CVEs published April 19, 2021
44 CVEs were published on April 19, 2021: 1 critical, 4 high.
- Published
- 44
- Critical
- 1
- High
- 4
- Medium
- 7
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Autodesk FBX Review
- 5
- Fibar Group S.A Fibaro Home Center
- 4
- exiv2
- 2
- gstreamer-plugins-good
- 2
- OpenClinic
- 2
- Adobe RoboHelp
- 1
- cifs-utils
- 1
- grassrootza grassroot-platform
- 1
- IBM Resilient OnPrem
- 1
- INNORIX Agent.exe
- 1
Critical 1
High 4
- CVE-2021-29455Missing validation of JWT signature in `grassrootza/grassroot-platform`grassrootza grassroot-platform
- CVE-2021-20992Fibaro Home Center Unencrypted management interfaceFibar Group S.A Fibaro Home Center
- CVE-2021-20990Fibaro Home Center Unauthenticated access to shutdown, reboot and reboot to recovery modeFibar Group S.A Fibaro Home Center
- CVE-2020-7851Innorix File Transfer Solution File Download and Execution VulnerabilityINNORIX Agent.exe
Medium, low and unrated 39
- CVE-2021-20208A flaw was found in cifs-utils in versions before 6.13.cifs-utils
- CVE-2021-3506An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4.kernel
- CVE-2021-27458If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCJTEKT Corporation TOYOPUC products
- CVE-2020-27241An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.OpenClinic
- CVE-2020-27240An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.OpenClinic
- CVE-2021-3498GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.gstreamer-plugins-good
- CVE-2021-3497GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.gstreamer-plugins-good
- CVE-2021-3505A flaw was found in libtpms in versions before 0.8.0.libtpms
- CVE-2021-29279There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1.
- CVE-2021-30014There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC from v0.9.0-preview to 1.0.1 which
- CVE-2021-30015There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1.
- CVE-2021-30019In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ct
- CVE-2021-30020In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pp
- CVE-2021-30022There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC from 0.5.2 to 1.0.1.
- CVE-2021-30199In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called.
- CVE-2021-29453Denial of service through memory exhaustionturt2live matrix-media-repo
- CVE-2021-29434Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fieldswagtail
- CVE-2021-31254Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary cod
- CVE-2021-31255Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary cod
- CVE-2021-31256Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- CVE-2021-31257The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Bo
- CVE-2021-31258The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted
- CVE-2021-31259The gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) v
- CVE-2021-31260The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4
- CVE-2021-31261The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
- CVE-2021-31262The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file i
- CVE-2021-20527IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user.IBM Resilient OnPrem
- CVE-2020-28141The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body.
- CVE-2021-27031A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the applicaAutodesk FBX Review
- CVE-2021-27030A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’sAutodesk FBX Review
- CVE-2021-27029The user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review versionAutodesk FBX Review
- CVE-2021-27028A Memory Corruption Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to remote code execution through maliciously craftAutodesk FBX Review
- CVE-2021-27027An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to code execution through maliciously crafted DLAutodesk FBX Review
- CVE-2021-21981VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment.VMware NSX-T
- CVE-2021-20989Fibaro Home Center Insufficient remote access server authorizationFibar Group S.A Fibaro Home Center
- CVE-2021-21070Privilege Escalation Vulnerability in Adobe RoboHelpAdobe RoboHelp
- CVE-2021-29399XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input.
- CVE-2021-29457Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadataexiv2
- CVE-2021-29458Out-of-bounds read in Exiv2::Internal::CrwMap::encodeexiv2