CVEs published April 15, 2021
49 CVEs were published on April 15, 2021: 0 critical, 14 high.
- Published
- 49
- Critical
- 0
- High
- 14
- Medium
- 14
- Low
- 1
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Adobe Bridge
- 6
- matrix-org sydent · matrix-sydent
- 4
- OpenClinic
- 3
- Adobe Photoshop
- 2
- Cosori
- 2
- McAfee Advanced Threat Defense
- 2
- McAfee Data Loss Prevention (DLP) Endpoint for Windows
- 2
- tribalsystems/zenario
- 2
- wordpress-develop
- 2
- Adobe ColdFusion
- 1
High 14
- CVE-2021-29447WordPress Authenticated XXE attack when installation is running PHP 8wordpress-develop
- CVE-2021-29431SSRF in Sydent due to missing validation of hostnamesmatrix-org sydent · matrix-sydent
- CVE-2021-29430Denial of service attack via memory exhaustionmatrix-org sydent · matrix-sydent
- CVE-2021-29448Stored DOM XSS in Pi-hole Admin Web Interfacepi-hole AdminLTE
- CVE-2021-28548Adobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code executionAdobe Photoshop
- CVE-2021-21092Adobe Bridge DCM File Parsing Memory Corruption could lead to arbitrary code executionAdobe Bridge
- CVE-2021-28549Adobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code executionAdobe Photoshop
- CVE-2021-21095Adobe Bridge TTF Font Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code executionAdobe Bridge
- CVE-2021-21093Adobe Bridge SGI File Parsing Memory Corruption vulnerability could lead to arbitrary code executionAdobe Bridge
- CVE-2021-21100Adobe Digital Editions Arbitrary file system write vulnerabilityAdobe Digital Editions
- CVE-2021-21094Adobe Bridge PDF File Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code executionAdobe Bridge
- CVE-2020-28593A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0.Cosori
- CVE-2020-28592A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AFCosori
- CVE-2021-23887Privilege escalation in McAfee DLP Endpoint for WindowsMcAfee Data Loss Prevention (DLP) Endpoint for Windows
Medium, low and unrated 35
- CVE-2021-27691Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with
- CVE-2021-27692Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to
- CVE-2021-21405BLS Signature "Malleability"filecoin-project lotus · github.com/filecoin-project/lotus
- CVE-2021-29450WordPress Authenticated disclosure of password-protected posts and pageswordpress-develop
- CVE-2021-29432Malicious users could control the content of invitation emailsmatrix-org sydent · matrix-sydent
- CVE-2021-30245Code execution in Apache OpenOffice via non-http(s) schemes in HyperlinksApache Software Foundation Apache OpenOffice
- CVE-2021-28055An issue was discovered in Centreon-Web in Centreon Platform 20.10.0.centreon/centreon
- CVE-2021-31402The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-202
- CVE-2020-28898In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in scri
- CVE-2021-29433Denial of service (via resource exhaustion) due to improper input validationmatrix-org sydent · matrix-sydent
- CVE-2021-26582A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, veIceWall SSO Dgfw
- CVE-2021-3243Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability.
- CVE-2021-27112LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading o
- CVE-2021-31229An issue was discovered in libezxml.a in ezXML 0.8.6.
- CVE-2021-21087ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browserAdobe ColdFusion
- CVE-2021-21091Adobe Bridge HEIC File Parsing Out-Of-Bounds Read vulnerability could lead to information disclosureAdobe Bridge
- CVE-2021-27673Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to executribalsystems/zenario
- CVE-2021-27672SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive dtribalsystems/zenario
- CVE-2021-28242SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by
- CVE-2021-21096Adobe Bridge Genuine Software Service Incorrect Permission Assignment could lead to Denial-of-ServiceAdobe Bridge
- CVE-2020-27239An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.OpenClinic
- CVE-2020-27238An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.OpenClinic
- CVE-2020-27237An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.OpenClinic
- CVE-2021-30209Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security veri
- CVE-2021-0488In pb_write of pb_encode.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-27545SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to obtain sens
- CVE-2021-27544Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers t
- CVE-2021-27129CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parame
- CVE-2020-7270Sensitive Information Exposure in McAfee ATDMcAfee Advanced Threat Defense
- CVE-2020-7269Sensitive Information Exposure in McAfee ATDMcAfee Advanced Threat Defense
- CVE-2021-23886Local Denial of Service in McAfee DLP Endpoint for WindowsMcAfee Data Loss Prevention (DLP) Endpoint for Windows
- CVE-2020-7308Transmission of data in clear text by McAfee ENSMcAfee Endpoint Security (ENS) for WIndows
- CVE-2021-27850Bypass of the fix for CVE-2019-0195Apache Software Foundation Apache Tapestry · org.apache.tap…
- CVE-2021-23884Clear text exposure of password in McAfee CSR ePO extensionMcAfee Content Security Reporter
- CVE-2021-20288An authentication flaw was found in ceph in versions before 14.2.20.ceph