# CVEs published 2021-04-15

49 CVEs were published on April 15, 2021: 0 critical, 14 high. Days are UTC.

- [CVE-2021-27691](https://cve.now/CVE-2021-27691.md): Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)\_CN and v15.11.0.5(5876)\_CN , and Tenda G1 and G3 routers with (no CVSS)
- [CVE-2021-27692](https://cve.now/CVE-2021-27692.md): Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)\_CN or v15.11.0.16(9024)\_CN allows remote attackers to (no CVSS)
- [CVE-2021-21405](https://cve.now/CVE-2021-21405.md): BLS Signature "Malleability" (CVSS 5.9, filecoin-project lotus · github.com/filecoin-project/lotus)
- [CVE-2021-29450](https://cve.now/CVE-2021-29450.md): WordPress Authenticated disclosure of password-protected posts and pages (CVSS 6.5, wordpress-develop)
- [CVE-2021-29447](https://cve.now/CVE-2021-29447.md): WordPress Authenticated XXE attack when installation is running PHP 8 (CVSS 7.1, wordpress-develop)
- [CVE-2021-29431](https://cve.now/CVE-2021-29431.md): SSRF in Sydent due to missing validation of hostnames (CVSS 7.7, matrix-org sydent · matrix-sydent)
- [CVE-2021-29432](https://cve.now/CVE-2021-29432.md): Malicious users could control the content of invitation emails (CVSS 5.3, matrix-org sydent · matrix-sydent)
- [CVE-2021-29430](https://cve.now/CVE-2021-29430.md): Denial of service attack via memory exhaustion (CVSS 7.5, matrix-org sydent · matrix-sydent)
- [CVE-2021-30245](https://cve.now/CVE-2021-30245.md): Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks (no CVSS, Apache Software Foundation Apache OpenOffice)
- [CVE-2021-28055](https://cve.now/CVE-2021-28055.md): An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. (no CVSS, centreon/centreon)
- [CVE-2021-31402](https://cve.now/CVE-2021-31402.md): The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-202 (no CVSS)
- [CVE-2020-28898](https://cve.now/CVE-2020-28898.md): In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in scri (no CVSS)
- [CVE-2021-29433](https://cve.now/CVE-2021-29433.md): Denial of service (via resource exhaustion) due to improper input validation (CVSS 4.3, matrix-org sydent · matrix-sydent)
- [CVE-2021-26582](https://cve.now/CVE-2021-26582.md): A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, ve (no CVSS, IceWall SSO Dgfw)
- [CVE-2021-3243](https://cve.now/CVE-2021-3243.md): Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-29448](https://cve.now/CVE-2021-29448.md): Stored DOM XSS in Pi-hole Admin Web Interface (CVSS 7.6, pi-hole AdminLTE)
- [CVE-2021-27112](https://cve.now/CVE-2021-27112.md): LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading o (no CVSS)
- [CVE-2021-31229](https://cve.now/CVE-2021-31229.md): An issue was discovered in libezxml.a in ezXML 0.8.6. (no CVSS)
- [CVE-2021-28548](https://cve.now/CVE-2021-28548.md): Adobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-21087](https://cve.now/CVE-2021-21087.md): ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser (CVSS 5.4, Adobe ColdFusion)
- [CVE-2021-21092](https://cve.now/CVE-2021-21092.md): Adobe Bridge DCM File Parsing Memory Corruption could lead to arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-21091](https://cve.now/CVE-2021-21091.md): Adobe Bridge HEIC File Parsing Out-Of-Bounds Read vulnerability could lead to information disclosure (CVSS 3.3, Adobe Bridge)
- [CVE-2021-28549](https://cve.now/CVE-2021-28549.md): Adobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-21095](https://cve.now/CVE-2021-21095.md): Adobe Bridge TTF Font Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-21093](https://cve.now/CVE-2021-21093.md): Adobe Bridge SGI File Parsing Memory Corruption vulnerability could lead to arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-27673](https://cve.now/CVE-2021-27673.md): Cross Site Scripting (XSS) in the "admin\_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execu (no CVSS, tribalsystems/zenario)
- [CVE-2021-27672](https://cve.now/CVE-2021-27672.md): SQL Injection in the "admin\_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive d (no CVSS, tribalsystems/zenario)
- [CVE-2021-21100](https://cve.now/CVE-2021-21100.md): Adobe Digital Editions Arbitrary file system write vulnerability (CVSS 7.8, Adobe Digital Editions)
- [CVE-2021-28242](https://cve.now/CVE-2021-28242.md): SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by (no CVSS)
- [CVE-2021-21096](https://cve.now/CVE-2021-21096.md): Adobe Bridge Genuine Software Service Incorrect Permission Assignment could lead to Denial-of-Service (CVSS 5.5, Adobe Bridge)
- [CVE-2021-21094](https://cve.now/CVE-2021-21094.md): Adobe Bridge PDF File Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2020-28593](https://cve.now/CVE-2020-28593.md): A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. (CVSS 8.1, Cosori)
- [CVE-2020-28592](https://cve.now/CVE-2020-28592.md): A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF (CVSS 8.1, Cosori)
- [CVE-2020-27239](https://cve.now/CVE-2020-27239.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. (CVSS 6.4, OpenClinic)
- [CVE-2020-27238](https://cve.now/CVE-2020-27238.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. (CVSS 6.4, OpenClinic)
- [CVE-2020-27237](https://cve.now/CVE-2020-27237.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. (CVSS 6.4, OpenClinic)
- [CVE-2021-30209](https://cve.now/CVE-2021-30209.md): Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security veri (no CVSS)
- [CVE-2021-0488](https://cve.now/CVE-2021-0488.md): In pb\_write of pb\_encode.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-27545](https://cve.now/CVE-2021-27545.md): SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to obtain sens (no CVSS)
- [CVE-2021-27544](https://cve.now/CVE-2021-27544.md): Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers t (no CVSS)
- [CVE-2021-27129](https://cve.now/CVE-2021-27129.md): CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students \> Edit \> ROUTE parame (no CVSS)
- [CVE-2020-7270](https://cve.now/CVE-2020-7270.md): Sensitive Information Exposure in McAfee ATD (CVSS 4.9, McAfee Advanced Threat Defense)
- [CVE-2020-7269](https://cve.now/CVE-2020-7269.md): Sensitive Information Exposure in McAfee ATD (CVSS 4.9, McAfee Advanced Threat Defense)
- [CVE-2021-23887](https://cve.now/CVE-2021-23887.md): Privilege escalation in McAfee DLP Endpoint for Windows (CVSS 7.8, McAfee Data Loss Prevention (DLP) Endpoint for Windows)
- [CVE-2021-23886](https://cve.now/CVE-2021-23886.md): Local Denial of Service in McAfee DLP Endpoint for Windows (CVSS 5.5, McAfee Data Loss Prevention (DLP) Endpoint for Windows)
- [CVE-2020-7308](https://cve.now/CVE-2020-7308.md): Transmission of data in clear text by McAfee ENS (CVSS 4.8, McAfee Endpoint Security (ENS) for WIndows)
- [CVE-2021-27850](https://cve.now/CVE-2021-27850.md): Bypass of the fix for CVE-2019-0195 (no CVSS, Apache Software Foundation Apache Tapestry · org.apache.tap…)
- [CVE-2021-23884](https://cve.now/CVE-2021-23884.md): Clear text exposure of password in McAfee CSR ePO extension (CVSS 4.3, McAfee Content Security Reporter)
- [CVE-2021-20288](https://cve.now/CVE-2021-20288.md): An authentication flaw was found in ceph in versions before 14.2.20. (no CVSS, ceph)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.