# CVEs published 2021-04-12

61 CVEs were published on April 12, 2021: 1 critical, 4 high. Days are UTC.

- [CVE-2021-30030](https://cve.now/CVE-2021-30030.md): Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php. (no CVSS)
- [CVE-2021-30034](https://cve.now/CVE-2021-30034.md): Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php. (no CVSS)
- [CVE-2021-30044](https://cve.now/CVE-2021-30044.md): Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php. (no CVSS)
- [CVE-2021-30042](https://cve.now/CVE-2021-30042.md): Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinic (no CVSS)
- [CVE-2021-30039](https://cve.now/CVE-2021-30039.md): Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php. (no CVSS)
- [CVE-2021-21392](https://cve.now/CVE-2021-21392.md): Open redirect via transitional IPv6 addresses on dual-stack networks (CVSS 6.3, matrix-org synapse · matrix-synapse)
- [CVE-2021-21393](https://cve.now/CVE-2021-21393.md): Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints (CVSS 5.3, matrix-org synapse · matrix-synapse)
- [CVE-2021-29429](https://cve.now/CVE-2021-29429.md): Information disclosure through temporary directory permissions (CVSS 4.0, gradle)
- [CVE-2021-22497](https://cve.now/CVE-2021-22497.md): Advanced Authentication Improper Session Management (CVSS 3.8, Micro Focus Advanced Authentication)
- [CVE-2021-21394](https://cve.now/CVE-2021-21394.md): Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints (CVSS 5.3, matrix-org synapse · matrix-synapse)
- [CVE-2021-3163](https://cve.now/CVE-2021-3163.md): A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a craft (no CVSS, quill)
- [CVE-2021-21545](https://cve.now/CVE-2021-21545.md): Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could be potentially explo (CVSS 7.8, Dell Peripheral Manager)
- [CVE-2021-21524](https://cve.now/CVE-2021-21524.md): Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. (CVSS 9.8, Dell EMC Storage Monitoring and Reporting)
- [CVE-2019-15059](https://cve.now/CVE-2019-15059.md): In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR- (no CVSS)
- [CVE-2021-29357](https://cve.now/CVE-2021-29357.md): The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before (no CVSS)
- [CVE-2020-15390](https://cve.now/CVE-2020-15390.md): pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo (no CVSS)
- [CVE-2021-20519](https://cve.now/CVE-2021-20519.md): IBM Jazz Team Server products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Team Concert +7)
- [CVE-2020-4965](https://cve.now/CVE-2020-4965.md): IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf (CVSS 5.9, IBM Rational DOORS Next Generation · IBM Engineering Tes… +7)
- [CVE-2020-4964](https://cve.now/CVE-2020-4964.md): IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on (CVSS 4.3, IBM Rational Rhapsody Model Manager · IBM Engineering Li… +7)
- [CVE-2020-4920](https://cve.now/CVE-2020-4920.md): IBM Jazz Team Server products are vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Rational Engineering Lifecycle Manager · IBM Rationa… +7)
- [CVE-2021-29302](https://cve.now/CVE-2021-29302.md): TP-Link TL-WR802N(US), Archer\_C50v5\_US v4\_200 \<= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. (no CVSS)
- [CVE-2021-3128](https://cve.now/CVE-2021-3128.md): In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware \< 3.0.0.4.386.42095 or \< 9.0.0.4.386.41994, when IPv6 is (no CVSS)
- [CVE-2021-3125](https://cve.now/CVE-2021-3125.md): In TP-Link TL-XDR3230 \< 1.0.12, TL-XDR1850 \< 1.0.9, TL-XDR1860 \< 1.0.14, TL-XDR3250 \< 1.0.2, TL-XDR6060 Turbo \< 1.1.8, TL-XDR5430 \< 1.0.11, (no CVSS)
- [CVE-2021-23270](https://cve.now/CVE-2021-23270.md): In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and i (no CVSS)
- [CVE-2020-15734](https://cve.now/CVE-2020-15734.md): Same-origin policy vulnerability in Bitdefender Safepay (CVSS 5.5, Bitdefender Safepay)
- [CVE-2020-7924](https://cve.now/CVE-2020-7924.md): Specific command line parameter might result in accepting invalid certificate (CVSS 4.2, MongoDB Database Tools · MongoDB Mongomirror +1)
- [CVE-2021-27486](https://cve.now/CVE-2021-27486.md): FATEK Automation WinProladder Versions 3.30 and prior is vulnerable to an integer underflow, which may cause an out-of-bounds write and allo (no CVSS, FATEK Automation WinProladder)
- [CVE-2021-22190](https://cve.now/CVE-2021-22190.md): A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token (CVSS 8.5, GitLab)
- [CVE-2019-17656](https://cve.now/CVE-2019-17656.md): A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1. (CVSS 5.4, Fortinet FortiProxy, FortiOS)
- [CVE-2021-24024](https://cve.now/CVE-2021-24024.md): A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5 (CVSS 4.3, Fortinet FortiADCManager, FortiADC)
