CVEs published April 13, 2021
202 CVEs were published on April 13, 2021: 9 critical, 97 high. 1 is now in CISA KEV.
- Published
- 202
- Critical
- 9
- High
- 97
- Medium
- 45
- Low
- 1
- Unrated
- 50
- Now in CISA KEV
- 1
- Fix available
- 40
Most affected products
- Microsoft Windows
- 77
- Android
- 21
- Eaton Intelligent Power manager
- 6
- Microsoft Visual Studio Code
- 6
- OpenClinic
- 6
- Microsoft Office · Microsoft 365 Apps for Enterprise +1
- 5
- C-Bus Toolkit V1.15.7 and prior
- 4
- Trend Micro Apex One · Trend Micro OfficeScan
- 4
- Apache Software Foundation Apache Solr · org.apache.solr:so…
- 3
- Microsoft Exchange Server 2019 Cumulative Update · Micro… +1
- 3
Critical 9
- CVE-2019-10881Default hidden Privileged Account Vulnerability in multiple XEROX devicesXEROX AltaLink B8045/B8055/B8065/B8075/B8090 · XEROX Alt… +4
- CVE-2021-28483Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Micro… +1
- CVE-2021-28481Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Micro… +1
- CVE-2021-28480Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-27602SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which aSAP SE SAP Commerce
- CVE-2021-21784An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8.Accusoft
- CVE-2021-23281Remote Code executionEaton Intelligent Power manager
- CVE-2021-21399Unauthenticated SubSonic backend access in Ampacheampache
- CVE-2020-27227An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3.OpenClinic
High 97
- CVE-2021-3460The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the supportMotorola MH702x
- CVE-2021-29440Twig allowing dangerous PHP functions by defaultgetgrav grav · getgrav/grav
- CVE-2021-29439Plugins can be installed with minimal admin privilegesgetgrav grav-plugin-admin
- CVE-2021-28482Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Micro… +1
- CVE-2021-28475Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-28477Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-28473Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-28471Remote Development Extension for Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-28472Visual Studio Code Maven for Java Extension Remote Code Execution VulnerabilityMicrosoft Visual Studio Code - Maven for Java Extension
- CVE-2021-28470Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution VulnerabilityMicrosoft Visual Studio Code - GitHub Pull Requests and Iss…
- CVE-2021-28468Raw Image Extension Remote Code Execution VulnerabilityMicrosoft Raw Image Extension
- CVE-2021-28469Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-28466Raw Image Extension Remote Code Execution VulnerabilityMicrosoft Raw Image Extension
- CVE-2021-28460Azure Sphere Unsigned Code Execution VulnerabilityMicrosoft Azure Sphere
- CVE-2021-28464VP9 Video Extensions Remote Code Execution VulnerabilityMicrosoft VP9 Video Extensions
- CVE-2021-28457Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-28458Azure ms-rest-nodeauth Library Elevation of Privilege VulnerabilityMicrosoft @azure/ms-rest-nodeauth · @azure/ms-rest-nodeauth
- CVE-2021-28454Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-28453Microsoft Word Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +3
- CVE-2021-28452Microsoft Outlook Memory Corruption VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-28451Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-28449Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-28448Visual Studio Code Kubernetes Tools Remote Code Execution VulnerabilityMicrosoft Visual Studio Code - Kubernetes Tools
- CVE-2021-28446Windows Portmapping Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28445Windows Network File System Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28440Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28439Windows TCP/IP Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-28436Windows Speech Runtime Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28434Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28357Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28358Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28356Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28354Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28355Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28353Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28351Windows Speech Runtime Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28352Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28350Windows GDI+ Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28349Windows GDI+ Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28347Windows Speech Runtime Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28348Windows GDI+ Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28346Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28344Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28345Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28343Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28341Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28342Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28340Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28338Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28339Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28337Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28336Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28334Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28335Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28333Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28332Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28330Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28331Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28329Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28327Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28324Windows SMB Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28322Diagnostics Hub Standard Collector Service Elevation of Privilege VulnerabilityMicrosoft Windows · Microsoft Visual Studio
