# CVEs published 2021-04-13

202 CVEs were published on April 13, 2021: 9 critical, 97 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-24028](https://cve.now/CVE-2021-24028.md): An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other un (no CVSS, Facebook Thrift)
- [CVE-2021-29370](https://cve.now/CVE-2021-29370.md): A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. (no CVSS)
- [CVE-2019-10881](https://cve.now/CVE-2019-10881.md): Default hidden Privileged Account Vulnerability in multiple XEROX devices (CVSS 9.4, XEROX AltaLink B8045/B8055/B8065/B8075/B8090 · XEROX Alt… +4)
- [CVE-2021-3473](https://cve.now/CVE-2021-3473.md): An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be (CVSS 4.5, Lenovo XClarity Controller)
- [CVE-2021-3462](https://cve.now/CVE-2021-3462.md): A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unautho (CVSS 5.5, Lenovo Power Management Driver for Windows)
- [CVE-2021-3463](https://cve.now/CVE-2021-3463.md): A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause sys (CVSS 4.2, Lenovo Power Management Driver for Windows)
- [CVE-2021-3460](https://cve.now/CVE-2021-3460.md): The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support (CVSS 8.1, Motorola MH702x)
- [CVE-2021-29440](https://cve.now/CVE-2021-29440.md): Twig allowing dangerous PHP functions by default (CVSS 8.4, getgrav grav · getgrav/grav)
- [CVE-2021-29439](https://cve.now/CVE-2021-29439.md): Plugins can be installed with minimal admin privileges (CVSS 7.2, getgrav grav-plugin-admin)
- [CVE-2021-28483](https://cve.now/CVE-2021-28483.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.0, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-28481](https://cve.now/CVE-2021-28481.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-28482](https://cve.now/CVE-2021-28482.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-28480](https://cve.now/CVE-2021-28480.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-28475](https://cve.now/CVE-2021-28475.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28477](https://cve.now/CVE-2021-28477.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Visual Studio Code)
- [CVE-2021-28473](https://cve.now/CVE-2021-28473.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28471](https://cve.now/CVE-2021-28471.md): Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28472](https://cve.now/CVE-2021-28472.md): Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code - Maven for Java Extension)
- [CVE-2021-28470](https://cve.now/CVE-2021-28470.md): Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code - GitHub Pull Requests and Iss…)
- [CVE-2021-28468](https://cve.now/CVE-2021-28468.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension)
- [CVE-2021-28469](https://cve.now/CVE-2021-28469.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28466](https://cve.now/CVE-2021-28466.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension)
- [CVE-2021-28460](https://cve.now/CVE-2021-28460.md): Azure Sphere Unsigned Code Execution Vulnerability (CVSS 8.1, Microsoft Azure Sphere)
- [CVE-2021-28464](https://cve.now/CVE-2021-28464.md): VP9 Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft VP9 Video Extensions)
- [CVE-2021-28459](https://cve.now/CVE-2021-28459.md): Azure DevOps Server Spoofing Vulnerability (CVSS 6.1, Microsoft Azure DevOps Server)
- [CVE-2021-28457](https://cve.now/CVE-2021-28457.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-28458](https://cve.now/CVE-2021-28458.md): Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft @azure/ms-rest-nodeauth · @azure/ms-rest-nodeauth)
- [CVE-2021-28454](https://cve.now/CVE-2021-28454.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28456](https://cve.now/CVE-2021-28456.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28453](https://cve.now/CVE-2021-28453.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +3)
- [CVE-2021-28452](https://cve.now/CVE-2021-28452.md): Microsoft Outlook Memory Corruption Vulnerability (CVSS 7.1, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28450](https://cve.now/CVE-2021-28450.md): Microsoft SharePoint Denial of Service Vulnerability (CVSS 5.0, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-28451](https://cve.now/CVE-2021-28451.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28449](https://cve.now/CVE-2021-28449.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-28447](https://cve.now/CVE-2021-28447.md): Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2021-28448](https://cve.now/CVE-2021-28448.md): Visual Studio Code Kubernetes Tools Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code - Kubernetes Tools)
