# CVEs published 2021-04-14

80 CVEs were published on April 14, 2021: 2 critical, 12 high. Days are UTC.

- [CVE-2021-30479](https://cve.now/CVE-2021-30479.md): An issue was discovered in Zulip Server before 3.4. (no CVSS)
- [CVE-2021-30478](https://cve.now/CVE-2021-30478.md): An issue was discovered in Zulip Server before 3.4. (no CVSS)
- [CVE-2021-26076](https://cve.now/CVE-2021-26076.md): The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 befo (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-26075](https://cve.now/CVE-2021-26075.md): The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2020-36288](https://cve.now/CVE-2020-36288.md): The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and fro (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-30477](https://cve.now/CVE-2021-30477.md): An issue was discovered in Zulip Server before 3.4. (no CVSS)
- [CVE-2021-30487](https://cve.now/CVE-2021-30487.md): In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizat (no CVSS)
- [CVE-2021-27183](https://cve.now/CVE-2021-27183.md): An issue was discovered in MDaemon before 20.0.4. (no CVSS)
- [CVE-2021-27182](https://cve.now/CVE-2021-27182.md): An issue was discovered in MDaemon before 20.0.4. (no CVSS)
- [CVE-2021-27181](https://cve.now/CVE-2021-27181.md): An issue was discovered in MDaemon before 20.0.4. (no CVSS)
- [CVE-2021-27180](https://cve.now/CVE-2021-27180.md): An issue was discovered in MDaemon before 20.0.4. (no CVSS)
- [CVE-2021-29449](https://cve.now/CVE-2021-29449.md): Multiple Privilege Escalation Vulnerabilities Pihole (CVSS 6.3, pi-hole)
- [CVE-2021-28157](https://cve.now/CVE-2021-28157.md): An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to exec (no CVSS)
- [CVE-2021-28048](https://cve.now/CVE-2021-28048.md): An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to (no CVSS)
- [CVE-2021-29654](https://cve.now/CVE-2021-29654.md): AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading t (no CVSS)
- [CVE-2021-26031](https://cve.now/CVE-2021-26031.md): \[20210402\] - Core - Inadequate filters on module layout settings (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26030](https://cve.now/CVE-2021-26030.md): \[20210401\] - Core - Escape xss in logo parameter error pages (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-30459](https://cve.now/CVE-2021-30459.md): A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attacke (no CVSS, django-debug-toolbar)
- [CVE-2021-3017](https://cve.now/CVE-2021-3017.md): The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the (no CVSS)
- [CVE-2021-28484](https://cve.now/CVE-2021-28484.md): An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). (no CVSS, github.com/Yubico/yubihsm-connector)
- [CVE-2021-27710](https://cve.now/CVE-2021-27710.md): Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118\_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470\_B2020 (no CVSS)
- [CVE-2020-35660](https://cve.now/CVE-2020-35660.md): Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page. (no CVSS)
- [CVE-2020-28124](https://cve.now/CVE-2020-28124.md): Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field. (no CVSS, lavalite/cms)
- [CVE-2021-28826](https://cve.now/CVE-2021-28826.md): TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO Messaging - Eclipse Mosquitto Distribu…)
- [CVE-2021-28825](https://cve.now/CVE-2021-28825.md): TIBCO Messaging - Eclipse Mosquitto Distribution - Core Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO Messaging - Eclipse Mosquitto Distribu…)
- [CVE-2021-28060](https://cve.now/CVE-2021-28060.md): A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs (no CVSS)
- [CVE-2020-35418](https://cve.now/CVE-2020-35418.md): Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file. (no CVSS)
- [CVE-2020-35419](https://cve.now/CVE-2020-35419.md): Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET\_LANGUAGE parameter. (no CVSS)
- [CVE-2021-28855](https://cve.now/CVE-2021-28855.md): In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf\_write function (src/deark-dbuf.c). (no CVSS)
- [CVE-2021-28856](https://cve.now/CVE-2021-28856.md): In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize. (no CVSS)
- [CVE-2021-27260](https://cve.now/CVE-2021-27260.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. (CVSS 3.2, Parallels Desktop)
- [CVE-2021-27259](https://cve.now/CVE-2021-27259.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. (CVSS 7.8, Parallels Desktop)
- [CVE-2021-27253](https://cve.now/CVE-2021-27253.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. (CVSS 8.8, NETGEAR R7800)
- [CVE-2021-27258](https://cve.now/CVE-2021-27258.md): This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. (CVSS 9.8, SolarWinds Orion Platform)
- [CVE-2021-27252](https://cve.now/CVE-2021-27252.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1 (CVSS 8.8, NETGEAR R7800)
- [CVE-2021-27250](https://cve.now/CVE-2021-27250.md): This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc0 (CVSS 6.5, D-Link DAP-2020)
- [CVE-2021-27251](https://cve.now/CVE-2021-27251.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. (CVSS 8.8, NETGEAR R7800)
- [CVE-2021-27249](https://cve.now/CVE-2021-27249.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi (CVSS 8.8, D-Link DAP-2020)
- [CVE-2021-27247](https://cve.now/CVE-2021-27247.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop versi (CVSS 6.5, Tencent WeChat)
- [CVE-2021-27248](https://cve.now/CVE-2021-27248.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi (CVSS 8.8, D-Link DAP-2020)
