CVEs published April 9, 2021
55 CVEs were published on April 9, 2021: 6 critical, 7 high. 2 are now in CISA KEV.
- Published
- 55
- Critical
- 6
- High
- 7
- Medium
- 17
- Low
- 2
- Unrated
- 23
- Now in CISA KEV
- 2
- Fix available
- 29
Most affected products
- Samsung Mobile Devices
- 10
- Google Chrome
- 6
- Dream Report
- 3
- Rukovoditel
- 3
- Samsung Mobile Samsung Email
- 2
- SonicWall Email Security
- 2
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- DEMON1A Discord-Recon
- 1
- Erlang Project Erlang/OTP
- 1
- go-vela server · github.com/go-vela/server
- 1
Critical 6
- CVE-2021-21433Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validationDEMON1A Discord-Recon
- CVE-2021-20021A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a craftedSonicWall Email Security
- CVE-2020-13532A privilege escalation vulnerability exists in Dream Report 5 R20-2.Dream Report
- CVE-2020-13533A privilege escalation vulnerability exists in Dream Report 5 R20-2.Dream Report
- CVE-2020-13534A privilege escalation vulnerability exists in Dream Report 5 R20-2.Dream Report
- CVE-2021-25360An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrarySamsung Mobile Devices
High 7
- CVE-2021-30480Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user inter
- CVE-2021-21432Reject unauthorized access with GitHub PATsgo-vela server · github.com/go-vela/server
- CVE-2021-20022SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to SonicWall Email Security
- CVE-2021-25374An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and bSamsung Mobile Samsung Members
- CVE-2021-25361An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to read or write arbitrary Samsung Mobile Devices
- CVE-2021-25356An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arSamsung Mobile Devices
- CVE-2021-21431Improper Input Validation in sopel-plugins.channelmgntMirahezeBots sopel-channelmgnt · sopel-plugins-channelmgnt
Medium, low and unrated 42
- CVE-2021-21199Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2021-21197Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2021-21198Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2021-21196Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2021-21194Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2021-21195Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2020-23763SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication.
- CVE-2020-23762Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbi
- CVE-2020-23761Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "paintelliants/subrion
- CVE-2020-13592An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2.Rukovoditel
- CVE-2020-13587An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2.Rukovoditel
- CVE-2020-13591An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2.Rukovoditel
- CVE-2021-25381Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above alSamsung Mobile Samsung Account
- CVE-2021-25380Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the useSamsung Mobile Bixby
- CVE-2021-25379Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.Samsung Mobile Gallery
- CVE-2021-25378Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.Samsung Mobile SmartThings
- CVE-2021-25377Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attSamsung Mobile Samsung Experience Service
- CVE-2021-25376An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLSamsung Mobile Samsung Email
- CVE-2021-25375Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emaSamsung Mobile Samsung Email
- CVE-2021-25373Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in AndSamsung Mobile Customization Service
- CVE-2021-25365An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access the API in softsimd.Samsung Mobile Devices
- CVE-2021-25364A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applications to access contact Samsung Mobile Devices
- CVE-2021-25363An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running processSamsung Mobile Devices
- CVE-2021-25362An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to delete certain local filSamsung Mobile Devices
- CVE-2021-25359An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via unSamsung Mobile Devices
- CVE-2021-25358A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values witSamsung Mobile Devices
- CVE-2021-25357A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q(Samsung Mobile Devices
- CVE-2021-21728A ZTE product has a configuration error vulnerability.ZXA10 C300M
- CVE-2021-20080Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 alManageEngine ServiceDesk Plus · ManageEngine AssetExplorer
- CVE-2021-29671IBM Spectrum Scale 5.1.0.1 could allow a local attacker to bypass the filesystem audit logging mechanism when file audit logging is enabled.IBM Spectrum Scale
- CVE-2021-29221A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3.Erlang Project Erlang/OTP
- CVE-2021-25328Skyworth Digital Technology RN510 V.3.1.0.4 RN510 V.3.1.0.4 contains a buffer overflow vulnerability in /cgi-bin/app-staticIP.asp.
- CVE-2021-25327Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-routeadd.asp and /cgi
- CVE-2021-25326Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/test_version.asp.
- CVE-2020-21884Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /t
- CVE-2020-21883Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, w
- CVE-2021-30159An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2.
- CVE-2021-30156An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2.
- CVE-2021-30155An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2.
- CVE-2021-30152An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2.
- CVE-2021-30458An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2.wikimedia/parsoid
- CVE-2020-36287The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, anAtlassian Jira Server · Atlassian Jira Data Center