# CVEs published 2021-04-08

64 CVEs were published on April 8, 2021: 1 critical, 11 high. Days are UTC.

- [CVE-2021-3413](https://cve.now/CVE-2021-3413.md): A flaw was found in Red Hat Satellite in tfm-rubygem-foreman\_azure\_rm in versions before 2.2.0. (no CVSS, Satellite)
- [CVE-2021-3448](https://cve.now/CVE-2021-3448.md): A flaw was found in dnsmasq in versions before 2.85. (CVSS 4.0, dnsmasq)
- [CVE-2021-3482](https://cve.now/CVE-2021-3482.md): A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. (no CVSS, exiv2)
- [CVE-2020-6590](https://cve.now/CVE-2020-6590.md): Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure. (no CVSS, Forcepoint Web Security Content Gateway)
- [CVE-2021-22512](https://cve.now/CVE-2021-22512.md): Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. (no CVSS, Micro Focus Application Automation Tools Plugin - Jenkins p…)
- [CVE-2021-22511](https://cve.now/CVE-2021-22511.md): Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. (no CVSS, Micro Focus Application Automation Tools Plugin - Jenkins p…)
- [CVE-2021-22510](https://cve.now/CVE-2021-22510.md): Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. (no CVSS, Micro Focus Application Automation Tools Plugin - Jenkins p…)
- [CVE-2021-22513](https://cve.now/CVE-2021-22513.md): Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. (no CVSS, Micro Focus Application Automation Tools Plugin - Jenkins p…)
- [CVE-2020-14106](https://cve.now/CVE-2020-14106.md): The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI \< (no CVSS, Xiaomi Mobile Phone)
- [CVE-2020-14103](https://cve.now/CVE-2020-14103.md): The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI \< 2020.01.15. (no CVSS, Xiaomi)
- [CVE-2021-3146](https://cve.now/CVE-2021-3146.md): The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges. (no CVSS)
- [CVE-2021-22312](https://cve.now/CVE-2021-22312.md): There is a memory leak vulnerability in some Huawei products. (no CVSS, IPS Module;NGFW Module;Secospace USG6300;Secospace USG6500;…)
- [CVE-2020-14099](https://cve.now/CVE-2020-14099.md): On Xiaomi router AX1800 rom version \< 1.0.336 and RM1800 root version \< 1.0.26, the encryption scheme for a user's backup files uses hard-co (no CVSS, Xiaomi Router AX1800,Xiaomi Rourer RM1800)
- [CVE-2020-14104](https://cve.now/CVE-2020-14104.md): A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50. (no CVSS, Xiaomi router AX3600)
- [CVE-2021-22507](https://cve.now/CVE-2021-22507.md): Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10. (no CVSS, Operations Bridge Manager)
- [CVE-2021-22115](https://cve.now/CVE-2021-22115.md): Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. (no CVSS, Cloud Control API)
- [CVE-2021-3328](https://cve.now/CVE-2021-3328.md): An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. (no CVSS)
- [CVE-2021-27945](https://cve.now/CVE-2021-27945.md): The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and includin (no CVSS)
- [CVE-2020-23539](https://cve.now/CVE-2020-23539.md): An issue was discovered in Realtek rtl8723de BLE Stack \<= 4.1 that allows remote attackers to cause a Denial of Service via the interval fie (no CVSS)
- [CVE-2021-27522](https://cve.now/CVE-2021-27522.md): Learnsite 1.2.5.0 contains a remote privilege escalation vulnerability in /Manager/index.aspx through the JudgIsAdmin() function. (no CVSS)
- [CVE-2020-23426](https://cve.now/CVE-2020-23426.md): zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify (no CVSS)
- [CVE-2021-30462](https://cve.now/CVE-2021-30462.md): VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to (no CVSS)
- [CVE-2021-30463](https://cve.now/CVE-2021-30463.md): VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. (no CVSS)
- [CVE-2021-28924](https://cve.now/CVE-2021-28924.md): Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. (no CVSS)
- [CVE-2021-28925](https://cve.now/CVE-2021-28925.md): SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o\[col\] parameter to api/checks/read/. (no CVSS)
- [CVE-2021-20480](https://cve.now/CVE-2021-20480.md): IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2021-30111](https://cve.now/CVE-2021-30111.md): A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. (no CVSS)
- [CVE-2021-30112](https://cve.now/CVE-2021-30112.md): Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student\_leave\_appl (no CVSS)
- [CVE-2021-30113](https://cve.now/CVE-2021-30113.md): A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. (no CVSS)
- [CVE-2021-30114](https://cve.now/CVE-2021-30114.md): Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment re (no CVSS)
- [CVE-2021-28686](https://cve.now/CVE-2021-28686.md): AsIO2\_64.sys and AsIO2\_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. (no CVSS)
