# CVEs published 2021-04-06

93 CVEs were published on April 6, 2021: 2 critical, 4 high. Days are UTC.

- [CVE-2020-36310](https://cve.now/CVE-2020-36310.md): An issue was discovered in the Linux kernel before 5.8. (no CVSS)
- [CVE-2021-30178](https://cve.now/CVE-2021-30178.md): An issue was discovered in the Linux kernel through 5.11.11. (no CVSS)
- [CVE-2020-36311](https://cve.now/CVE-2020-36311.md): An issue was discovered in the Linux kernel before 5.9. (no CVSS)
- [CVE-2020-36312](https://cve.now/CVE-2020-36312.md): An issue was discovered in the Linux kernel before 5.8.10. (no CVSS)
- [CVE-2020-36313](https://cve.now/CVE-2020-36313.md): An issue was discovered in the Linux kernel before 5.7. (no CVSS)
- [CVE-2021-27900](https://cve.now/CVE-2021-27900.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Co (no CVSS)
- [CVE-2021-22158](https://cve.now/CVE-2021-22158.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web (no CVSS)
- [CVE-2021-27899](https://cve.now/CVE-2021-27899.md): The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server (no CVSS)
- [CVE-2021-22157](https://cve.now/CVE-2021-22157.md): Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS. (no CVSS)
- [CVE-2020-13422](https://cve.now/CVE-2020-13422.md): OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/\* administrative actions. (no CVSS)
- [CVE-2020-13421](https://cve.now/CVE-2020-13421.md): OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions. (no CVSS)
- [CVE-2020-13419](https://cve.now/CVE-2020-13419.md): OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task. (no CVSS)
- [CVE-2020-13418](https://cve.now/CVE-2020-13418.md): OpenIAM before 4.2.0.3 allows XSS in the Add New User feature. (no CVSS)
- [CVE-2020-13420](https://cve.now/CVE-2020-13420.md): OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script. (no CVSS)
- [CVE-2021-21404](https://cve.now/CVE-2021-21404.md): Crash due to malformed relay protocol message (CVSS 7.5, syncthing · github.com/syncthing/syncthing)
- [CVE-2021-25692](https://cve.now/CVE-2021-25692.md): Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01. (no CVSS, Teradici PCoIP Connection Manager and Security Gateway)
- [CVE-2021-21423](https://cve.now/CVE-2021-21423.md): Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen (CVSS 6.8, projen)
- [CVE-2021-28688](https://cve.now/CVE-2021-28688.md): The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. (no CVSS, Linux)
- [CVE-2020-36309](https://cve.now/CVE-2020-36309.md): ngx\_http\_lua\_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate (no CVSS)
- [CVE-2021-20334](https://cve.now/CVE-2021-20334.md): Local privilege escalation in MongoDB Compass for Windows (CVSS 4.8, MongoDB Compass)
- [CVE-2021-24026](https://cve.now/CVE-2021-24026.md): A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for (no CVSS, Facebook WhatsApp Business for iOS · Facebook WhatsApp f… +2)
- [CVE-2021-24027](https://cve.now/CVE-2021-24027.md): A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third p (no CVSS, Facebook WhatsApp Business for Android · Facebook WhatsApp…)
- [CVE-2021-29136](https://cve.now/CVE-2021-29136.md): Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink trav (no CVSS, github.com/opencontainers/umoci)
- [CVE-2021-30146](https://cve.now/CVE-2021-30146.md): Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality." (no CVSS)
- [CVE-2021-30140](https://cve.now/CVE-2021-30140.md): LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. (CVSS 5.4)
- [CVE-2021-26833](https://cve.now/CVE-2021-26833.md): Cleartext Storage in a File or on Disk in TimelyBills \<= 1.7.0 for iOS and versions \<= 1.21.115 for Android allows attacker who can locally (no CVSS)
- [CVE-2020-36285](https://cve.now/CVE-2020-36285.md): Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows atta (no CVSS)
- [CVE-2020-36284](https://cve.now/CVE-2020-36284.md): Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attacker (no CVSS)
- [CVE-2020-23533](https://cve.now/CVE-2020-23533.md): Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows att (no CVSS)
- [CVE-2021-28658](https://cve.now/CVE-2021-28658.md): In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with su (no CVSS, django)
- [CVE-2021-28142](https://cve.now/CVE-2021-28142.md): CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete." (no CVSS)
- [CVE-2021-30046](https://cve.now/CVE-2021-30046.md): VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read\_image\_band() function, in whi (no CVSS)
