CVEs published April 12, 2021
61 CVEs were published on April 12, 2021: 1 critical, 4 high.
- Published
- 61
- Critical
- 1
- High
- 4
- Medium
- 17
- Low
- 1
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Patreon WordPress
- 5
- wpDataTables – Tables & Table Charts
- 4
- matrix-org synapse · matrix-synapse
- 3
- Facebook for WordPress
- 2
- sickrage
- 2
- AccessAlly
- 1
- Advanced Booking Calendar
- 1
- Bitdefender Safepay
- 1
- chrono-node
- 1
- Controlled Admin Access
- 1
Critical 1
High 4
- CVE-2021-21545Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could be potentially exploDell Peripheral Manager
- CVE-2021-22190A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT tokenGitLab
- CVE-2021-23370Prototype Pollutionswiper
- CVE-2021-23371Regular Expression Denial of Service (ReDoS)chrono-node
Medium, low and unrated 56
- CVE-2021-30030Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
- CVE-2021-30034Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
- CVE-2021-30044Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
- CVE-2021-30042Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinic
- CVE-2021-30039Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.
- CVE-2021-21392Open redirect via transitional IPv6 addresses on dual-stack networksmatrix-org synapse · matrix-synapse
- CVE-2021-21393Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsmatrix-org synapse · matrix-synapse
- CVE-2021-29429Information disclosure through temporary directory permissionsgradle
- CVE-2021-22497Advanced Authentication Improper Session ManagementMicro Focus Advanced Authentication
- CVE-2021-21394Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpointsmatrix-org synapse · matrix-synapse
- CVE-2021-3163A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a craftquill
- CVE-2019-15059In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-
- CVE-2021-29357The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before
- CVE-2020-15390pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo
- CVE-2021-20519IBM Jazz Team Server products are vulnerable to cross-site scripting.IBM Rational Quality Manager · IBM Rational Team Concert +7
- CVE-2020-4965IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infIBM Rational DOORS Next Generation · IBM Engineering Tes… +7
- CVE-2020-4964IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message onIBM Rational Rhapsody Model Manager · IBM Engineering Li… +7
- CVE-2020-4920IBM Jazz Team Server products are vulnerable to stored cross-site scripting.IBM Rational Engineering Lifecycle Manager · IBM Rationa… +7
- CVE-2021-29302TP-Link TL-WR802N(US), Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message.
- CVE-2021-3128In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is
- CVE-2021-3125In TP-Link TL-XDR3230 < 1.0.12, TL-XDR1850 < 1.0.9, TL-XDR1860 < 1.0.14, TL-XDR3250 < 1.0.2, TL-XDR6060 Turbo < 1.1.8, TL-XDR5430 < 1.0.11,
- CVE-2021-23270In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and i
- CVE-2020-15734Same-origin policy vulnerability in Bitdefender SafepayBitdefender Safepay
- CVE-2020-7924Specific command line parameter might result in accepting invalid certificateMongoDB Database Tools · MongoDB Mongomirror +1
- CVE-2021-27486FATEK Automation WinProladder Versions 3.30 and prior is vulnerable to an integer underflow, which may cause an out-of-bounds write and alloFATEK Automation WinProladder
- CVE-2019-17656A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.Fortinet FortiProxy, FortiOS
- CVE-2021-24024A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5Fortinet FortiADCManager, FortiADC
- CVE-2020-15942An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.xFortinet FortiWeb
- CVE-2021-24231Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From PatreonPatreon WordPress
- CVE-2021-24230Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User MetaPatreon WordPress
- CVE-2021-24229Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX actionPatreon WordPress
- CVE-2021-24228Patreon WordPress < 1.7.2 - Reflected XSS on Login FormPatreon WordPress
- CVE-2021-24227Patreon WordPress < 1.7.0 - Unauthenticated Local File DisclosurePatreon WordPress
- CVE-2021-24226AccessAlly < 3.5.7 - $_SERVER Superglobal LeakageAccessAlly
- CVE-2021-24225Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)Advanced Booking Calendar
- CVE-2021-24224Easy Form Builder <= 1.0 - Authenticated Arbitrary File UploadEasy Form Builder
- CVE-2021-24223N5 Upload Form <= 1.0 - Unauthenticated Arbitrary File Upload to RCEN5 Upload Form
- CVE-2021-24222WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCEWP-Curriculo Vitae Free
- CVE-2021-24221Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcodeQuiz And Survey Master – Best Quiz, Exam and Survey Plugin…
- CVE-2021-24220All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option DeletionRise by Thrive Themes · Luxe by Thrive Themes +8
- CVE-2021-24219All Thrive Themes and Plugins - Unauthenticated Option UpdateThrive Themes Thrive Optimize · Thrive Themes Thrive Co… +20
- CVE-2021-24218Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings DeletionFacebook for WordPress
- CVE-2021-24217Facebook for WordPress < 3.0.0 - PHP Object Injection with POP ChainFacebook for WordPress
- CVE-2021-24215Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege EscalationControlled Admin Access
- CVE-2021-24213GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)GiveWP – Donation Plugin and Fundraising Platform
- CVE-2021-24200wpDataTables < 3.4.2 - Blind SQL Injection via length ParameterwpDataTables – Tables & Table Charts
- CVE-2021-24199wpDataTables < 3.4.2 - Blind SQL Injection via start ParameterwpDataTables – Tables & Table Charts
- CVE-2021-24198wpDataTables < 3.4.2 - Improper Access Control leading to Table Data DeletionwpDataTables – Tables & Table Charts
- CVE-2021-24197wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission TakeoverwpDataTables – Tables & Table Charts
- CVE-2021-23368Regular Expression Denial of Service (ReDoS)postcss
- CVE-2021-25925in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated propersickrage
- CVE-2021-25926In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validatsickrage
- CVE-2020-28872An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized perso
- CVE-2021-23369Remote Code Execution (RCE)handlebars · org.webjars:handlebars +2
- CVE-2020-24285INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.
- CVE-2021-29379An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05.