CVEs published April 5, 2021
65 CVEs were published on April 5, 2021: 0 critical, 0 high.
- Published
- 65
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- Elementor Website Builder
- 6
- Tutor LMS – eLearning and online course solution
- 6
- Ninja Forms Contact Form – The Drag and Drop Form Builder f…
- 4
- ExpressTech Responsive Menu – Create Mobile-Friendly Menu ·…
- 3
- Orbit Fox by ThemeIsle
- 2
- VM Backups
- 2
- WP Page Builder
- 2
- Advanced Order Export For WooCommerce
- 1
- Contact Form 7 Style
- 1
- Database Backups
- 1
Medium, low and unrated 65
- CVE-2021-30141Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an
- CVE-2021-20307Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary mlibpano13
- CVE-2021-20308Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similahtmldoc
- CVE-2021-20305A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result nettle
- CVE-2020-19595Buffer overflow vulnerability in Core FTP Server v2 Build 697, via a crafted username.
- CVE-2020-19596Buffer overflow vulnerability in Core FTP Server v1.2 Build 583, via a crafted username.
- CVE-2021-24210PhastPress < 1.111 - Open RedirectPhastPress
- CVE-2021-24211WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)WordPress Related Posts
- CVE-2021-24212WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCEWooCommerce Help Scout
- CVE-2021-24201Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementElementor Website Builder
- CVE-2021-24202Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading WidgetElementor Website Builder
- CVE-2021-24203Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetElementor Website Builder
- CVE-2021-24204Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetElementor Website Builder
- CVE-2021-24205Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetElementor Website Builder
- CVE-2021-24206Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box WidgetElementor Website Builder
- CVE-2021-24207WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to PostsWP Page Builder
- CVE-2021-24208WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)WP Page Builder
- CVE-2021-24209WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)WP Super Cache
- CVE-2021-24177WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)File Manager
- CVE-2021-24180Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)Related Posts for WordPress
- CVE-2021-24181Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correctTutor LMS – eLearning and online course solution
- CVE-2021-24182Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_questionTutor LMS – eLearning and online course solution
- CVE-2021-24183Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_formTutor LMS – eLearning and online course solution
- CVE-2021-24184Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege EscalationTutor LMS – eLearning and online course solution
- CVE-2021-24185Tutor LMS < 1.7.7 - SQL Injection via tutor_place_ratingTutor LMS – eLearning and online course solution
- CVE-2021-24186Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_idTutor LMS – eLearning and online course solution
- CVE-2021-24187SEO Redirection < 6.4 - Authenticated Reflected Cross-Site Scripting (XSS)SEO Redirection Plugin - 301 Redirect Manager
- CVE-2021-24196Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)Social Slider Widget
- CVE-2021-24168Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)Easy Contact Form Pro
- CVE-2021-24169Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)Advanced Order Export For WooCommerce
- CVE-2021-24170User Profile Picture < 2.5.0 - Sensitive Information DisclosureUser Profile Picture
- CVE-2021-24171WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File UploadWooCommerce Upload Files
- CVE-2021-24172VM Backups <= 1.0 - CSRF to Database Backup DownloadVM Backups
- CVE-2021-24173VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)VM Backups
- CVE-2021-24174Database Backups <= 1.2.2.6 - CSRF to Backup DownloadDatabase Backups
- CVE-2021-24175The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication BypassThe Plus Addons for Elementor Page Builder
- CVE-2021-24176JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)JH 404 Logger
- CVE-2021-24159Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site ScriptingContact Form 7 Style
- CVE-2021-24160Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File UploadExpressTech Responsive Menu – Create Mobile-Friendly Menu ·…
- CVE-2021-24161Responsive Menu < 4.0.4 - CSRF to Arbitrary File UploadExpressTech Responsive Menu – Create Mobile-Friendly Menu ·…
- CVE-2021-24162Responsive Menu < 4.0.4 - CSRF to Settings UpdateExpressTech Responsive Menu – Create Mobile-Friendly Menu ·…
- CVE-2021-24163Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key DisclosureNinja Forms Contact Form – The Drag and Drop Form Builder f…
- CVE-2021-24164Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key DisclosureNinja Forms Contact Form – The Drag and Drop Form Builder f…
- CVE-2021-24165Ninja Forms < 3.4.34 - Administrator Open RedirectNinja Forms Contact Form – The Drag and Drop Form Builder f…
- CVE-2021-24166Ninja Forms < 3.4.34 - CSRF to OAuth Service DisconnectionNinja Forms Contact Form – The Drag and Drop Form Builder f…
- CVE-2021-24167Web-Stat < 1.4.1 - API Key DisclosureWeb-Stat
- CVE-2021-24150Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRFLike Button Rating ♥ LikeBtn
- CVE-2021-24152Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)Popup Builder – Responsive WordPress Pop up – Subscription…
- CVE-2021-24153Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)Yoast SEO
- CVE-2021-24154Theme Editor < 2.6 - Authenticated Arbitrary File DownloadTheme Editor
- CVE-2021-24155Backup Guard < 1.6.0 - Authenticated Arbitrary File UploadWordPress Backup and Migrate Plugin – Backup Guard
- CVE-2021-24156Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site ScriptingTestimonial Rotator
- CVE-2021-24157Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site ScriptingOrbit Fox by ThemeIsle
- CVE-2021-24158Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege EscalationOrbit Fox by ThemeIsle
- CVE-2020-4997IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2020-4792IBM Edge 4.2 is vulnerable to cross-site scripting.IBM Edge
- CVE-2021-30109Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS).froala-editor
- CVE-2021-30055A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year'
- CVE-2021-30056Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS).
- CVE-2021-30057A stored HTML injection vulnerability exists in Knowage Suite version 7.1.
- CVE-2021-30058Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS).
- CVE-2021-29996Mark Text through 0.16.3 allows attackers arbitrary command execution.
- CVE-2021-29261The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace con
- CVE-2021-28832VSCodeVim before 1.19.0 allows attackers to execute arbitrary code via a crafted workspace configuration.
- CVE-2020-17453WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.