# CVEs published 2021-04-13

202 CVEs were published on April 13, 2021: 9 critical, 97 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-24028](https://cve.now/CVE-2021-24028.md): An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other… (no CVSS, Facebook Thrift)
- [CVE-2021-29370](https://cve.now/CVE-2021-29370.md): A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. (no CVSS)
- [CVE-2019-10881](https://cve.now/CVE-2019-10881.md): Default hidden Privileged Account Vulnerability in multiple XEROX devices (CVSS 9.4, XEROX AltaLink B8045/B8055/B8065/B8075/B8090 · XEROX Alt… +4)
- [CVE-2021-3473](https://cve.now/CVE-2021-3473.md): An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may… (CVSS 4.5, Lenovo XClarity Controller)
- [CVE-2021-3462](https://cve.now/CVE-2021-3462.md): A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow… (CVSS 5.5, Lenovo Power Management Driver for Windows)
- [CVE-2021-3463](https://cve.now/CVE-2021-3463.md): A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause… (CVSS 4.2, Lenovo Power Management Driver for Windows)
- [CVE-2021-3460](https://cve.now/CVE-2021-3460.md): The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the… (CVSS 8.1, Motorola MH702x)
- [CVE-2021-29440](https://cve.now/CVE-2021-29440.md): Twig allowing dangerous PHP functions by default (CVSS 8.4, getgrav grav · getgrav/grav)
- [CVE-2021-29439](https://cve.now/CVE-2021-29439.md): Plugins can be installed with minimal admin privileges (CVSS 7.2, getgrav grav-plugin-admin)
- [CVE-2021-28483](https://cve.now/CVE-2021-28483.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.0, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-28481](https://cve.now/CVE-2021-28481.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-28482](https://cve.now/CVE-2021-28482.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-28480](https://cve.now/CVE-2021-28480.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-28475](https://cve.now/CVE-2021-28475.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28477](https://cve.now/CVE-2021-28477.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Visual Studio Code)
- [CVE-2021-28473](https://cve.now/CVE-2021-28473.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28471](https://cve.now/CVE-2021-28471.md): Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28472](https://cve.now/CVE-2021-28472.md): Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code - Maven for Java Extension)
- [CVE-2021-28470](https://cve.now/CVE-2021-28470.md): Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code - GitHub Pull Requests and Iss…)
- [CVE-2021-28468](https://cve.now/CVE-2021-28468.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension)
- [CVE-2021-28469](https://cve.now/CVE-2021-28469.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28466](https://cve.now/CVE-2021-28466.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension)
- [CVE-2021-28460](https://cve.now/CVE-2021-28460.md): Azure Sphere Unsigned Code Execution Vulnerability (CVSS 8.1, Microsoft Azure Sphere)
- [CVE-2021-28464](https://cve.now/CVE-2021-28464.md): VP9 Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft VP9 Video Extensions)
- [CVE-2021-28459](https://cve.now/CVE-2021-28459.md): Azure DevOps Server Spoofing Vulnerability (CVSS 6.1, Microsoft Azure DevOps Server)
- [CVE-2021-28457](https://cve.now/CVE-2021-28457.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28458](https://cve.now/CVE-2021-28458.md): Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft @azure/ms-rest-nodeauth · @azure/ms-rest-nodeauth)
- [CVE-2021-28454](https://cve.now/CVE-2021-28454.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28456](https://cve.now/CVE-2021-28456.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28453](https://cve.now/CVE-2021-28453.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +3)
- [CVE-2021-28452](https://cve.now/CVE-2021-28452.md): Microsoft Outlook Memory Corruption Vulnerability (CVSS 7.1, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28450](https://cve.now/CVE-2021-28450.md): Microsoft SharePoint Denial of Service Vulnerability (CVSS 5.0, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-28451](https://cve.now/CVE-2021-28451.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28449](https://cve.now/CVE-2021-28449.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28447](https://cve.now/CVE-2021-28447.md): Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2021-28448](https://cve.now/CVE-2021-28448.md): Visual Studio Code Kubernetes Tools Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code - Kubernetes Tools)