- [CVE-2021-30045](https://cve.now/CVE-2021-30045.md): SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function. (no CVSS)
- [CVE-2021-28874](https://cve.now/CVE-2021-28874.md): SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a cr (no CVSS)
- [CVE-2021-28075](https://cve.now/CVE-2021-28075.md): iKuaiOS 3.4.8 Build 202012291059 has an arbitrary file download vulnerability, which can be exploited by attackers to obtain sensitive infor (no CVSS)
- [CVE-2021-27698](https://cve.now/CVE-2021-27698.md): RIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc\_rpl\_control\_messages.c through the \_parse\_options (no CVSS)
- [CVE-2021-27697](https://cve.now/CVE-2021-27697.md): RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc\_rpl\_validation.c through the gnrc\_rpl\_validation\_o (no CVSS)
- [CVE-2021-27357](https://cve.now/CVE-2021-27357.md): RIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl/gnrc\_rpl\_control\_messages.c. (no CVSS)
- [CVE-2021-27343](https://cve.now/CVE-2021-27343.md): SerenityOS Unspecified is affected by: Buffer Overflow. (no CVSS)
- [CVE-2021-28173](https://cve.now/CVE-2021-28173.md): Vangene deltaFlow E-platform - Arbitrary File Upload (CVSS 9.8, Vangene deltaFlow E-platform)
- [CVE-2021-28172](https://cve.now/CVE-2021-28172.md): Vangene deltaFlow E-platform - Path Traversal (CVSS 7.5, Vangene deltaFlow E-platform)
- [CVE-2021-28171](https://cve.now/CVE-2021-28171.md): Vangene deltaFlow E-platform - Broken Authentication (CVSS 9.8, Vangene deltaFlow E-platform)
- [CVE-2021-30163](https://cve.now/CVE-2021-30163.md): Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that h (no CVSS)
- [CVE-2020-36306](https://cve.now/CVE-2020-36306.md): Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back\_url field. (no CVSS)
- [CVE-2020-36307](https://cve.now/CVE-2020-36307.md): Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links. (no CVSS)
- [CVE-2020-36308](https://cve.now/CVE-2020-36308.md): Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and r (no CVSS)
- [CVE-2019-25026](https://cve.now/CVE-2019-25026.md): Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. (no CVSS)
- [CVE-2021-30164](https://cve.now/CVE-2021-30164.md): Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add\_issue\_notes permission requirement by leveraging the Issues A (no CVSS)
- [CVE-2021-30161](https://cve.now/CVE-2021-30161.md): An issue was discovered on LG mobile devices with Android OS 11 software. (no CVSS)
- [CVE-2021-30162](https://cve.now/CVE-2021-30162.md): An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. (no CVSS)
- [CVE-2021-30154](https://cve.now/CVE-2021-30154.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30157](https://cve.now/CVE-2021-30157.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30158](https://cve.now/CVE-2021-30158.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30149](https://cve.now/CVE-2021-30149.md): Composr 10.0.36 allows upload and execution of PHP files. (no CVSS)
- [CVE-2021-30150](https://cve.now/CVE-2021-30150.md): Composr 10.0.36 allows XSS in an XML script. (no CVSS)
- [CVE-2021-28209](https://cve.now/CVE-2021-28209.md): ASUS BMC's firmware: path traversal - Delete video file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28208](https://cve.now/CVE-2021-28208.md): ASUS BMC's firmware: path traversal - Get video file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28207](https://cve.now/CVE-2021-28207.md): ASUS BMC's firmware: path traversal - Get Help file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28206](https://cve.now/CVE-2021-28206.md): ASUS BMC's firmware: path traversal - Record video file function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28205](https://cve.now/CVE-2021-28205.md): ASUS BMC's firmware: path traversal - Delete SOL video file function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28204](https://cve.now/CVE-2021-28204.md): ASUS BMC's firmware: command injection - Modify user’s information function (CVSS 7.2, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28203](https://cve.now/CVE-2021-28203.md): ASUS BMC's firmware: command injection - Web Set Media Image function (CVSS 7.2, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28202](https://cve.now/CVE-2021-28202.md): ASUS BMC's firmware: buffer overflow - Service configuration-2 function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28201](https://cve.now/CVE-2021-28201.md): ASUS BMC's firmware: buffer overflow - Service configuration-1 function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28200](https://cve.now/CVE-2021-28200.md): ASUS