# CVEs published 2021-04-07

57 CVEs were published on April 7, 2021: 2 critical, 13 high. Days are UTC.

- [CVE-2021-29641](https://cve.now/CVE-2021-29641.md): Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to u (no CVSS)
- [CVE-2021-30454](https://cve.now/CVE-2021-30454.md): An issue was discovered in the outer\_cgi crate before 0.2.1 for Rust. (no CVSS, outer\_cgi)
- [CVE-2021-30455](https://cve.now/CVE-2021-30455.md): An issue was discovered in the id-map crate through 2021-02-26 for Rust. (no CVSS, id-map)
- [CVE-2021-30457](https://cve.now/CVE-2021-30457.md): An issue was discovered in the id-map crate through 2021-02-26 for Rust. (no CVSS, id-map)
- [CVE-2021-30456](https://cve.now/CVE-2021-30456.md): An issue was discovered in the id-map crate through 2021-02-26 for Rust. (no CVSS, id-map)
- [CVE-2021-26758](https://cve.now/CVE-2021-26758.md): Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and exec (no CVSS)
- [CVE-2021-30246](https://cve.now/CVE-2021-30246.md): In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. (no CVSS, jsrsasign)
- [CVE-2020-36315](https://cve.now/CVE-2020-36315.md): In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) a (no CVSS)
- [CVE-2020-36316](https://cve.now/CVE-2020-36316.md): In RELIC before 2021-04-03, there is a buffer overflow in PKCS#1 v1.5 signature verification because garbage bytes can be present. (no CVSS)
- [CVE-2013-1055](https://cve.now/CVE-2013-1055.md): Potential DoS through abuse of rate limit in libunity-webapps for Firefox (CVSS 4.3, Canonical unity-firefox-extension · Canonical libunity-weba…)
- [CVE-2013-1054](https://cve.now/CVE-2013-1054.md): Possible remote DOS in WebApps (CVSS 4.3, Canonical unity-firefox-extension)
- [CVE-2021-30123](https://cve.now/CVE-2021-30123.md): FFmpeg \<=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution. (no CVSS)
- [CVE-2021-28166](https://cve.now/CVE-2021-28166.md): In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to th (CVSS 6.5, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2021-21425](https://cve.now/CVE-2021-21425.md): Unauthenticated Arbitrary YAML Write/Update leads to Code Execution (CVSS 9.3, getgrav grav-plugin-admin)
- [CVE-2020-24137](https://cve.now/CVE-2020-24137.md): Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via (no CVSS)
- [CVE-2020-24140](https://cve.now/CVE-2020-24140.md): Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via (no CVSS)
- [CVE-2020-24139](https://cve.now/CVE-2020-24139.md): Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application vi (no CVSS)
- [CVE-2020-24135](https://cve.now/CVE-2020-24135.md): A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2020-24136](https://cve.now/CVE-2020-24136.md): Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename p (no CVSS)
- [CVE-2020-24138](https://cve.now/CVE-2020-24138.md): Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename para (no CVSS)
- [CVE-2021-29626](https://cve.now/CVE-2021-29626.md): In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, a (no CVSS, FreeBSD)
- [CVE-2021-29627](https://cve.now/CVE-2021-29627.md): In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept f (no CVSS, FreeBSD)
- [CVE-2020-25584](https://cve.now/CVE-2020-25584.md): In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, a (no CVSS, FreeBSD)
- [CVE-2021-28927](https://cve.now/CVE-2021-28927.md): The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform\_win32.c via the ac (no CVSS)
- [CVE-2021-21641](https://cve.now/CVE-2021-21641.md): A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds. (no CVSS, Jenkins project Jenkins promoted builds Plugin · org.jenkin…)
- [CVE-2021-21640](https://cve.now/CVE-2021-21640.md): Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2021-21639](https://cve.now/CVE-2021-21639.md): Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the \`con (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2021-30185](https://cve.now/CVE-2021-30185.md): CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link. (no CVSS, indico)
- [CVE-2021-30184](https://cve.now/CVE-2021-30184.md): GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. (no CVSS)
- [CVE-2020-36314](https://cve.now/CVE-2020-36314.md): fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during ex (no CVSS)
- [CVE-2021-30177](https://cve.now/CVE-2021-30177.md): There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. (no CVSS)
- [CVE-2021-26709](https://cve.now/CVE-2021-26709.md): D-Link DSL-320B-D1 devices through EU\_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to (no CVSS)