- [CVE-2021-28446](https://cve.now/CVE-2021-28446.md): Windows Portmapping Information Disclosure Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2021-28444](https://cve.now/CVE-2021-28444.md): Windows Hyper-V Security Feature Bypass Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2021-28445](https://cve.now/CVE-2021-28445.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-28443](https://cve.now/CVE-2021-28443.md): Windows Console Driver Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28441](https://cve.now/CVE-2021-28441.md): Windows Hyper-V Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28442](https://cve.now/CVE-2021-28442.md): Windows TCP/IP Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28440](https://cve.now/CVE-2021-28440.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-28438](https://cve.now/CVE-2021-28438.md): Windows Console Driver Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28439](https://cve.now/CVE-2021-28439.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-28437](https://cve.now/CVE-2021-28437.md): Windows Installer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28435](https://cve.now/CVE-2021-28435.md): Windows Event Tracing Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28436](https://cve.now/CVE-2021-28436.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28434](https://cve.now/CVE-2021-28434.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28357](https://cve.now/CVE-2021-28357.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28358](https://cve.now/CVE-2021-28358.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28356](https://cve.now/CVE-2021-28356.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28354](https://cve.now/CVE-2021-28354.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28355](https://cve.now/CVE-2021-28355.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28353](https://cve.now/CVE-2021-28353.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28351](https://cve.now/CVE-2021-28351.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28352](https://cve.now/CVE-2021-28352.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28350](https://cve.now/CVE-2021-28350.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28349](https://cve.now/CVE-2021-28349.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28347](https://cve.now/CVE-2021-28347.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28348](https://cve.now/CVE-2021-28348.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28346](https://cve.now/CVE-2021-28346.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28344](https://cve.now/CVE-2021-28344.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28345](https://cve.now/CVE-2021-28345.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28343](https://cve.now/CVE-2021-28343.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28341](https://cve.now/CVE-2021-28341.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28342](https://cve.now/CVE-2021-28342.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28340](https://cve.now/CVE-2021-28340.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28338](https://cve.now/CVE-2021-28338.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28339](https://cve.now/CVE-2021-28339.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28337](https://cve.now/CVE-2021-28337.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28336](https://cve.now/CVE-2021-28336.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28334](https://cve.now/CVE-2021-28334.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28335](https://cve.now/CVE-2021-28335.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28333](https://cve.now/CVE-2021-28333.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28332](https://cve.now/CVE-2021-28332.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28330](https://cve.now/CVE-2021-28330.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28331](https://cve.now/CVE-2021-28331.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28329](https://cve.now/CVE-2021-28329.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28328](https://cve.now/CVE-2021-28328.md): Windows DNS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28326](https://cve.now/CVE-2021-28326.md): Windows AppX Deployment Server Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28327](https://cve.now/CVE-2021-28327.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-28325](https://cve.now/CVE-2021-28325.md): Windows SMB Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28324](https://cve.now/CVE-2021-28324.md): Windows SMB Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-28322](https://cve.now/CVE-2021-28322.md): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-28323](https://cve.now/CVE-2021-28323.md): Windows DNS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28321](https://cve.now/CVE-2021-28321.md): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-28319](https://cve.now/CVE-2021-28319.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-28320](https://cve.now/CVE-2021-28320.md): Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28318](https://cve.now/CVE-2021-28318.md): Windows GDI+ Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28317](https://cve.now/CVE-2021-28317.md): Microsoft Windows Codecs Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28315](https://cve.now/CVE-2021-28315.md): Windows Media Video Decoder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28316](https://cve.now/CVE-2021-28316.md): Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability (CVSS 4.2, Microsoft Windows)