- [CVE-2021-28446](https://cve.now/CVE-2021-28446.md): Windows Portmapping Information Disclosure Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2021-28444](https://cve.now/CVE-2021-28444.md): Windows Hyper-V Security Feature Bypass Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2021-28445](https://cve.now/CVE-2021-28445.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-28443](https://cve.now/CVE-2021-28443.md): Windows Console Driver Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28441](https://cve.now/CVE-2021-28441.md): Windows Hyper-V Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28442](https://cve.now/CVE-2021-28442.md): Windows TCP/IP Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28440](https://cve.now/CVE-2021-28440.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-28438](https://cve.now/CVE-2021-28438.md): Windows Console Driver Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28439](https://cve.now/CVE-2021-28439.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-28437](https://cve.now/CVE-2021-28437.md): Windows Installer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28435](https://cve.now/CVE-2021-28435.md): Windows Event Tracing Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28436](https://cve.now/CVE-2021-28436.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28434](https://cve.now/CVE-2021-28434.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28357](https://cve.now/CVE-2021-28357.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28358](https://cve.now/CVE-2021-28358.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28356](https://cve.now/CVE-2021-28356.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28354](https://cve.now/CVE-2021-28354.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28355](https://cve.now/CVE-2021-28355.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28353](https://cve.now/CVE-2021-28353.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28351](https://cve.now/CVE-2021-28351.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28352](https://cve.now/CVE-2021-28352.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28350](https://cve.now/CVE-2021-28350.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28349](https://cve.now/CVE-2021-28349.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28347](https://cve.now/CVE-2021-28347.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28348](https://cve.now/CVE-2021-28348.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28346](https://cve.now/CVE-2021-28346.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28344](https://cve.now/CVE-2021-28344.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28345](https://cve.now/CVE-2021-28345.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28343](https://cve.now/CVE-2021-28343.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28341](https://cve.now/CVE-2021-28341.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28342](https://cve.now/CVE-2021-28342.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28340](https://cve.now/CVE-2021-28340.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28338](https://cve.now/CVE-2021-28338.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28339](https://cve.now/CVE-2021-28339.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28337](https://cve.now/CVE-2021-28337.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28336](https://cve.now/CVE-2021-28336.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28334](https://cve.now/CVE-2021-28334.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28335](https://cve.now/CVE-2021-28335.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28333](https://cve.now/CVE-2021-28333.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28332](https://cve.now/CVE-2021-28332.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28330](https://cve.now/CVE-2021-28330.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28331](https://cve.now/CVE-2021-28331.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28329](https://cve.now/CVE-2021-28329.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28328](https://cve.now/CVE-2021-28328.md): Windows DNS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28326](https://cve.now/CVE-2021-28326.md): Windows AppX Deployment Server Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28327](https://cve.now/CVE-2021-28327.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28325](https://cve.now/CVE-2021-28325.md): Windows SMB Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28324](https://cve.now/CVE-2021-28324.md): Windows SMB Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-28322](https://cve.now/CVE-2021-28322.md): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-28323](https://cve.now/CVE-2021-28323.md): Windows DNS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28321](https://cve.now/CVE-2021-28321.md): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-28319](https://cve.now/CVE-2021-28319.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-28320](https://cve.now/CVE-2021-28320.md): Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28318](https://cve.now/CVE-2021-28318.md): Windows GDI+ Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28317](https://cve.now/CVE-2021-28317.md): Microsoft Windows Codecs Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28315](https://cve.now/CVE-2021-28315.md): Windows Media Video Decoder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28316](https://cve.now/CVE-2021-28316.md): Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability (CVSS 4.2, Microsoft Windows)
