CVEs published April 7, 2021
57 CVEs were published on April 7, 2021: 2 critical, 13 high.
- Published
- 57
- Critical
- 2
- High
- 13
- Medium
- 4
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 11
- daifukuya.com Kagemai
- 3
- FreeBSD
- 3
- id-map
- 3
- WonderLink Yomi-Search
- 3
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- 2
- Canonical unity-firefox-extension
- 1
- Canonical unity-firefox-extension · Canonical libunity-weba…
- 1
- CGI Script Market MagazinegerZ
- 1
Critical 2
- CVE-2021-21425Unauthenticated Arbitrary YAML Write/Update leads to Code Executiongetgrav grav-plugin-admin
- CVE-2020-11210Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, SnapdragonQualcomm Snapdragon Connectivity, Snapdragon Industrial IOT…
High 13
- CVE-2020-11255Denial of service while processing RTCP packets containing multiple SDES reports due to memory for last SDES packet is freed and rest of theQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1892Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon ConnecQualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2020-11252Trustzone initialization code will disable xPU`s when memory dumps are enabled and lead to information disclosure in Snapdragon Auto, SnapdrQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11247Out of bound memory read while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectiQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11251Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in Snapdragon Auto, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11246A double free condition can occur when the device moves to suspend mode during secure playback in Snapdragon Auto, Snapdragon Compute, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11243RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads to denial of service iQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11245Unintended reads and writes by NS EL2 in access control driver due to lack of check of input validation in Snapdragon Auto, Snapdragon CompuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11242User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contentQualcomm Snapdragon Industrial IOT, Snapdragon Mobile
- CVE-2020-11236Memory corruption due to invalid value of total dimension in the non-histogram type KPI could lead to a denial of service in Snapdragon AutoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11237Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11234When sending a socket event message to a user application, invalid information will be passed if socket is freed by other thread resulting iQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11191Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdragon Compute, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
Medium, low and unrated 42
- CVE-2021-29641Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to u
- CVE-2021-30454An issue was discovered in the outer_cgi crate before 0.2.1 for Rust.outer_cgi
- CVE-2021-30455An issue was discovered in the id-map crate through 2021-02-26 for Rust.id-map
- CVE-2021-30457An issue was discovered in the id-map crate through 2021-02-26 for Rust.id-map
- CVE-2021-30456An issue was discovered in the id-map crate through 2021-02-26 for Rust.id-map
- CVE-2021-26758Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and exec
- CVE-2021-30246In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid.jsrsasign
- CVE-2020-36315In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) a
- CVE-2020-36316In RELIC before 2021-04-03, there is a buffer overflow in PKCS#1 v1.5 signature verification because garbage bytes can be present.
- CVE-2013-1055Potential DoS through abuse of rate limit in libunity-webapps for FirefoxCanonical unity-firefox-extension · Canonical libunity-weba…
- CVE-2013-1054Possible remote DOS in WebAppsCanonical unity-firefox-extension
- CVE-2021-30123FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution.
- CVE-2021-28166In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to thThe Eclipse Foundation Eclipse Mosquitto
- CVE-2020-24137Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via
- CVE-2020-24140Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via
- CVE-2020-24139Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application vi
- CVE-2020-24135A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web scr
- CVE-2020-24136Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename p
- CVE-2020-24138Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename para
- CVE-2021-29626In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, aFreeBSD
- CVE-2021-29627In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept fFreeBSD
- CVE-2020-25584In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, aFreeBSD
- CVE-2021-28927The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the ac
- CVE-2021-21641A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.Jenkins project Jenkins promoted builds Plugin · org.jenkin…
- CVE-2021-21640Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackersJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21639Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `conJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-30185CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.indico
- CVE-2021-30184GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data.
- CVE-2020-36314fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during ex
- CVE-2021-30177There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution.
- CVE-2021-26709D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to
- CVE-2020-11231Two threads call one or both functions concurrently leading to corruption of pointers and reference counters which in turn can lead to heap Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2021-20692Directory traversal vulnerability in Archive collectively operation utility Ver.2.10.1.0 and earlier allows an attacker to create or overwriEikiSoft Archive collectively operation utility
- CVE-2021-20690Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.WonderLink Yomi-Search
- CVE-2021-20691Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.WonderLink Yomi-Search
- CVE-2021-20689Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.WonderLink Yomi-Search
- CVE-2021-20687Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via daifukuya.com Kagemai
- CVE-2021-20688Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors.GoPlace! Click Ranker
- CVE-2021-20686Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.daifukuya.com Kagemai
- CVE-2021-20684Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors.CGI Script Market MagazinegerZ
- CVE-2021-20685Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.daifukuya.com Kagemai
- CVE-2021-30147DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.