# CVEs published 2021-04-09

55 CVEs were published on April 9, 2021: 6 critical, 7 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-30480](https://cve.now/CVE-2021-30480.md): Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user inter (CVSS 8.5)
- [CVE-2021-21199](https://cve.now/CVE-2021-21199.md): Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process t (no CVSS, Google Chrome)
- [CVE-2021-21197](https://cve.now/CVE-2021-21197.md): Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2021-21198](https://cve.now/CVE-2021-21198.md): Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to pote (no CVSS, Google Chrome)
- [CVE-2021-21196](https://cve.now/CVE-2021-21196.md): Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap co (no CVSS, Google Chrome)
- [CVE-2021-21194](https://cve.now/CVE-2021-21194.md): Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2021-21195](https://cve.now/CVE-2021-21195.md): Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-21432](https://cve.now/CVE-2021-21432.md): Reject unauthorized access with GitHub PATs (CVSS 7.5, go-vela server · github.com/go-vela/server)
- [CVE-2021-21433](https://cve.now/CVE-2021-21433.md): Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation (CVSS 9.9, DEMON1A Discord-Recon)
- [CVE-2020-23763](https://cve.now/CVE-2020-23763.md): SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication. (no CVSS)
- [CVE-2021-20022](https://cve.now/CVE-2021-20022.md): SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to (CVSS 7.2, KEV, SonicWall Email Security)
- [CVE-2021-20021](https://cve.now/CVE-2021-20021.md): A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted (CVSS 9.8, KEV, SonicWall Email Security)
- [CVE-2020-13532](https://cve.now/CVE-2020-13532.md): A privilege escalation vulnerability exists in Dream Report 5 R20-2. (CVSS 9.3, Dream Report)
- [CVE-2020-23762](https://cve.now/CVE-2020-23762.md): Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version \<= 1.2 for WordPress allows remote attackers to execute arbi (no CVSS)
- [CVE-2020-13533](https://cve.now/CVE-2020-13533.md): A privilege escalation vulnerability exists in Dream Report 5 R20-2. (CVSS 9.3, Dream Report)
- [CVE-2020-13534](https://cve.now/CVE-2020-13534.md): A privilege escalation vulnerability exists in Dream Report 5 R20-2. (CVSS 9.3, Dream Report)
- [CVE-2020-23761](https://cve.now/CVE-2020-23761.md): Cross Site Scripting (XSS) vulnerability in subrion CMS Version \<= 4.2.1 allows remote attackers to execute arbitrary web script via the "pa (no CVSS, intelliants/subrion)
- [CVE-2020-13592](https://cve.now/CVE-2020-13592.md): An exploitable SQL injection vulnerability exists in "global\_lists/choices" page of the Rukovoditel Project Management App 2.7.2. (CVSS 5.4, Rukovoditel)
- [CVE-2020-13587](https://cve.now/CVE-2020-13587.md): An exploitable SQL injection vulnerability exists in the "forms\_fields\_rules/rules" page of the Rukovoditel Project Management App 2.7.2. (CVSS 5.4, Rukovoditel)
- [CVE-2020-13591](https://cve.now/CVE-2020-13591.md): An exploitable SQL injection vulnerability exists in the "access\_rules/rules\_form" page of the Rukovoditel Project Management App 2.7.2. (CVSS 5.4, Rukovoditel)
- [CVE-2021-25381](https://cve.now/CVE-2021-25381.md): Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above al (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2021-25380](https://cve.now/CVE-2021-25380.md): Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the use (CVSS 5.8, Samsung Mobile Bixby)
- [CVE-2021-25379](https://cve.now/CVE-2021-25379.md): Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action. (CVSS 4.0, Samsung Mobile Gallery)
- [CVE-2021-25378](https://cve.now/CVE-2021-25378.md): Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service. (CVSS 4.3, Samsung Mobile SmartThings)
- [CVE-2021-25377](https://cve.now/CVE-2021-25377.md): Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows att (CVSS 3.3, Samsung Mobile Samsung Experience Service)
- [CVE-2021-25376](https://cve.now/CVE-2021-25376.md): An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTL (CVSS 3.1, Samsung Mobile Samsung Email)
- [CVE-2021-25375](https://cve.now/CVE-2021-25375.md): Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another ema (CVSS 6.5, Samsung Mobile Samsung Email)
- [CVE-2021-25374](https://cve.now/CVE-2021-25374.md): An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and b (CVSS 8.6, Samsung Mobile Samsung Members)
