CVEs published April 1, 2021
64 CVEs were published on April 1, 2021: 0 critical, 6 high.
- Published
- 64
- Critical
- 0
- High
- 6
- Medium
- 6
- Low
- 2
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- EMUI;Magic UI
- 4
- Atlassian Jira Server · Atlassian Jira Data Center
- 3
- The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- 3
- Adobe Acrobat Reader
- 2
- arenavec
- 2
- https://github.com/curl/curl
- 2
- reorder
- 2
- zeromq
- 2
- adtensor
- 1
- ansible
- 1
High 6
- CVE-2021-21421ApiKey secret could be revelated on network issuecreharmony node-etsy-client · node-etsy-client
- CVE-2021-21420Vulnerability in Stripe for Visual Studio Code < 1.7.3vscode-stripe
- CVE-2021-22195Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user systemgitlab-vscode-extension
- CVE-2021-28165In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2021-28545Acrobat Reader DC Missing Support for Integrity CheckAdobe Acrobat Reader
- CVE-2021-29083Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.Synology DiskStation Manager
Medium, low and unrated 58
- CVE-2021-23922An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12.
- CVE-2021-23925An issue was discovered in Devolutions Server before 2020.3.
- CVE-2021-23924An issue was discovered in Devolutions Server before 2020.3.
- CVE-2021-23921An issue was discovered in Devolutions Server before 2020.3.
- CVE-2021-23923An issue was discovered in Devolutions Server before 2020.3.
- CVE-2021-21416Potential sensitive information disclosed in error reportsubernostrum django-registration · django-registration
- CVE-2021-28047Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users t
- CVE-2021-28970eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks vi
- CVE-2021-28969eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to
- CVE-2020-19619Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
- CVE-2020-19618Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
- CVE-2020-19617Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
- CVE-2020-19616Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
- CVE-2020-19613Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503.
- CVE-2021-21982VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor withVMware Carbon Black Cloud Workload appliance
- CVE-2021-26581A potential security vulnerability has been identified in HPE Superdome Flex server.HPE Superdome Flex Server
- CVE-2021-26580A potential security vulnerability has been identified in HPE iLO Amplifier Pack.iLO Amplifier Pack
- CVE-2021-27653Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.Pega Systems Pega Infinity
- CVE-2021-26072The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the cAtlassian Confluence Server · Atlassian Confluence Data Cen…
- CVE-2021-20078Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in sparManage Engine OpManager
- CVE-2021-26718KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.Kaspersky Internet Security for Mac
- CVE-2021-25924In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backupgocd
- CVE-2020-9148An application bypass mechanism vulnerability exists in a component interface of Huawei Smartphone.EMUI;Magic UI
- CVE-2020-9149An application error verification vulnerability exists in a component interface of Huawei Smartphone.EMUI;Magic UI
- CVE-2020-9146A memory buffer error vulnerability exists in a component interface of Huawei Smartphone.EMUI;Magic UI
- CVE-2020-9147A memory buffer error vulnerability exists in a component interface of Huawei Smartphone.EMUI;Magic UI
- CVE-2021-20291A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1.containers/storage · github.com/containers/storage
- CVE-2021-22890curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of Thttps://github.com/curl/curl
- CVE-2021-22876curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credenhttps://github.com/curl/curl
- CVE-2021-28164In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segmThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2021-28163In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink,The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2021-22177Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource GitLab
- CVE-2021-20235There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp.zeromq
- CVE-2021-20234An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp.zeromq
- CVE-2021-3393An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11.postgresql
- CVE-2021-28546Acrobat Reader DC Missing Support for Integrity CheckAdobe Acrobat Reader
- CVE-2021-28918Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indetenetmask
- CVE-2021-29251BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).
- CVE-2021-29929An issue was discovered in the endian_trait crate through 2021-01-04 for Rust.endian_trait
- CVE-2021-29930An issue was discovered in the arenavec crate through 2021-01-12 for Rust.arenavec
- CVE-2021-29931An issue was discovered in the arenavec crate through 2021-01-12 for Rust.arenavec
- CVE-2021-29932An issue was discovered in the parse_duration crate through 2021-03-18 for Rust.parse_duration
- CVE-2021-29933An issue was discovered in the insert_many crate through 2021-01-26 for Rust.insert_many
- CVE-2021-29934An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust.uu_od
- CVE-2021-29935An issue was discovered in the rocket crate before 0.4.7 for Rust.rocket
- CVE-2021-29936An issue was discovered in the adtensor crate through 2021-01-11 for Rust.adtensor
- CVE-2021-29937An issue was discovered in the telemetry crate through 2021-02-17 for Rust.telemetry
- CVE-2021-29938An issue was discovered in the slice-deque crate through 2021-02-19 for Rust.slice-deque
- CVE-2021-29939An issue was discovered in the stackvector crate through 2021-02-19 for Rust.stackvector
- CVE-2021-29940An issue was discovered in the through crate through 2021-02-18 for Rust.through
- CVE-2021-29941An issue was discovered in the reorder crate through 2021-02-24 for Rust.reorder
- CVE-2021-29942An issue was discovered in the reorder crate through 2021-02-24 for Rust.reorder
- CVE-2020-36286The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from vAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-26071The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and fromAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2020-36238The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from vAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-20296A flaw was found in OpenEXR in versions before 3.0.0-beta.OpenEXR
- CVE-2021-29421models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.pikepdf
- CVE-2021-3447A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on maansible