BMC's firmware: buffer overflow - CD media configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28199](https://cve.now/CVE-2021-28199.md): ASUS BMC's firmware: buffer overflow - Modify user’s information function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28198](https://cve.now/CVE-2021-28198.md): ASUS BMC's firmware: buffer overflow - Firmware protocol configuration (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28197](https://cve.now/CVE-2021-28197.md): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28196](https://cve.now/CVE-2021-28196.md): ASUS BMC's firmware: buffer overflow - Generate SSL certificate function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28195](https://cve.now/CVE-2021-28195.md): ASUS BMC's firmware: buffer overflow - Radius configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28194](https://cve.now/CVE-2021-28194.md): ASUS BMC's firmware: buffer overflow - Remote image configuration setting (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28193](https://cve.now/CVE-2021-28193.md): ASUS BMC's firmware: buffer overflow - SMTP configuration function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28192](https://cve.now/CVE-2021-28192.md): ASUS BMC's firmware: buffer overflow - Remote video storage function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28191](https://cve.now/CVE-2021-28191.md): ASUS BMC's firmware: buffer overflow - Firmware update function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28190](https://cve.now/CVE-2021-28190.md): ASUS BMC's firmware: buffer overflow - Generate new certificate function (CVSS 4.9, ASUS BMC firmware for ASMB9-iKVM · ASUS BMC firmware fo… +42)
- [CVE-2021-28189](https://cve.now/CVE-2021-28189.md): ASUS BMC's firmware: buffer overflow - SMTP configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28188](https://cve.now/CVE-2021-28188.md): ASUS BMC's firmware: buffer overflow - Modify user’s information function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28187](https://cve.now/CVE-2021-28187.md): ASUS BMC's firmware: buffer overflow - Generate new SSL certificate (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28186](https://cve.now/CVE-2021-28186.md): ASUS BMC's firmware: buffer overflow - ActiveX configuration-2 acquisition (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28185](https://cve.now/CVE-2021-28185.md): ASUS BMC's firmware: buffer overflow - ActiveX configuration-1 acquisition (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28184](https://cve.now/CVE-2021-28184.md): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28183](https://cve.now/CVE-2021-28183.md): ASUS BMC's firmware: buffer overflow - Web License configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28182](https://cve.now/CVE-2021-28182.md): ASUS BMC's firmware: buffer overflow - Web Service configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28181](https://cve.now/CVE-2021-28181.md): ASUS BMC's firmware: buffer overflow - Remote video configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28180](https://cve.now/CVE-2021-28180.md): ASUS BMC's firmware: buffer overflow - Audit log configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28179](https://cve.now/CVE-2021-28179.md): ASUS BMC's firmware: buffer overflow - Media support configuration setting (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28178](https://cve.now/CVE-2021-28178.md): ASUS BMC's firmware: buffer overflow - UEFI configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28177](https://cve.now/CVE-2021-28177.md): ASUS BMC's firmware: buffer overflow - LDAP configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28176](https://cve.now/CVE-2021-28176.md): ASUS BMC's firmware: buffer overflow - DNS configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-28175](https://cve.now/CVE-2021-28175.md): ASUS BMC's firmware: buffer overflow - Radius configuration function (CVSS 4.9, ASUS BMC firmware for Z10PR-D16 · ASUS BMC firmware for… +1)
- [CVE-2021-30144](https://cve.now/CVE-2021-30144.md): The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the las (CVSS 4.3)
- [CVE-2021-30130](https://cve.now/CVE-2021-30130.md): phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification. (no CVSS, phpseclib/phpseclib)
- [CVE-2021-30151](https://cve.now/CVE-2021-30151.md): Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. (no CVSS, sidekiq)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.