- [CVE-2020-11255](https://cve.now/CVE-2020-11255.md): Denial of service while processing RTCP packets containing multiple SDES reports due to memory for last SDES packet is freed and rest of the (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1892](https://cve.now/CVE-2021-1892.md): Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connec (CVSS 8.4, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2020-11252](https://cve.now/CVE-2020-11252.md): Trustzone initialization code will disable xPU\`s when memory dumps are enabled and lead to information disclosure in Snapdragon Auto, Snapdr (CVSS 7.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11247](https://cve.now/CVE-2020-11247.md): Out of bound memory read while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti (CVSS 8.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11251](https://cve.now/CVE-2020-11251.md): Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in Snapdragon Auto, Snapd (CVSS 8.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11246](https://cve.now/CVE-2020-11246.md): A double free condition can occur when the device moves to suspend mode during secure playback in Snapdragon Auto, Snapdragon Compute, Snapd (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11243](https://cve.now/CVE-2020-11243.md): RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads to denial of service i (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11245](https://cve.now/CVE-2020-11245.md): Unintended reads and writes by NS EL2 in access control driver due to lack of check of input validation in Snapdragon Auto, Snapdragon Compu (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11242](https://cve.now/CVE-2020-11242.md): User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested content (CVSS 8.4, Qualcomm Snapdragon Industrial IOT, Snapdragon Mobile)
- [CVE-2020-11236](https://cve.now/CVE-2020-11236.md): Memory corruption due to invalid value of total dimension in the non-histogram type KPI could lead to a denial of service in Snapdragon Auto (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11237](https://cve.now/CVE-2020-11237.md): Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11234](https://cve.now/CVE-2020-11234.md): When sending a socket event message to a user application, invalid information will be passed if socket is freed by other thread resulting i (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11210](https://cve.now/CVE-2020-11210.md): Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon (CVSS 9.3, Qualcomm Snapdragon Connectivity, Snapdragon Industrial IOT…)
- [CVE-2020-11231](https://cve.now/CVE-2020-11231.md): Two threads call one or both functions concurrently leading to corruption of pointers and reference counters which in turn can lead to heap (CVSS 6.7, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2020-11191](https://cve.now/CVE-2020-11191.md): Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdragon Compute, Snapdragon (CVSS 8.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-20692](https://cve.now/CVE-2021-20692.md): Directory traversal vulnerability in Archive collectively operation utility Ver.2.10.1.0 and earlier allows an attacker to create or overwri (no CVSS, EikiSoft Archive collectively operation utility)
- [CVE-2021-20690](https://cve.now/CVE-2021-20690.md): Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. (no CVSS, WonderLink Yomi-Search)
- [CVE-2021-20691](https://cve.now/CVE-2021-20691.md): Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. (no CVSS, WonderLink Yomi-Search)
- [CVE-2021-20689](https://cve.now/CVE-2021-20689.md): Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. (no CVSS, WonderLink Yomi-Search)
- [CVE-2021-20687](https://cve.now/CVE-2021-20687.md): Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via (no CVSS, daifukuya.com Kagemai)
- [CVE-2021-20688](https://cve.now/CVE-2021-20688.md): Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors. (no CVSS, GoPlace! Click Ranker)
- [CVE-2021-20686](https://cve.now/CVE-2021-20686.md): Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors. (no CVSS, daifukuya.com Kagemai)
- [CVE-2021-20684](https://cve.now/CVE-2021-20684.md): Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors. (no CVSS, CGI Script Market MagazinegerZ)
- [CVE-2021-20685](https://cve.now/CVE-2021-20685.md): Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors. (no CVSS, daifukuya.com Kagemai)
- [CVE-2021-30147](https://cve.now/CVE-2021-30147.md): DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.