- CVE-2021-28321Diagnostics Hub Standard Collector Service Elevation of Privilege VulnerabilityMicrosoft Windows · Microsoft Visual Studio
- CVE-2021-28319Windows TCP/IP Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-28320Windows Resource Manager PSM Service Extension Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28315Windows Media Video Decoder Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-28314Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28313Diagnostics Hub Standard Collector Service Elevation of Privilege VulnerabilityMicrosoft Windows · Microsoft Visual Studio
- CVE-2021-28310Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27096NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27095Windows Media Video Decoder Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-27091RPC Endpoint Mapper Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27090Windows Secure Kernel Mode Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27088Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27089Microsoft Internet Messaging API Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-27086Windows Services and Controller App Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27072Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27064Visual Studio Installer Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2021-26415Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26416Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-21485An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java thSAP SE SAP NetWeaver AS for JAVA
- CVE-2021-21482SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to SAP SE SAP NetWeaver Master Data Management
- CVE-2021-21483Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information whichSAP SE SAP Solution Manager
- CVE-2021-22716A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unpriviSchneider Electric C-Bus Toolkit
- CVE-2021-29437Account compromise by man-in-the-middle attackScratchVerifier ScratchOAuth2
- CVE-2020-28590An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master CSlic3r
- CVE-2021-23280Arbitrary File uploadEaton Intelligent Power manager
- CVE-2021-23277Improper Neutralization of Directives in Dynamically Evaluated CodeEaton Intelligent Power manager
- CVE-2021-23279Arbitrary File deleteEaton Intelligent Power manager
- CVE-2021-23276Improper Neutralization of Special Elements used in an SQL CommandEaton Intelligent Power manager
- CVE-2021-23278Arbitrary File deleteEaton Intelligent Power manager
- CVE-2021-29427Repository content filters do not work in Settings pluginManagementgradle
- CVE-2021-29428Local privilege escalation through system temporary directorygradle
- CVE-2021-29435Cross-Site Request Forgery (CSRF) in trestle-authTrestleAdmin trestle-auth · trestle-auth
- CVE-2020-13568SQL injection vulnerability exists in phpGACL 3.3.7.phpGACL
- CVE-2020-13566SQL injection vulnerabilities exist in phpGACL 3.3.7.phpGACL
- CVE-2020-27228An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3.OpenClinic
Medium, low and unrated 96
- CVE-2021-24028An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other unFacebook Thrift
- CVE-2021-29370A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme.
- CVE-2021-3473An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be Lenovo XClarity Controller
- CVE-2021-3462A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthoLenovo Power Management Driver for Windows
- CVE-2021-3463A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause sysLenovo Power Management Driver for Windows
- CVE-2021-28459Azure DevOps Server Spoofing VulnerabilityMicrosoft Azure DevOps Server
- CVE-2021-28456Microsoft Excel Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-28450Microsoft SharePoint Denial of Service VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-28447Windows Early Launch Antimalware Driver Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-28444Windows Hyper-V Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-28443Windows Console Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-28441Windows Hyper-V Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28442Windows TCP/IP Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28438Windows Console Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-28437Windows Installer Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28435Windows Event Tracing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28328Windows DNS Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28326Windows AppX Deployment Server Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-28325Windows SMB Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28323Windows DNS Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28318Windows GDI+ Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28317Microsoft Windows Codecs Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28316Windows WLAN AutoConfig Service Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-28312Windows NTFS Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-28311Windows Application Compatibility Cache Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-28309Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-27094Windows Early Launch Antimalware Driver Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-27093Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-27092Azure AD Web Sign-in Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-27079Windows Media Photo Codec Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-27067Azure DevOps Server and Team Foundation Server Information Disclosure VulnerabilityMicrosoft Azure DevOps Server · Microsoft Team Foundatio… +2
