# CVEs published 2021-04-01

64 CVEs were published on April 1, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2021-21421](https://cve.now/CVE-2021-21421.md): ApiKey secret could be revelated on network issue (CVSS 8.1, creharmony node-etsy-client · node-etsy-client)
- [CVE-2021-23922](https://cve.now/CVE-2021-23922.md): An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. (no CVSS)
- [CVE-2021-23925](https://cve.now/CVE-2021-23925.md): An issue was discovered in Devolutions Server before 2020.3. (no CVSS)
- [CVE-2021-23924](https://cve.now/CVE-2021-23924.md): An issue was discovered in Devolutions Server before 2020.3. (no CVSS)
- [CVE-2021-23921](https://cve.now/CVE-2021-23921.md): An issue was discovered in Devolutions Server before 2020.3. (no CVSS)
- [CVE-2021-23923](https://cve.now/CVE-2021-23923.md): An issue was discovered in Devolutions Server before 2020.3. (no CVSS)
- [CVE-2021-21420](https://cve.now/CVE-2021-21420.md): Vulnerability in Stripe for Visual Studio Code \< 1.7.3 (CVSS 7.5, vscode-stripe)
- [CVE-2021-21416](https://cve.now/CVE-2021-21416.md): Potential sensitive information disclosed in error reports (CVSS 3.7, ubernostrum django-registration · django-registration)
- [CVE-2021-28047](https://cve.now/CVE-2021-28047.md): Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users t (no CVSS)
- [CVE-2021-28970](https://cve.now/CVE-2021-28970.md): eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks vi (no CVSS)
- [CVE-2021-28969](https://cve.now/CVE-2021-28969.md): eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort\_by parameter to (no CVSS)
- [CVE-2020-19619](https://cve.now/CVE-2020-19619.md): Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile. (no CVSS)
- [CVE-2020-19618](https://cve.now/CVE-2020-19618.md): Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing. (no CVSS)
- [CVE-2020-19617](https://cve.now/CVE-2020-19617.md): Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile. (no CVSS)
- [CVE-2020-19616](https://cve.now/CVE-2020-19616.md): Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing. (no CVSS)
- [CVE-2020-19613](https://cve.now/CVE-2020-19613.md): Server Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in sunkaifei FlyCMS version 20190503. (no CVSS)
- [CVE-2021-21982](https://cve.now/CVE-2021-21982.md): VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with (no CVSS, VMware Carbon Black Cloud Workload appliance)
- [CVE-2021-26581](https://cve.now/CVE-2021-26581.md): A potential security vulnerability has been identified in HPE Superdome Flex server. (no CVSS, HPE Superdome Flex Server)
- [CVE-2021-26580](https://cve.now/CVE-2021-26580.md): A potential security vulnerability has been identified in HPE iLO Amplifier Pack. (no CVSS, iLO Amplifier Pack)
- [CVE-2021-27653](https://cve.now/CVE-2021-27653.md): Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. (CVSS 6.6, Pega Systems Pega Infinity)
- [CVE-2021-26072](https://cve.now/CVE-2021-26072.md): The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the c (no CVSS, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2021-20078](https://cve.now/CVE-2021-20078.md): Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spar (no CVSS, Manage Engine OpManager)
- [CVE-2021-26718](https://cve.now/CVE-2021-26718.md): KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection. (no CVSS, Kaspersky Internet Security for Mac)
- [CVE-2021-25924](https://cve.now/CVE-2021-25924.md): In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the \`/go/api/config/backup (no CVSS, gocd)
- [CVE-2020-9148](https://cve.now/CVE-2020-9148.md): An application bypass mechanism vulnerability exists in a component interface of Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2020-9149](https://cve.now/CVE-2020-9149.md): An application error verification vulnerability exists in a component interface of Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2020-9146](https://cve.now/CVE-2020-9146.md): A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2020-9147](https://cve.now/CVE-2020-9147.md): A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-20291](https://cve.now/CVE-2021-20291.md): A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. (no CVSS, containers/storage · github.com/containers/storage)
- [CVE-2021-22890](https://cve.now/CVE-2021-22890.md): curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of T (CVSS 4.3, https://github.com/curl/curl)
- [CVE-2021-22876](https://cve.now/CVE-2021-22876.md): curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking creden (CVSS 5.3, https://github.com/curl/curl)
- [CVE-2021-22195](https://cve.now/CVE-2021-22195.md): Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system (CVSS 8.6, gitlab-vscode-extension)