- [CVE-2021-28685](https://cve.now/CVE-2021-28685.md): AsIO2\_64.sys and AsIO2\_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by ca (no CVSS)
- [CVE-2021-3012](https://cve.now/CVE-2021-3012.md): A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated user (no CVSS)
- [CVE-2021-1404](https://cve.now/CVE-2021-1404.md): Clam AntiVirus (ClamAV) Email Parser Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2021-1405](https://cve.now/CVE-2021-1405.md): Clam AntiVirus (ClamAV) PDF Parser Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2021-1252](https://cve.now/CVE-2021-1252.md): Clam AntiVirus (ClamAV) Excel XLM Parser Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2021-1485](https://cve.now/CVE-2021-1485.md): Cisco IOS XR Software Command Injection Vulnerability (CVSS 6.6, Cisco IOS XR Software)
- [CVE-2021-1480](https://cve.now/CVE-2021-1480.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2021-1479](https://cve.now/CVE-2021-1479.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2021-1475](https://cve.now/CVE-2021-1475.md): Cisco Umbrella Link and CSV Formula Injection Vulnerabilities (CVSS 6.5, Cisco Umbrella Insights Virtual Appliance)
- [CVE-2021-1474](https://cve.now/CVE-2021-1474.md): Cisco Umbrella Link and CSV Formula Injection Vulnerabilities (CVSS 6.5, Cisco Umbrella Insights Virtual Appliance)
- [CVE-2021-1473](https://cve.now/CVE-2021-1473.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 5.3, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1472](https://cve.now/CVE-2021-1472.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 5.3, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1467](https://cve.now/CVE-2021-1467.md): Cisco Webex Meetings for Android Avatar Modification Vulnerability (CVSS 4.3, Cisco Webex Meetings)
- [CVE-2021-1463](https://cve.now/CVE-2021-1463.md): Cisco Unified Intelligence Center Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Contact Center Express)
- [CVE-2021-1459](https://cve.now/CVE-2021-1459.md): Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability (CVSS 9.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1420](https://cve.now/CVE-2021-1420.md): Cisco Webex Meetings HTML Injection Vulnerability (CVSS 4.7, Cisco Webex Meetings)
- [CVE-2021-1415](https://cve.now/CVE-2021-1415.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities (CVSS 6.3, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1414](https://cve.now/CVE-2021-1414.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities (CVSS 6.3, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1413](https://cve.now/CVE-2021-1413.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities (CVSS 6.3, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1409](https://cve.now/CVE-2021-1409.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Unity Connection)
- [CVE-2021-1408](https://cve.now/CVE-2021-1408.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Unity Connection)
- [CVE-2021-1407](https://cve.now/CVE-2021-1407.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Unity Connection)
- [CVE-2021-1406](https://cve.now/CVE-2021-1406.md): Cisco Unified Communications Manager Information Disclosure Vulnerability (CVSS 4.9, Cisco Unified Communications Manager)
- [CVE-2021-1399](https://cve.now/CVE-2021-1399.md): Cisco Unified Communications Manager Self Care Portal Authorization Bypass Vulnerability (CVSS 4.3, Cisco Unified Communications Manager)
- [CVE-2021-1386](https://cve.now/CVE-2021-1386.md): Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability (CVSS 7.0, Cisco AMP for Endpoints)
- [CVE-2021-1380](https://cve.now/CVE-2021-1380.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Unity Connection)
- [CVE-2021-1362](https://cve.now/CVE-2021-1362.md): Cisco Unified Communications Products Remote Code Execution Vulnerability (CVSS 8.8, Cisco Unity Connection)
- [CVE-2021-1309](https://cve.now/CVE-2021-1309.md): Cisco Small Business RV Series Routers Link Layer Discovery Protocol Vulnerabilities (CVSS 7.4, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1308](https://cve.now/CVE-2021-1308.md): Cisco Small Business RV Series Routers Link Layer Discovery Protocol Vulnerabilities (CVSS 7.4, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1251](https://cve.now/CVE-2021-1251.md): Cisco Small Business RV Series Routers Link Layer Discovery Protocol Vulnerabilities (CVSS 7.4, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1137](https://cve.now/CVE-2021-1137.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2021-28174](https://cve.now/CVE-2021-28174.md): Mitake Smart Stock Selection System - Broken Authentication (CVSS 6.5, Mitake Smart Stock Selection System)
- [CVE-2021-29154](https://cve.now/CVE-2021-29154.md): BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.