- [CVE-2021-28314](https://cve.now/CVE-2021-28314.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28312](https://cve.now/CVE-2021-28312.md): Windows NTFS Denial of Service Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2021-28313](https://cve.now/CVE-2021-28313.md): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-28311](https://cve.now/CVE-2021-28311.md): Windows Application Compatibility Cache Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28310](https://cve.now/CVE-2021-28310.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-27096](https://cve.now/CVE-2021-27096.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28309](https://cve.now/CVE-2021-28309.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-27095](https://cve.now/CVE-2021-27095.md): Windows Media Video Decoder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27094](https://cve.now/CVE-2021-27094.md): Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2021-27093](https://cve.now/CVE-2021-27093.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-27091](https://cve.now/CVE-2021-27091.md): RPC Endpoint Mapper Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27092](https://cve.now/CVE-2021-27092.md): Azure AD Web Sign-in Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-27090](https://cve.now/CVE-2021-27090.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27088](https://cve.now/CVE-2021-27088.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27089](https://cve.now/CVE-2021-27089.md): Microsoft Internet Messaging API Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27086](https://cve.now/CVE-2021-27086.md): Windows Services and Controller App Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27079](https://cve.now/CVE-2021-27079.md): Windows Media Photo Codec Information Disclosure Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2021-27067](https://cve.now/CVE-2021-27067.md): Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Azure DevOps Server · Microsoft Team Foundatio… +2)
- [CVE-2021-27072](https://cve.now/CVE-2021-27072.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-27064](https://cve.now/CVE-2021-27064.md): Visual Studio Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2021-26417](https://cve.now/CVE-2021-26417.md): Windows Overlay Filter Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-26415](https://cve.now/CVE-2021-26415.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-26416](https://cve.now/CVE-2021-26416.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2021-26413](https://cve.now/CVE-2021-26413.md): Windows Installer Spoofing Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2021-27609](https://cve.now/CVE-2021-27609.md): SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call… (CVSS 4.6, SAP SE SAP Focused RUN)
- [CVE-2021-21485](https://cve.now/CVE-2021-21485.md): An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java… (CVSS 7.4, SAP SE SAP NetWeaver AS for JAVA)
- [CVE-2021-27605](https://cve.now/CVE-2021-27605.md): SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but… (CVSS 4.3, SAP SE SAP Fiori Apps 2.0 for Travel Management in SAP ERP)
- [CVE-2021-27601](https://cve.now/CVE-2021-27601.md): SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the… (CVSS 5.4, SAP SE SAP NetWeaver AS for Java)
- [CVE-2021-27600](https://cve.now/CVE-2021-27600.md): SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into… (CVSS 6.4, SAP SE SAP Manufacturing Execution)
- [CVE-2021-27602](https://cve.now/CVE-2021-27602.md): SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which… (CVSS 9.9, SAP SE SAP Commerce)
- [CVE-2021-27603](https://cve.now/CVE-2021-27603.md): An RFC enabled function module SPI\_WAIT\_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for… (CVSS 6.5, SAP SE SAP NetWeaver AS for ABAP)
- [CVE-2021-21492](https://cve.now/CVE-2021-21492.md): SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate… (CVSS 4.3, SAP SE SAP NetWeaver AS for JAVA)
- [CVE-2021-29438](https://cve.now/CVE-2021-29438.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs (CVSS 4.6, nextcloud-dialogs · @nextcloud/dialogs)
- [CVE-2021-21482](https://cve.now/CVE-2021-21482.md): SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet… (CVSS 8.3, SAP SE SAP NetWeaver Master Data Management)
- [CVE-2021-21483](https://cve.now/CVE-2021-21483.md): Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information… (CVSS 8.2, SAP SE SAP Solution Manager)
