# CVEs published 2021-04-16

19 CVEs were published on April 16, 2021: 1 critical, 4 high. Days are UTC.

- [CVE-2021-29446](https://cve.now/CVE-2021-29446.md): Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime (CVSS 5.9, panva jose-node-cjs-runtime · jose-node-cjs-runtime)
- [CVE-2021-29445](https://cve.now/CVE-2021-29445.md): Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime (CVSS 5.9, panva jose-node-esm-runtime · jose-node-esm-runtime)
- [CVE-2021-29444](https://cve.now/CVE-2021-29444.md): Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime (CVSS 5.9, panva jose · jose-browser-runtime)
- [CVE-2021-29451](https://cve.now/CVE-2021-29451.md): Missing validation of JWT signature in \`ManyDesigns/Portofino\` (CVSS 9.1, ManyDesigns Portofino · com.manydesigns:portofino-dispat… +1)
- [CVE-2021-29452](https://cve.now/CVE-2021-29452.md): Any logged in user could edit any other logged in user. (CVSS 8.1, curveball a12n-server · @curveball/a12n-server)
- [CVE-2021-27394](https://cve.now/CVE-2021-27394.md): A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \< V7.23.19), Mendix Applications using Mendix 8 (All (no CVSS, Siemens Mendix Applications using Mendix)
- [CVE-2021-31348](https://cve.now/CVE-2021-31348.md): An issue was discovered in libezxml.a in ezXML 0.8.6. (no CVSS)
- [CVE-2021-29443](https://cve.now/CVE-2021-29443.md): Padding Oracle Attack due to Observable Timing Discrepancy in jose (CVSS 5.9, panva jose · jose)
- [CVE-2021-31347](https://cve.now/CVE-2021-31347.md): An issue was discovered in libezxml.a in ezXML 0.8.6. (no CVSS)
- [CVE-2021-26830](https://cve.now/CVE-2021-26830.md): SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. (no CVSS, tribalsystems/zenario)
- [CVE-2020-9681](https://cve.now/CVE-2020-9681.md): Adobe Genuine Service privilege escalation vulnerability (CVSS 6.5, Adobe GoCart)
- [CVE-2020-9668](https://cve.now/CVE-2020-9668.md): AGSService program mishandling symbolic links (CVSS 7.8, Adobe GoCart)
- [CVE-2020-9667](https://cve.now/CVE-2020-9667.md): Uncontrolled Search Path Element in AGSService.exe (CVSS 6.5, Adobe GoCart)
- [CVE-2021-20491](https://cve.now/CVE-2021-20491.md): IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of (CVSS 4.4, IBM Spectrum Protect Server)
- [CVE-2021-22539](https://cve.now/CVE-2021-22539.md): Code execution in VSCode-bazel via malicious Bazel config files (CVSS 8.2, Google VSCode-Bazel)
- [CVE-2021-31414](https://cve.now/CVE-2021-31414.md): The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configurat (no CVSS)
- [CVE-2021-26074](https://cve.now/CVE-2021-26074.md): Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Ja (CVSS 6.5, Atlassian Connect Spring Boot · com.atlassian.connect:atlas…)
- [CVE-2021-26073](https://cve.now/CVE-2021-26073.md): Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js pac (CVSS 7.7, Atlassian Connect Express · atlassian-connect-express)
- [CVE-2018-19942](https://cve.now/CVE-2018-19942.md): Cross-site Scripting Vulnerability in File Station (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.