- [CVE-2021-28314](https://cve.now/CVE-2021-28314.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28312](https://cve.now/CVE-2021-28312.md): Windows NTFS Denial of Service Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2021-28313](https://cve.now/CVE-2021-28313.md): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-28311](https://cve.now/CVE-2021-28311.md): Windows Application Compatibility Cache Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-28310](https://cve.now/CVE-2021-28310.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-27096](https://cve.now/CVE-2021-27096.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-28309](https://cve.now/CVE-2021-28309.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-27095](https://cve.now/CVE-2021-27095.md): Windows Media Video Decoder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27094](https://cve.now/CVE-2021-27094.md): Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2021-27093](https://cve.now/CVE-2021-27093.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-27091](https://cve.now/CVE-2021-27091.md): RPC Endpoint Mapper Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27092](https://cve.now/CVE-2021-27092.md): Azure AD Web Sign-in Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-27090](https://cve.now/CVE-2021-27090.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27088](https://cve.now/CVE-2021-27088.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27089](https://cve.now/CVE-2021-27089.md): Microsoft Internet Messaging API Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27086](https://cve.now/CVE-2021-27086.md): Windows Services and Controller App Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-27079](https://cve.now/CVE-2021-27079.md): Windows Media Photo Codec Information Disclosure Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2021-27067](https://cve.now/CVE-2021-27067.md): Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Azure DevOps Server · Microsoft Team Foundatio… +2)
- [CVE-2021-27072](https://cve.now/CVE-2021-27072.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-27064](https://cve.now/CVE-2021-27064.md): Visual Studio Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2021-26417](https://cve.now/CVE-2021-26417.md): Windows Overlay Filter Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-26415](https://cve.now/CVE-2021-26415.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-26416](https://cve.now/CVE-2021-26416.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2021-26413](https://cve.now/CVE-2021-26413.md): Windows Installer Spoofing Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2021-27609](https://cve.now/CVE-2021-27609.md): SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call th (CVSS 4.6, SAP SE SAP Focused RUN)
- [CVE-2021-21485](https://cve.now/CVE-2021-21485.md): An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java th (CVSS 7.4, SAP SE SAP NetWeaver AS for JAVA)
- [CVE-2021-27605](https://cve.now/CVE-2021-27605.md): SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unautho (CVSS 4.3, SAP SE SAP Fiori Apps 2.0 for Travel Management in SAP ERP)
- [CVE-2021-27601](https://cve.now/CVE-2021-27601.md): SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the serve (CVSS 5.4, SAP SE SAP NetWeaver AS for Java)
- [CVE-2021-27600](https://cve.now/CVE-2021-27600.md): SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HT (CVSS 6.4, SAP SE SAP Manufacturing Execution)
- [CVE-2021-27602](https://cve.now/CVE-2021-27602.md): SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which a (CVSS 9.9, SAP SE SAP Commerce)
- [CVE-2021-27603](https://cve.now/CVE-2021-27603.md): An RFC enabled function module SPI\_WAIT\_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for an (CVSS 6.5, SAP SE SAP NetWeaver AS for ABAP)
- [CVE-2021-21492](https://cve.now/CVE-2021-21492.md): SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate log (CVSS 4.3, SAP SE SAP NetWeaver AS for JAVA)
- [CVE-2021-29438](https://cve.now/CVE-2021-29438.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs (CVSS 4.6, nextcloud-dialogs · @nextcloud/dialogs)
- [CVE-2021-21482](https://cve.now/CVE-2021-21482.md): SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to (CVSS 8.3, SAP SE SAP NetWeaver Master Data Management)