- [CVE-2021-27598](https://cve.now/CVE-2021-27598.md): SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data… (CVSS 6.5, SAP SE SAP NetWeaver AS for JAVA)
- [CVE-2021-22720](https://cve.now/CVE-2021-22720.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7… (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22719](https://cve.now/CVE-2021-22719.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7… (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22718](https://cve.now/CVE-2021-22718.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7… (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22717](https://cve.now/CVE-2021-22717.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7… (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22716](https://cve.now/CVE-2021-22716.md): A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an… (CVSS 7.8, Schneider Electric C-Bus Toolkit)
- [CVE-2021-0468](https://cve.now/CVE-2021-0468.md): In LK, there is a possible escalation of privilege due to an insecure default value. (no CVSS, Android)
- [CVE-2021-0444](https://cve.now/CVE-2021-0444.md): In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent. (no CVSS, Android)
- [CVE-2021-0430](https://cve.now/CVE-2021-0430.md): In rw\_mfc\_handle\_read\_op of rw\_mfc.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0400](https://cve.now/CVE-2021-0400.md): In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to… (no CVSS, Android)
- [CVE-2021-0436](https://cve.now/CVE-2021-0436.md): In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer overflow. (no CVSS, Android)
- [CVE-2021-29437](https://cve.now/CVE-2021-29437.md): Account compromise by man-in-the-middle attack (CVSS 8.0, ScratchVerifier ScratchOAuth2)
- [CVE-2021-0471](https://cve.now/CVE-2021-0471.md): In decrypt\_1\_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0437](https://cve.now/CVE-2021-0437.md): In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. (no CVSS, Android)
- [CVE-2021-0429](https://cve.now/CVE-2021-0429.md): In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0442](https://cve.now/CVE-2021-0442.md): In updateInfo of android\_hardware\_input\_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. (no CVSS, Android)
- [CVE-2021-0427](https://cve.now/CVE-2021-0427.md): In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0426](https://cve.now/CVE-2021-0426.md): In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0439](https://cve.now/CVE-2021-0439.md): In setPowerModeWithHandle of com\_android\_server\_power\_PowerManagerService.cpp, there is a possible out of bounds write due to a missing… (no CVSS, Android)
- [CVE-2021-0435](https://cve.now/CVE-2021-0435.md): In avrc\_proc\_vendor\_command of avrc\_api.cc, there is a possible leak of heap data due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0431](https://cve.now/CVE-2021-0431.md): In avrc\_msg\_cback of avrc\_api.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0432](https://cve.now/CVE-2021-0432.md): In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race… (no CVSS, Android)
- [CVE-2021-0428](https://cve.now/CVE-2021-0428.md): In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0445](https://cve.now/CVE-2021-0445.md): In start of WelcomeActivity.java, there is a possible residual profile due to a confused deputy. (no CVSS, Android)
- [CVE-2021-0446](https://cve.now/CVE-2021-0446.md): In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-0433](https://cve.now/CVE-2021-0433.md): In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a… (no CVSS, Android)
- [CVE-2021-0443](https://cve.now/CVE-2021-0443.md): In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. (no CVSS, Android)
- [CVE-2021-0438](https://cve.now/CVE-2021-0438.md): In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an… (no CVSS, Android)
- [CVE-2021-21784](https://cve.now/CVE-2021-21784.md): An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2020-28590](https://cve.now/CVE-2020-28590.md): An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master… (CVSS 8.6, Slic3r)
- [CVE-2021-23280](https://cve.now/CVE-2021-23280.md): Arbitrary File upload (CVSS 8.0, Eaton Intelligent Power manager)
- [CVE-2021-23277](https://cve.now/CVE-2021-23277.md): Improper Neutralization of Directives in Dynamically Evaluated Code (CVSS 8.3, Eaton Intelligent Power manager)
- [CVE-2021-23281](https://cve.now/CVE-2021-23281.md): Remote Code execution (CVSS 10.0, Eaton Intelligent Power manager)
- [CVE-2021-23279](https://cve.now/CVE-2021-23279.md): Arbitrary File delete (CVSS 8.0, Eaton Intelligent Power manager)
- [CVE-2021-23276](https://cve.now/CVE-2021-23276.md): Improper Neutralization of Special Elements used in an SQL Command (CVSS 7.1, Eaton Intelligent Power manager)
- [CVE-2021-23278](https://cve.now/CVE-2021-23278.md): Arbitrary File delete (CVSS 8.7, Eaton Intelligent Power manager)
- [CVE-2021-29427](https://cve.now/CVE-2021-29427.md): Repository content filters do not work in Settings pluginManagement (CVSS 8.0, gradle)