- [CVE-2021-28164](https://cve.now/CVE-2021-28164.md): In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segm (CVSS 5.3, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2021-28165](https://cve.now/CVE-2021-28165.md): In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large inva (CVSS 7.5, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2021-28163](https://cve.now/CVE-2021-28163.md): In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, (CVSS 2.7, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2021-22177](https://cve.now/CVE-2021-22177.md): Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource (CVSS 4.3, GitLab)
- [CVE-2021-20235](https://cve.now/CVE-2021-20235.md): There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder\_allocators.hpp. (no CVSS, zeromq)
- [CVE-2021-20234](https://cve.now/CVE-2021-20234.md): An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. (no CVSS, zeromq)
- [CVE-2021-3393](https://cve.now/CVE-2021-3393.md): An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. (no CVSS, postgresql)
- [CVE-2021-28546](https://cve.now/CVE-2021-28546.md): Acrobat Reader DC Missing Support for Integrity Check (CVSS 6.5, Adobe Acrobat Reader)
- [CVE-2021-28545](https://cve.now/CVE-2021-28545.md): Acrobat Reader DC Missing Support for Integrity Check (CVSS 8.1, Adobe Acrobat Reader)
- [CVE-2021-28918](https://cve.now/CVE-2021-28918.md): Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indete (no CVSS, netmask)
- [CVE-2021-29083](https://cve.now/CVE-2021-29083.md): Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6. (CVSS 7.2, Synology DiskStation Manager)
- [CVE-2021-29251](https://cve.now/CVE-2021-29251.md): BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings \> Policies). (no CVSS)
- [CVE-2021-29929](https://cve.now/CVE-2021-29929.md): An issue was discovered in the endian\_trait crate through 2021-01-04 for Rust. (no CVSS, endian\_trait)
- [CVE-2021-29930](https://cve.now/CVE-2021-29930.md): An issue was discovered in the arenavec crate through 2021-01-12 for Rust. (no CVSS, arenavec)
- [CVE-2021-29931](https://cve.now/CVE-2021-29931.md): An issue was discovered in the arenavec crate through 2021-01-12 for Rust. (no CVSS, arenavec)
- [CVE-2021-29932](https://cve.now/CVE-2021-29932.md): An issue was discovered in the parse\_duration crate through 2021-03-18 for Rust. (no CVSS, parse\_duration)
- [CVE-2021-29933](https://cve.now/CVE-2021-29933.md): An issue was discovered in the insert\_many crate through 2021-01-26 for Rust. (no CVSS, insert\_many)
- [CVE-2021-29934](https://cve.now/CVE-2021-29934.md): An issue was discovered in PartialReader in the uu\_od crate before 0.0.4 for Rust. (no CVSS, uu\_od)
- [CVE-2021-29935](https://cve.now/CVE-2021-29935.md): An issue was discovered in the rocket crate before 0.4.7 for Rust. (no CVSS, rocket)
- [CVE-2021-29936](https://cve.now/CVE-2021-29936.md): An issue was discovered in the adtensor crate through 2021-01-11 for Rust. (no CVSS, adtensor)
- [CVE-2021-29937](https://cve.now/CVE-2021-29937.md): An issue was discovered in the telemetry crate through 2021-02-17 for Rust. (no CVSS, telemetry)
- [CVE-2021-29938](https://cve.now/CVE-2021-29938.md): An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. (no CVSS, slice-deque)
- [CVE-2021-29939](https://cve.now/CVE-2021-29939.md): An issue was discovered in the stackvector crate through 2021-02-19 for Rust. (no CVSS, stackvector)
- [CVE-2021-29940](https://cve.now/CVE-2021-29940.md): An issue was discovered in the through crate through 2021-02-18 for Rust. (no CVSS, through)
- [CVE-2021-29941](https://cve.now/CVE-2021-29941.md): An issue was discovered in the reorder crate through 2021-02-24 for Rust. (no CVSS, reorder)
- [CVE-2021-29942](https://cve.now/CVE-2021-29942.md): An issue was discovered in the reorder crate through 2021-02-24 for Rust. (no CVSS, reorder)
- [CVE-2020-36286](https://cve.now/CVE-2020-36286.md): The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-26071](https://cve.now/CVE-2021-26071.md): The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2020-36238](https://cve.now/CVE-2020-36238.md): The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-20296](https://cve.now/CVE-2021-20296.md): A flaw was found in OpenEXR in versions before 3.0.0-beta. (no CVSS, OpenEXR)
- [CVE-2021-29421](https://cve.now/CVE-2021-29421.md): models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries. (no CVSS, pikepdf)
- [CVE-2021-3447](https://cve.now/CVE-2021-3447.md): A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on ma (no CVSS, ansible)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.