- [CVE-2021-30045](https://cve.now/CVE-2021-30045.md): SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function. (no CVSS)
- [CVE-2021-28874](https://cve.now/CVE-2021-28874.md): SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a… (no CVSS)
- [CVE-2021-28075](https://cve.now/CVE-2021-28075.md): iKuaiOS 3.4.8 Build 202012291059 has an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive… (no CVSS)
- [CVE-2021-27698](https://cve.now/CVE-2021-27698.md): RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc\_rpl\_control\_messages.c through the… (no CVSS)
- [CVE-2021-27697](https://cve.now/CVE-2021-27697.md): RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc\_rpl\_validation.c through the… (no CVSS)
- [CVE-2021-27357](https://cve.now/CVE-2021-27357.md): RIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc\_rpl\_control\_messages.c. (no CVSS)
- [CVE-2021-27343](https://cve.now/CVE-2021-27343.md): SerenityOS Unspecified is affected by: Buffer Overflow. (no CVSS)
- [CVE-2021-28173](https://cve.now/CVE-2021-28173.md): Vangene deltaFlow E-platform - Arbitrary File Upload (CVSS 9.8, Vangene deltaFlow E-platform)
- [CVE-2021-28172](https://cve.now/CVE-2021-28172.md): Vangene deltaFlow E-platform - Path Traversal (CVSS 7.5, Vangene deltaFlow E-platform)
- [CVE-2021-28171](https://cve.now/CVE-2021-28171.md): Vangene deltaFlow E-platform - Broken Authentication (CVSS 9.8, Vangene deltaFlow E-platform)
- [CVE-2021-30163](https://cve.now/CVE-2021-30163.md): Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that… (no CVSS)
- [CVE-2020-36306](https://cve.now/CVE-2020-36306.md): Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back\_url field. (no CVSS)
- [CVE-2020-36307](https://cve.now/CVE-2020-36307.md): Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links. (no CVSS)
- [CVE-2020-36308](https://cve.now/CVE-2020-36308.md): Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and… (no CVSS)
- [CVE-2019-25026](https://cve.now/CVE-2019-25026.md): Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. (no CVSS)
- [CVE-2021-30164](https://cve.now/CVE-2021-30164.md): Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add\_issue\_notes permission requirement by leveraging the Issues… (no CVSS)
- [CVE-2021-30161](https://cve.now/CVE-2021-30161.md): An issue was discovered on LG mobile devices with Android OS 11 software. (no CVSS)
- [CVE-2021-30162](https://cve.now/CVE-2021-30162.md): An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. (no CVSS)
- [CVE-2021-30154](https://cve.now/CVE-2021-30154.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30157](https://cve.now/CVE-2021-30157.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30158](https://cve.now/CVE-2021-30158.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30149](https://cve.now/CVE-2021-30149.md): Composr 10.0.36 allows upload and execution of PHP files. (no CVSS)
- [CVE-2021-30150](https://cve.now/CVE-2021-30150.md): Composr 10.0.36 allows XSS in an XML script. (no CVSS)
- [CVE-2021-28209](https://cve.now/CVE-2021-28209.md): ASUS BMC's firmware: path traversal - Delete video file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28208](https://cve.now/CVE-2021-28208.md): ASUS BMC's firmware: path traversal - Get video file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28207](https://cve.now/CVE-2021-28207.md): ASUS BMC's firmware: path traversal - Get Help file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28206](https://cve.now/CVE-2021-28206.md): ASUS BMC's firmware: path traversal - Record video file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28205](https://cve.now/CVE-2021-28205.md): ASUS BMC's firmware: path traversal - Delete SOL video file function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28204](https://cve.now/CVE-2021-28204.md): ASUS BMC's firmware: command injection - Modify user’s information function (CVSS 7.2, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28203](https://cve.now/CVE-2021-28203.md): ASUS BMC's firmware: command injection - Web Set Media Image function (CVSS 7.2, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28202](https://cve.now/CVE-2021-28202.md): ASUS BMC's firmware: buffer overflow - Service configuration-2 function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28201](https://cve.now/CVE-2021-28201.md): ASUS BMC's firmware: buffer overflow - Service configuration-1 function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28200](https://cve.now/CVE-2021-28200.md): ASUS BMC's firmware: buffer overflow - CD media configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28199](https://cve.now/CVE-2021-28199.md): ASUS BMC's firmware: buffer overflow - Modify user’s information function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28198](https://cve.now/CVE-2021-28198.md): ASUS BMC's firmware: buffer overflow - Firmware protocol configuration (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28197](https://cve.now/CVE-2021-28197.md): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28196](https://cve.now/CVE-2021-28196.md): ASUS BMC's firmware: buffer overflow - Generate SSL certificate function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28195](https://cve.now/CVE-2021-28195.md): ASUS BMC's firmware: buffer overflow - Radius configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28194](https://cve.now/CVE-2021-28194.md): ASUS BMC's firmware: buffer overflow - Remote image configuration setting (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28193](https://cve.now/CVE-2021-28193.md): ASUS BMC's firmware: buffer overflow - SMTP configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28192](https://cve.now/CVE-2021-28192.md): ASUS BMC's firmware: buffer overflow - Remote video storage function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28191](https://cve.now/CVE-2021-28191.md): ASUS BMC's firmware: buffer overflow - Firmware update function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28190](https://cve.now/CVE-2021-28190.md): ASUS BMC's firmware: buffer overflow - Generate new certificate function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28189](https://cve.now/CVE-2021-28189.md): ASUS BMC's firmware: buffer overflow - SMTP configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28188](https://cve.now/CVE-2021-28188.md): ASUS BMC's firmware: buffer overflow - Modify user’s information function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28187](https://cve.now/CVE-2021-28187.md): ASUS BMC's firmware: buffer overflow - Generate new SSL certificate (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28186](https://cve.now/CVE-2021-28186.md): ASUS BMC's firmware: buffer overflow - ActiveX configuration-2 acquisition (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28185](https://cve.now/CVE-2021-28185.md): ASUS BMC's firmware: buffer overflow - ActiveX configuration-1 acquisition (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28184](https://cve.now/CVE-2021-28184.md): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28183](https://cve.now/CVE-2021-28183.md): ASUS BMC's firmware: buffer overflow - Web License configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28182](https://cve.now/CVE-2021-28182.md): ASUS BMC's firmware: buffer overflow - Web Service configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28181](https://cve.now/CVE-2021-28181.md): ASUS BMC's firmware: buffer overflow - Remote video configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28180](https://cve.now/CVE-2021-28180.md): ASUS BMC's firmware: buffer overflow - Audit log configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28179](https://cve.now/CVE-2021-28179.md): ASUS BMC's firmware: buffer overflow - Media support configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28178](https://cve.now/CVE-2021-28178.md): ASUS BMC's firmware: buffer overflow - UEFI configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28177](https://cve.now/CVE-2021-28177.md): ASUS BMC's firmware: buffer overflow - LDAP configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28176](https://cve.now/CVE-2021-28176.md): ASUS BMC's firmware: buffer overflow - DNS configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28175](https://cve.now/CVE-2021-28175.md): ASUS BMC's firmware: buffer overflow - Radius configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-30144](https://cve.now/CVE-2021-30144.md): The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the… (CVSS 4.3)
- [CVE-2021-30130](https://cve.now/CVE-2021-30130.md): phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification. (no CVSS, phpseclib/phpseclib)
- [CVE-2021-30151](https://cve.now/CVE-2021-30151.md): Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. (no CVSS, sidekiq)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.