- [CVE-2021-29428](https://cve.now/CVE-2021-29428.md): Local privilege escalation through system temporary directory (CVSS 8.8, gradle)
- [CVE-2021-21399](https://cve.now/CVE-2021-21399.md): Unauthenticated SubSonic backend access in Ampache (CVSS 9.1, ampache)
- [CVE-2021-29436](https://cve.now/CVE-2021-29436.md): Cross site request forgery vulnerability (CVSS 5.4, anuko timetracker)
- [CVE-2021-29435](https://cve.now/CVE-2021-29435.md): Cross-Site Request Forgery (CSRF) in trestle-auth (CVSS 8.1, TrestleAdmin trestle-auth · trestle-auth)
- [CVE-2021-28973](https://cve.now/CVE-2021-28973.md): The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed… (no CVSS)
- [CVE-2021-29997](https://cve.now/CVE-2021-29997.md): An issue was discovered in Wind River VxWorks 7 before 21.03. (no CVSS)
- [CVE-2021-29999](https://cve.now/CVE-2021-29999.md): An issue was discovered in Wind River VxWorks through 6.8. (no CVSS)
- [CVE-2021-29998](https://cve.now/CVE-2021-29998.md): An issue was discovered in Wind River VxWorks before 6.5. (no CVSS)
- [CVE-2021-23372](https://cve.now/CVE-2021-23372.md): Denial of Service (DoS) (CVSS 4.4, mongo-express)
- [CVE-2021-21729](https://cve.now/CVE-2021-21729.md): Some ZTE products have CSRF vulnerability. (no CVSS, ZXHN H168N,ZXHN H108N)
- [CVE-2021-21730](https://cve.now/CVE-2021-21730.md): A ZTE product is impacted by improper access control vulnerability. (no CVSS, ZXHN H168N)
- [CVE-2021-21731](https://cve.now/CVE-2021-21731.md): A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully… (no CVSS, ZXCLOUD iRAI)
- [CVE-2020-13568](https://cve.now/CVE-2020-13568.md): SQL injection vulnerability exists in phpGACL 3.3.7. (CVSS 8.8, phpGACL)
- [CVE-2020-13566](https://cve.now/CVE-2020-13566.md): SQL injection vulnerabilities exist in phpGACL 3.3.7. (CVSS 8.8, phpGACL)
- [CVE-2020-27227](https://cve.now/CVE-2020-27227.md): An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. (CVSS 10.0, OpenClinic)
- [CVE-2020-27228](https://cve.now/CVE-2020-27228.md): An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. (CVSS 8.8, OpenClinic)
- [CVE-2020-27236](https://cve.now/CVE-2020-27236.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. (CVSS 6.4, OpenClinic)
- [CVE-2020-27235](https://cve.now/CVE-2020-27235.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. (CVSS 6.4, OpenClinic)
- [CVE-2020-27234](https://cve.now/CVE-2020-27234.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. (CVSS 6.4, OpenClinic)
- [CVE-2020-27233](https://cve.now/CVE-2020-27233.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. (CVSS 6.4, OpenClinic)
- [CVE-2021-22505](https://cve.now/CVE-2021-22505.md): Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.14 and 12.15. (no CVSS, Operations Agent)
- [CVE-2021-30176](https://cve.now/CVE-2021-30176.md): The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint. (no CVSS)
- [CVE-2021-30175](https://cve.now/CVE-2021-30175.md): ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page. (no CVSS)
- [CVE-2021-28647](https://cve.now/CVE-2021-28647.md): Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a… (no CVSS, Trend Micro Password Manager)
- [CVE-2021-28646](https://cve.now/CVE-2021-28646.md): An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local… (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-28645](https://cve.now/CVE-2021-28645.md): An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local… (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-25253](https://cve.now/CVE-2021-25253.md): An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource… (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-25250](https://cve.now/CVE-2021-25250.md): An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive… (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-29425](https://cve.now/CVE-2021-29425.md): Possible limited path traversal vulnerabily in Apache Commons IO (CVSS 6.5, Apache Software Foundation Apache Commons IO · commons-i… +9)
- [CVE-2021-29943](https://cve.now/CVE-2021-29943.md): Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2021-29262](https://cve.now/CVE-2021-29262.md): Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2021-27905](https://cve.now/CVE-2021-27905.md): SSRF vulnerability with the Replication handler (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2021-28938](https://cve.now/CVE-2021-28938.md): Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before… (no CVSS)
- [CVE-2021-29003](https://cve.now/CVE-2021-29003.md): Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to… (no CVSS)
- [CVE-2021-29054](https://cve.now/CVE-2021-29054.md): Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. (no CVSS)
- [CVE-2021-30637](https://cve.now/CVE-2021-30637.md): htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php. (no CVSS)
- [CVE-2021-30503](https://cve.now/CVE-2021-30503.md): The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.