- [CVE-2021-25373](https://cve.now/CVE-2021-25373.md): Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in And (CVSS 5.5, Samsung Mobile Customization Service)
- [CVE-2021-25365](https://cve.now/CVE-2021-25365.md): An improper exception control in softsimd prior to SMR APR-2021 Release 1 allows unprivileged applications to access the API in softsimd. (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2021-25364](https://cve.now/CVE-2021-25364.md): A pendingIntent hijacking vulnerability in Secure Folder prior to SMR APR-2021 Release 1 allows unprivileged applications to access contact (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25363](https://cve.now/CVE-2021-25363.md): An improper access control in ActivityManagerService prior to SMR APR-2021 Release 1 allows untrusted applications to access running process (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2021-25362](https://cve.now/CVE-2021-25362.md): An improper permission management in CertInstaller prior to SMR APR-2021 Release 1 allows untrusted applications to delete certain local fil (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2021-25361](https://cve.now/CVE-2021-25361.md): An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to read or write arbitrary (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2021-25360](https://cve.now/CVE-2021-25360.md): An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrary (CVSS 9.0, Samsung Mobile Devices)
- [CVE-2021-25359](https://cve.now/CVE-2021-25359.md): An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via un (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25358](https://cve.now/CVE-2021-25358.md): A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values wit (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25357](https://cve.now/CVE-2021-25357.md): A pendingIntent hijacking vulnerability in Create Movie prior to SMR APR-2021 Release 1 in Android O(8.x) and P(9.0), 3.4.81.1 in Android Q( (CVSS 5.6, Samsung Mobile Devices)
- [CVE-2021-25356](https://cve.now/CVE-2021-25356.md): An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install ar (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2021-21728](https://cve.now/CVE-2021-21728.md): A ZTE product has a configuration error vulnerability. (no CVSS, ZXA10 C300M)
- [CVE-2021-20080](https://cve.now/CVE-2021-20080.md): Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 al (no CVSS, ManageEngine ServiceDesk Plus · ManageEngine AssetExplorer)
- [CVE-2021-29671](https://cve.now/CVE-2021-29671.md): IBM Spectrum Scale 5.1.0.1 could allow a local attacker to bypass the filesystem audit logging mechanism when file audit logging is enabled. (CVSS 4.0, IBM Spectrum Scale)
- [CVE-2021-21431](https://cve.now/CVE-2021-21431.md): Improper Input Validation in sopel-plugins.channelmgnt (CVSS 7.6, MirahezeBots sopel-channelmgnt · sopel-plugins-channelmgnt)
- [CVE-2021-29221](https://cve.now/CVE-2021-29221.md): A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. (no CVSS, Erlang Project Erlang/OTP)
- [CVE-2021-25328](https://cve.now/CVE-2021-25328.md): Skyworth Digital Technology RN510 V.3.1.0.4 RN510 V.3.1.0.4 contains a buffer overflow vulnerability in /cgi-bin/app-staticIP.asp. (no CVSS)
- [CVE-2021-25327](https://cve.now/CVE-2021-25327.md): Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery (CSRF) vulnerability in /cgi-bin/net-routeadd.asp and /cgi (no CVSS)
- [CVE-2021-25326](https://cve.now/CVE-2021-25326.md): Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/test\_version.asp. (no CVSS)
- [CVE-2020-21884](https://cve.now/CVE-2020-21884.md): Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /t (no CVSS)
- [CVE-2020-21883](https://cve.now/CVE-2020-21883.md): Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, w (no CVSS)
- [CVE-2021-30159](https://cve.now/CVE-2021-30159.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30156](https://cve.now/CVE-2021-30156.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30155](https://cve.now/CVE-2021-30155.md): An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30152](https://cve.now/CVE-2021-30152.md): An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. (no CVSS)
- [CVE-2021-30458](https://cve.now/CVE-2021-30458.md): An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. (no CVSS, wikimedia/parsoid)
- [CVE-2020-36287](https://cve.now/CVE-2020-36287.md): The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, an (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.