- [CVE-2021-21483](https://cve.now/CVE-2021-21483.md): Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which (CVSS 8.2, SAP SE SAP Solution Manager)
- [CVE-2021-27598](https://cve.now/CVE-2021-27598.md): SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data l (CVSS 6.5, SAP SE SAP NetWeaver AS for JAVA)
- [CVE-2021-22720](https://cve.now/CVE-2021-22720.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22719](https://cve.now/CVE-2021-22719.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22718](https://cve.now/CVE-2021-22718.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22717](https://cve.now/CVE-2021-22717.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and (no CVSS, C-Bus Toolkit V1.15.7 and prior)
- [CVE-2021-22716](https://cve.now/CVE-2021-22716.md): A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivi (CVSS 7.8, Schneider Electric C-Bus Toolkit)
- [CVE-2021-0468](https://cve.now/CVE-2021-0468.md): In LK, there is a possible escalation of privilege due to an insecure default value. (no CVSS, Android)
- [CVE-2021-0444](https://cve.now/CVE-2021-0444.md): In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent. (no CVSS, Android)
- [CVE-2021-0430](https://cve.now/CVE-2021-0430.md): In rw\_mfc\_handle\_read\_op of rw\_mfc.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0400](https://cve.now/CVE-2021-0400.md): In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to eme (no CVSS, Android)
- [CVE-2021-0436](https://cve.now/CVE-2021-0436.md): In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer overflow. (no CVSS, Android)
- [CVE-2021-29437](https://cve.now/CVE-2021-29437.md): Account compromise by man-in-the-middle attack (CVSS 8.0, ScratchVerifier ScratchOAuth2)
- [CVE-2021-0471](https://cve.now/CVE-2021-0471.md): In decrypt\_1\_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0437](https://cve.now/CVE-2021-0437.md): In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. (no CVSS, Android)
- [CVE-2021-0429](https://cve.now/CVE-2021-0429.md): In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0442](https://cve.now/CVE-2021-0442.md): In updateInfo of android\_hardware\_input\_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. (no CVSS, Android)
- [CVE-2021-0427](https://cve.now/CVE-2021-0427.md): In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0426](https://cve.now/CVE-2021-0426.md): In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0439](https://cve.now/CVE-2021-0439.md): In setPowerModeWithHandle of com\_android\_server\_power\_PowerManagerService.cpp, there is a possible out of bounds write due to a missing boun (no CVSS, Android)
- [CVE-2021-0435](https://cve.now/CVE-2021-0435.md): In avrc\_proc\_vendor\_command of avrc\_api.cc, there is a possible leak of heap data due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0431](https://cve.now/CVE-2021-0431.md): In avrc\_msg\_cback of avrc\_api.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0432](https://cve.now/CVE-2021-0432.md): In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race conditi (no CVSS, Android)
- [CVE-2021-0428](https://cve.now/CVE-2021-0428.md): In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0445](https://cve.now/CVE-2021-0445.md): In start of WelcomeActivity.java, there is a possible residual profile due to a confused deputy. (no CVSS, Android)
- [CVE-2021-0446](https://cve.now/CVE-2021-0446.md): In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-0433](https://cve.now/CVE-2021-0433.md): In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjackin (no CVSS, Android)
- [CVE-2021-0443](https://cve.now/CVE-2021-0443.md): In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. (no CVSS, Android)
- [CVE-2021-0438](https://cve.now/CVE-2021-0438.md): In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an i (no CVSS, Android)
- [CVE-2021-21784](https://cve.now/CVE-2021-21784.md): An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2020-28590](https://cve.now/CVE-2020-28590.md): An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master C (CVSS 8.6, Slic3r)
- [CVE-2021-23280](https://cve.now/CVE-2021-23280.md): Arbitrary File upload (CVSS 8.0, Eaton Intelligent Power manager)
- [CVE-2021-23277](https://cve.now/CVE-2021-23277.md): Improper Neutralization of Directives in Dynamically Evaluated Code (CVSS 8.3, Eaton Intelligent Power manager)
- [CVE-2021-23281](https://cve.now/CVE-2021-23281.md): Remote Code execution (CVSS 10.0, Eaton Intelligent Power manager)
- [CVE-2021-23279](https://cve.now/CVE-2021-23279.md): Arbitrary File delete (CVSS 8.0, Eaton Intelligent Power manager)
- [CVE-2021-23276](https://cve.now/CVE-2021-23276.md): Improper Neutralization of Special Elements used in an SQL Command (CVSS 7.1, Eaton Intelligent Power manager)
- [CVE-2021-23278](https://cve.now/CVE-2021-23278.md): Arbitrary File delete (CVSS 8.7, Eaton Intelligent Power manager)
- [CVE-2021-29427](https://cve.now/CVE-2021-29427.md): Repository content filters do not work in Settings pluginManagement (CVSS 8.0, gradle)
- [CVE-2021-29428](https://cve.now/CVE-2021-29428.md): Local privilege escalation through system temporary directory (CVSS 8.8, gradle)
- [CVE-2021-21399](https://cve.now/CVE-2021-21399.md): Unauthenticated SubSonic backend access in Ampache (CVSS 9.1, ampache)
- [CVE-2021-29436](https://cve.now/CVE-2021-29436.md): Cross site request forgery vulnerability (CVSS 5.4, anuko timetracker)
- [CVE-2021-29435](https://cve.now/CVE-2021-29435.md): Cross-Site Request Forgery (CSRF) in trestle-auth (CVSS 8.1, TrestleAdmin trestle-auth · trestle-auth)
- [CVE-2021-28973](https://cve.now/CVE-2021-28973.md): The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by (no CVSS)
- [CVE-2021-29997](https://cve.now/CVE-2021-29997.md): An issue was discovered in Wind River VxWorks 7 before 21.03. (no CVSS)
- [CVE-2021-29999](https://cve.now/CVE-2021-29999.md): An issue was discovered in Wind River VxWorks through 6.8. (no CVSS)
- [CVE-2021-29998](https://cve.now/CVE-2021-29998.md): An issue was discovered in Wind River VxWorks before 6.5. (no CVSS)
- [CVE-2021-23372](https://cve.now/CVE-2021-23372.md): Denial of Service (DoS) (CVSS 4.4, mongo-express)
- [CVE-2021-21729](https://cve.now/CVE-2021-21729.md): Some ZTE products have CSRF vulnerability. (no CVSS, ZXHN H168N,ZXHN H108N)
- [CVE-2021-21730](https://cve.now/CVE-2021-21730.md): A ZTE product is impacted by improper access control vulnerability. (no CVSS, ZXHN H168N)
- [CVE-2021-21731](https://cve.now/CVE-2021-21731.md): A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully v (no CVSS, ZXCLOUD iRAI)
- [CVE-2020-13568](https://cve.now/CVE-2020-13568.md): SQL injection vulnerability exists in phpGACL 3.3.7. (CVSS 8.8, phpGACL)
- [CVE-2020-13566](https://cve.now/CVE-2020-13566.md): SQL injection vulnerabilities exist in phpGACL 3.3.7. (CVSS 8.8, phpGACL)
- [CVE-2020-27227](https://cve.now/CVE-2020-27227.md): An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. (CVSS 10.0, OpenClinic)
- [CVE-2020-27228](https://cve.now/CVE-2020-27228.md): An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. (CVSS 8.8, OpenClinic)
- [CVE-2020-27236](https://cve.now/CVE-2020-27236.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. (CVSS 6.4, OpenClinic)
- [CVE-2020-27235](https://cve.now/CVE-2020-27235.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. (CVSS 6.4, OpenClinic)
- [CVE-2020-27234](https://cve.now/CVE-2020-27234.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. (CVSS 6.4, OpenClinic)
- [CVE-2020-27233](https://cve.now/CVE-2020-27233.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. (CVSS 6.4, OpenClinic)
- [CVE-2021-22505](https://cve.now/CVE-2021-22505.md): Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.14 and 12.15. (no CVSS, Operations Agent)
- [CVE-2021-30176](https://cve.now/CVE-2021-30176.md): The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint. (no CVSS)
- [CVE-2021-30175](https://cve.now/CVE-2021-30175.md): ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page. (no CVSS)
- [CVE-2021-28647](https://cve.now/CVE-2021-28647.md): Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a m (no CVSS, Trend Micro Password Manager)
- [CVE-2021-28646](https://cve.now/CVE-2021-28646.md): An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-28645](https://cve.now/CVE-2021-28645.md): An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local at (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-25253](https://cve.now/CVE-2021-25253.md): An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-25250](https://cve.now/CVE-2021-25250.md): An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive fil (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-29425](https://cve.now/CVE-2021-29425.md): Possible limited path traversal vulnerabily in Apache Commons IO (CVSS 6.5, Apache Software Foundation Apache Commons IO · commons-i… +9)
- [CVE-2021-29943](https://cve.now/CVE-2021-29943.md): Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2021-29262](https://cve.now/CVE-2021-29262.md): Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2021-27905](https://cve.now/CVE-2021-27905.md): SSRF vulnerability with the Replication handler (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2021-28938](https://cve.now/CVE-2021-28938.md): Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2 (no CVSS)
- [CVE-2021-29003](https://cve.now/CVE-2021-29003.md): Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys\_config\_vali (no CVSS)
- [CVE-2021-29054](https://cve.now/CVE-2021-29054.md): Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. (no CVSS)
- [CVE-2021-30637](https://cve.now/CVE-2021-30637.md): htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php. (no CVSS)
- [CVE-2021-30503](https://cve.now/CVE-2021-30503.md): The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.