- [CVE-2020-15942](https://cve.now/CVE-2020-15942.md): An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x (CVSS 4.3, Fortinet FortiWeb)
- [CVE-2021-24231](https://cve.now/CVE-2021-24231.md): Patreon WordPress \< 1.7.0 - CSRF to Disconnect Sites From Patreon (no CVSS, Patreon WordPress)
- [CVE-2021-24230](https://cve.now/CVE-2021-24230.md): Patreon WordPress \< 1.7.0 - CSRF to Overwrite/Create User Meta (no CVSS, Patreon WordPress)
- [CVE-2021-24229](https://cve.now/CVE-2021-24229.md): Patreon WordPress \< 1.7.2 - Reflected XSS on patreon\_save\_attachment\_patreon\_level AJAX action (no CVSS, Patreon WordPress)
- [CVE-2021-24228](https://cve.now/CVE-2021-24228.md): Patreon WordPress \< 1.7.2 - Reflected XSS on Login Form (no CVSS, Patreon WordPress)
- [CVE-2021-24227](https://cve.now/CVE-2021-24227.md): Patreon WordPress \< 1.7.0 - Unauthenticated Local File Disclosure (no CVSS, Patreon WordPress)
- [CVE-2021-24226](https://cve.now/CVE-2021-24226.md): AccessAlly \< 3.5.7 - $\_SERVER Superglobal Leakage (no CVSS, AccessAlly)
- [CVE-2021-24225](https://cve.now/CVE-2021-24225.md): Advanced Booking Calendar \< 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Advanced Booking Calendar)
- [CVE-2021-24224](https://cve.now/CVE-2021-24224.md): Easy Form Builder \<= 1.0 - Authenticated Arbitrary File Upload (no CVSS, Easy Form Builder)
- [CVE-2021-24223](https://cve.now/CVE-2021-24223.md): N5 Upload Form \<= 1.0 - Unauthenticated Arbitrary File Upload to RCE (no CVSS, N5 Upload Form)
- [CVE-2021-24222](https://cve.now/CVE-2021-24222.md): WP-Curricul Vitea Free \<= 6.3 - Unauthenticated Arbitrary File Upload to RCE (no CVSS, WP-Curriculo Vitae Free)
- [CVE-2021-24221](https://cve.now/CVE-2021-24221.md): Quiz And Survey Master \< 7.1.12 - Authenticated SQL injection via shortcode (no CVSS, Quiz And Survey Master – Best Quiz, Exam and Survey Plugin…)
- [CVE-2021-24220](https://cve.now/CVE-2021-24220.md): All Thrive Themes Legacy Themes \< 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion (no CVSS, Rise by Thrive Themes · Luxe by Thrive Themes +8)
- [CVE-2021-24219](https://cve.now/CVE-2021-24219.md): All Thrive Themes and Plugins - Unauthenticated Option Update (no CVSS, Thrive Themes Thrive Optimize · Thrive Themes Thrive Co… +20)
- [CVE-2021-24218](https://cve.now/CVE-2021-24218.md): Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion (no CVSS, Facebook for WordPress)
- [CVE-2021-24217](https://cve.now/CVE-2021-24217.md): Facebook for WordPress \< 3.0.0 - PHP Object Injection with POP Chain (no CVSS, Facebook for WordPress)
- [CVE-2021-24215](https://cve.now/CVE-2021-24215.md): Controlled Admin Access \< 1.5.2 - Improper Access Control & Privilege Escalation (no CVSS, Controlled Admin Access)
- [CVE-2021-24213](https://cve.now/CVE-2021-24213.md): GiveWP \< 2.10.0 - Reflected Cross Site Scripting (XSS) (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2021-24200](https://cve.now/CVE-2021-24200.md): wpDataTables \< 3.4.2 - Blind SQL Injection via length Parameter (no CVSS, wpDataTables – Tables & Table Charts)
- [CVE-2021-24199](https://cve.now/CVE-2021-24199.md): wpDataTables \< 3.4.2 - Blind SQL Injection via start Parameter (no CVSS, wpDataTables – Tables & Table Charts)
- [CVE-2021-24198](https://cve.now/CVE-2021-24198.md): wpDataTables \< 3.4.2 - Improper Access Control leading to Table Data Deletion (no CVSS, wpDataTables – Tables & Table Charts)
- [CVE-2021-24197](https://cve.now/CVE-2021-24197.md): wpDataTables \< 3.4.2 - Improper Access Control leading to Table Permission Takeover (no CVSS, wpDataTables – Tables & Table Charts)
- [CVE-2021-23368](https://cve.now/CVE-2021-23368.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, postcss)
- [CVE-2021-25925](https://cve.now/CVE-2021-25925.md): in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated proper (CVSS 5.4, sickrage)
- [CVE-2021-25926](https://cve.now/CVE-2021-25926.md): In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validat (CVSS 6.1, sickrage)
- [CVE-2020-28872](https://cve.now/CVE-2020-28872.md): An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/\_installation/\_register.php allows an unauthorized perso (no CVSS)
- [CVE-2021-23370](https://cve.now/CVE-2021-23370.md): Prototype Pollution (CVSS 7.5, swiper)
- [CVE-2021-23369](https://cve.now/CVE-2021-23369.md): Remote Code Execution (RCE) (CVSS 5.6, handlebars · org.webjars:handlebars +2)
- [CVE-2021-23371](https://cve.now/CVE-2021-23371.md): Regular Expression Denial of Service (ReDoS) (CVSS 7.5, chrono-node)
- [CVE-2020-24285](https://cve.now/CVE-2020-24285.md): INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx. (no CVSS)
- [CVE-2021-29379](https://cve.now/CVE-2021-29379.md): An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.