- [CVE-2021-27246](https://cve.now/CVE-2021-27246.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 (CVSS 8.0, TP-Link AC1750)
- [CVE-2021-27708](https://cve.now/CVE-2021-27708.md): Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118\_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470\_B2020 (no CVSS)
- [CVE-2021-25314](https://cve.now/CVE-2021-25314.md): hawk: Insecure file permissions (CVSS 7.8, SUSE Linux Enterprise High Availability 12-SP3 · SUSE Li… +1)
- [CVE-2021-27707](https://cve.now/CVE-2021-27707.md): Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)\_CN allows remote attackers to execute arbitrary code via a crafte (no CVSS)
- [CVE-2021-27130](https://cve.now/CVE-2021-27130.md): Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload. (no CVSS)
- [CVE-2021-28098](https://cve.now/CVE-2021-28098.md): An issue was discovered in Forescout CounterACT before 8.1.4. (no CVSS)
- [CVE-2021-27706](https://cve.now/CVE-2021-27706.md): Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)\_CN allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2021-27705](https://cve.now/CVE-2021-27705.md): Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)\_CN allows remote attackers to execute arbitrary code via a crafte (no CVSS)
- [CVE-2021-30494](https://cve.now/CVE-2021-30494.md): Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Ch (no CVSS)
- [CVE-2021-30493](https://cve.now/CVE-2021-30493.md): Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBr (no CVSS)
- [CVE-2020-29593](https://cve.now/CVE-2020-29593.md): An issue was discovered in Orchard before 1.10. (no CVSS)
- [CVE-2021-27608](https://cve.now/CVE-2021-27608.md): An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed wh (CVSS 7.5, SAP Setup)
- [CVE-2020-29592](https://cve.now/CVE-2020-29592.md): An issue was discovered in Orchard before 1.10. (no CVSS)
- [CVE-2021-27599](https://cve.now/CVE-2021-27599.md): SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, (CVSS 6.5, SAP SE SAP Process Integration)
- [CVE-2021-27604](https://cve.now/CVE-2021-27604.md): In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Servi (CVSS 7.7, SAP SE SAP Process Integration)
- [CVE-2021-27990](https://cve.now/CVE-2021-27990.md): Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the fra (no CVSS)
- [CVE-2021-26812](https://cve.now/CVE-2021-26812.md): Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. (no CVSS)
- [CVE-2020-19778](https://cve.now/CVE-2020-19778.md): Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the paramete (no CVSS)
- [CVE-2021-27114](https://cve.now/CVE-2021-27114.md): An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. (no CVSS)
- [CVE-2021-27113](https://cve.now/CVE-2021-27113.md): An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. (no CVSS)
- [CVE-2021-26827](https://cve.now/CVE-2021-26827.md): Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Service (DoS) by sendin (no CVSS)
- [CVE-2021-29338](https://cve.now/CVE-2021-29338.md): Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). (no CVSS)
- [CVE-2021-28300](https://cve.now/CVE-2021-28300.md): NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary cod (no CVSS)
- [CVE-2021-26805](https://cve.now/CVE-2021-26805.md): Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a malicious WAV file. (no CVSS)
- [CVE-2020-36120](https://cve.now/CVE-2020-36120.md): Buffer Overflow in the "sixel\_encoder\_encode\_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS). (no CVSS)
- [CVE-2020-21088](https://cve.now/CVE-2020-21088.md): Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary w (no CVSS)
- [CVE-2020-21087](https://cve.now/CVE-2020-21087.md): Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web scr (no CVSS)
- [CVE-2021-27288](https://cve.now/CVE-2021-27288.md): Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script (no CVSS)
- [CVE-2021-26832](https://cve.now/CVE-2021-26832.md): Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute java (no CVSS)
- [CVE-2021-22879](https://cve.now/CVE-2021-22879.md): Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious serve (no CVSS, Nextcloud Desktop Client)
- [CVE-2021-27989](https://cve.now/CVE-2021-27989.md): Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx. (no CVSS)
- [CVE-2021-25316](https://cve.now/CVE-2021-25316.md): Local DoS of VM live migration due to use of static tmp files in detach\_disks.sh in s390-tools (CVSS 3.3, SUSE Linux Enterprise Server 12-SP5 · SUSE Linux Enterprise…)
- [CVE-2021-28797](https://cve.now/CVE-2021-28797.md): Stack Buffer Overflow in Surveillance Station (CVSS 9.8, QNAP Systems Surveillance Station)
- [CVE-2017-20004](https://cve.now/CVE-2017-20004.md): In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. (no CVSS)
- [CVE-2020-36323](https://cve.now/CVE-2020-36323.md): In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (no CVSS)
- [CVE-2018-25008](https://cve.now/CVE-2018-25008.md): In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get\_mut method. (no CVSS)
- [CVE-2020-36322](https://cve.now/CVE-2020-36322.md): An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. (no CVSS)
- [CVE-2021-27815](https://cve.now/CVE-2021-27815.md): NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attacker (no CVSS)
- [CVE-2021-31152](https://cve.now/CVE-2021-31152.md): Multilaser Router AC1200 V02.03.01.45\_pt contains a cross-site request forgery (CSRF) vulnerability. (no CVSS)
- [CVE-2021-31162](https://cve.now/CVE-2021-31162.md): In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from\_iter function if freeing the element panics. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.