- CVE-2021-26417Windows Overlay Filter Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-26413Windows Installer Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-27609SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call thSAP SE SAP Focused RUN
- CVE-2021-27605SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthoSAP SE SAP Fiori Apps 2.0 for Travel Management in SAP ERP
- CVE-2021-27601SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the serveSAP SE SAP NetWeaver AS for Java
- CVE-2021-27600SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTSAP SE SAP Manufacturing Execution
- CVE-2021-27603An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for anSAP SE SAP NetWeaver AS for ABAP
- CVE-2021-21492SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logSAP SE SAP NetWeaver AS for JAVA
- CVE-2021-29438Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogsnextcloud-dialogs · @nextcloud/dialogs
- CVE-2021-27598SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data lSAP SE SAP NetWeaver AS for JAVA
- CVE-2021-22720A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and C-Bus Toolkit V1.15.7 and prior
- CVE-2021-22719A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and C-Bus Toolkit V1.15.7 and prior
- CVE-2021-22718A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and C-Bus Toolkit V1.15.7 and prior
- CVE-2021-22717A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and C-Bus Toolkit V1.15.7 and prior
- CVE-2021-0468In LK, there is a possible escalation of privilege due to an insecure default value.Android
- CVE-2021-0444In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent.Android
- CVE-2021-0430In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0400In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emeAndroid
- CVE-2021-0436In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer overflow.Android
- CVE-2021-0471In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2021-0437In setPlayPolicy of DrmPlugin.cpp, there is a possible double free.Android
- CVE-2021-0429In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free.Android
- CVE-2021-0442In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free.Android
- CVE-2021-0427In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0426In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0439In setPowerModeWithHandle of com_android_server_power_PowerManagerService.cpp, there is a possible out of bounds write due to a missing bounAndroid
- CVE-2021-0435In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data.Android
- CVE-2021-0431In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0432In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race conditiAndroid
- CVE-2021-0428In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing permission check.Android
- CVE-2021-0445In start of WelcomeActivity.java, there is a possible residual profile due to a confused deputy.Android
- CVE-2021-0446In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack.Android
- CVE-2021-0433In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjackinAndroid
- CVE-2021-0443In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition.Android
- CVE-2021-0438In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an iAndroid
- CVE-2021-29436Cross site request forgery vulnerabilityanuko timetracker
- CVE-2021-28973The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by
- CVE-2021-29997An issue was discovered in Wind River VxWorks 7 before 21.03.
- CVE-2021-29999An issue was discovered in Wind River VxWorks through 6.8.
- CVE-2021-29998An issue was discovered in Wind River VxWorks before 6.5.
- CVE-2021-23372Denial of Service (DoS)mongo-express
- CVE-2021-21729Some ZTE products have CSRF vulnerability.ZXHN H168N,ZXHN H108N
- CVE-2021-21730A ZTE product is impacted by improper access control vulnerability.ZXHN H168N
- CVE-2021-21731A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully vZXCLOUD iRAI
- CVE-2020-27236An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter.OpenClinic
- CVE-2020-27235An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter.OpenClinic
- CVE-2020-27234An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter.OpenClinic
- CVE-2020-27233An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter.OpenClinic
- CVE-2021-22505Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.14 and 12.15.Operations Agent
- CVE-2021-30176The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint.
- CVE-2021-30175ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
- CVE-2021-28647Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a mTrend Micro Password Manager
- CVE-2021-28646An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attackerTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2021-28645An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local atTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2021-25253An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource usedTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2021-25250An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive filTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IOApache Software Foundation Apache Commons IO · commons-i… +9
- CVE-2021-29943Apache Solr Unprivileged users may be able to perform unauthorized read/write to collectionsApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2021-29262Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settingsApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2021-27905SSRF vulnerability with the Replication handlerApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2021-28938Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2
- CVE-2021-29003Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_vali
- CVE-2021-29054Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface.
- CVE-2021-30637htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
- CVE-2021-30503The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath in