CVEs published April 14, 2021
80 CVEs were published on April 14, 2021: 2 critical, 12 high.
- Published
- 80
- Critical
- 2
- High
- 12
- Medium
- 4
- Low
- 2
- Unrated
- 60
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Atlassian Jira Server · Atlassian Jira Data Center
- 3
- D-Link DAP-2020
- 3
- NETGEAR R7800
- 3
- Joomla! Project Joomla! CMS
- 2
- Parallels Desktop
- 2
- SAP SE SAP Process Integration
- 2
- TIBCO Software TIBCO Messaging - Eclipse Mosquitto Distribu…
- 2
- django-debug-toolbar
- 1
- github.com/Yubico/yubihsm-connector
- 1
- lavalite/cms
- 1
Critical 2
High 12
- CVE-2021-28826TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge Windows Platform Installation vulnerabilityTIBCO Software TIBCO Messaging - Eclipse Mosquitto Distribu…
- CVE-2021-28825TIBCO Messaging - Eclipse Mosquitto Distribution - Core Windows Platform Installation vulnerabilityTIBCO Software TIBCO Messaging - Eclipse Mosquitto Distribu…
- CVE-2021-27259This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919.Parallels Desktop
- CVE-2021-27253This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800.NETGEAR R7800
- CVE-2021-27252This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1NETGEAR R7800
- CVE-2021-27251This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800.NETGEAR R7800
- CVE-2021-27249This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-FiD-Link DAP-2020
- CVE-2021-27248This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-FiD-Link DAP-2020
- CVE-2021-27246This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 TP-Link AC1750
- CVE-2021-25314hawk: Insecure file permissionsSUSE Linux Enterprise High Availability 12-SP3 · SUSE Li… +1
- CVE-2021-27608An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed whSAP Setup
- CVE-2021-27604In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise ServiSAP SE SAP Process Integration
Medium, low and unrated 66
- CVE-2021-30479An issue was discovered in Zulip Server before 3.4.
- CVE-2021-30478An issue was discovered in Zulip Server before 3.4.
- CVE-2021-26076The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 befoAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-26075The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2020-36288The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and froAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-30477An issue was discovered in Zulip Server before 3.4.
- CVE-2021-30487In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizat
- CVE-2021-27183An issue was discovered in MDaemon before 20.0.4.
- CVE-2021-27182An issue was discovered in MDaemon before 20.0.4.
- CVE-2021-27181An issue was discovered in MDaemon before 20.0.4.
- CVE-2021-27180An issue was discovered in MDaemon before 20.0.4.
- CVE-2021-29449Multiple Privilege Escalation Vulnerabilities Piholepi-hole
- CVE-2021-28157An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to exec
- CVE-2021-28048An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to
- CVE-2021-29654AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading t
- CVE-2021-26031[20210402] - Core - Inadequate filters on module layout settingsJoomla! Project Joomla! CMS
- CVE-2021-26030[20210401] - Core - Escape xss in logo parameter error pagesJoomla! Project Joomla! CMS
- CVE-2021-30459A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackedjango-debug-toolbar
- CVE-2021-3017The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the
- CVE-2021-28484An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04).github.com/Yubico/yubihsm-connector
- CVE-2021-27710Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B2020
- CVE-2020-35660Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.
- CVE-2020-28124Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.lavalite/cms
- CVE-2021-28060A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs
- CVE-2020-35418Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
- CVE-2020-35419Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
- CVE-2021-28855In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).
- CVE-2021-28856In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize.
- CVE-2021-27260This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919.Parallels Desktop
- CVE-2021-27250This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc0D-Link DAP-2020
- CVE-2021-27247This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop versiTencent WeChat
- CVE-2021-27708Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B2020
- CVE-2021-27707Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafte
- CVE-2021-27130Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload.
- CVE-2021-28098An issue was discovered in Forescout CounterACT before 8.1.4.
- CVE-2021-27706Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via
- CVE-2021-27705Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafte
- CVE-2021-30494Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Ch
- CVE-2021-30493Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBr
- CVE-2020-29593An issue was discovered in Orchard before 1.10.
- CVE-2020-29592An issue was discovered in Orchard before 1.10.
- CVE-2021-27599SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, SAP SE SAP Process Integration
- CVE-2021-27990Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the fra
- CVE-2021-26812Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module.
- CVE-2020-19778Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the paramete
- CVE-2021-27114An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices.
- CVE-2021-27113An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices.
- CVE-2021-26827Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Service (DoS) by sendin
- CVE-2021-29338Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS).
- CVE-2021-28300NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary cod
- CVE-2021-26805Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a malicious WAV file.
- CVE-2020-36120Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).
- CVE-2020-21088Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary w
- CVE-2020-21087Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web scr
- CVE-2021-27288Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script
- CVE-2021-26832Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute java
- CVE-2021-22879Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious serveNextcloud Desktop Client
- CVE-2021-27989Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.
- CVE-2021-25316Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-toolsSUSE Linux Enterprise Server 12-SP5 · SUSE Linux Enterprise…
- CVE-2017-20004In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object.
- CVE-2020-36323In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed
- CVE-2018-25008In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method.
- CVE-2020-36322An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf.
- CVE-2021-27815NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attacker
- CVE-2021-31152Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability.
- CVE-2021-31162In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.