# CVEs published 2021-04-19

44 CVEs were published on April 19, 2021: 1 critical, 4 high. Days are UTC.

- [CVE-2021-20208](https://cve.now/CVE-2021-20208.md): A flaw was found in cifs-utils in versions before 6.13. (no CVSS, cifs-utils)
- [CVE-2021-3506](https://cve.now/CVE-2021-3506.md): An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. (no CVSS, kernel)
- [CVE-2021-27458](https://cve.now/CVE-2021-27458.md): If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TC (no CVSS, JTEKT Corporation TOYOPUC products)
- [CVE-2020-27241](https://cve.now/CVE-2020-27241.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. (CVSS 6.4, OpenClinic)
- [CVE-2020-27240](https://cve.now/CVE-2020-27240.md): An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. (CVSS 6.4, OpenClinic)
- [CVE-2021-3498](https://cve.now/CVE-2021-3498.md): GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files. (no CVSS, gstreamer-plugins-good)
- [CVE-2021-3497](https://cve.now/CVE-2021-3497.md): GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files. (no CVSS, gstreamer-plugins-good)
- [CVE-2021-3505](https://cve.now/CVE-2021-3505.md): A flaw was found in libtpms in versions before 0.8.0. (no CVSS, libtpms)
- [CVE-2021-29279](https://cve.now/CVE-2021-29279.md): There is a integer overflow in function filter\_core/filter\_props.c:gf\_props\_assign\_value in GPAC 1.0.1. (no CVSS)
- [CVE-2021-30014](https://cve.now/CVE-2021-30014.md): There is a integer overflow in media\_tools/av\_parsers.c in the hevc\_parse\_slice\_segment function in GPAC from v0.9.0-preview to 1.0.1 which (no CVSS)
- [CVE-2021-30015](https://cve.now/CVE-2021-30015.md): There is a Null Pointer Dereference in function filter\_core/filter\_pck.c:gf\_filter\_pck\_new\_alloc\_internal in GPAC 1.0.1. (no CVSS)
- [CVE-2021-30019](https://cve.now/CVE-2021-30019.md): In the adts\_dmx\_process function in filters/reframe\_adts.c in GPAC 1.0.1, a crafted file may cause ctx-\>hdr.frame\_size to be smaller than ct (no CVSS)
- [CVE-2021-30020](https://cve.now/CVE-2021-30020.md): In the function gf\_hevc\_read\_pps\_bs\_internal function in media\_tools/av\_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pp (no CVSS)
- [CVE-2021-30022](https://cve.now/CVE-2021-30022.md): There is a integer overflow in media\_tools/av\_parsers.c in the gf\_avc\_read\_pps\_bs\_internal in GPAC from 0.5.2 to 1.0.1. (no CVSS)
- [CVE-2021-30199](https://cve.now/CVE-2021-30199.md): In filters/reframe\_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf\_filter\_pck\_get\_data is called. (no CVSS)
- [CVE-2021-29455](https://cve.now/CVE-2021-29455.md): Missing validation of JWT signature in \`grassrootza/grassroot-platform\` (CVSS 7.5, grassrootza grassroot-platform)
- [CVE-2021-29453](https://cve.now/CVE-2021-29453.md): Denial of service through memory exhaustion (CVSS 5.7, turt2live matrix-media-repo)
- [CVE-2021-29434](https://cve.now/CVE-2021-29434.md): Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields (CVSS 6.1, wagtail)
- [CVE-2021-31254](https://cve.now/CVE-2021-31254.md): Buffer overflow in the tenc\_box\_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary cod (no CVSS)
- [CVE-2021-31255](https://cve.now/CVE-2021-31255.md): Buffer overflow in the abst\_box\_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary cod (no CVSS)
- [CVE-2021-31256](https://cve.now/CVE-2021-31256.md): Memory leak in the stbl\_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. (no CVSS)
- [CVE-2021-31257](https://cve.now/CVE-2021-31257.md): The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Bo (no CVSS)
- [CVE-2021-31258](https://cve.now/CVE-2021-31258.md): The gf\_isom\_set\_extraction\_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted (no CVSS)
- [CVE-2021-31259](https://cve.now/CVE-2021-31259.md): The gf\_isom\_cenc\_get\_default\_info\_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) v (no CVSS)
- [CVE-2021-31260](https://cve.now/CVE-2021-31260.md): The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4 (no CVSS)
- [CVE-2021-31261](https://cve.now/CVE-2021-31261.md): The gf\_hinter\_track\_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command. (no CVSS)
- [CVE-2021-31262](https://cve.now/CVE-2021-31262.md): The AV1\_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file i (no CVSS)
- [CVE-2021-20527](https://cve.now/CVE-2021-20527.md): IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. (CVSS 6.0, IBM Resilient OnPrem)
- [CVE-2020-28141](https://cve.now/CVE-2020-28141.md): The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. (no CVSS)
- [CVE-2021-27031](https://cve.now/CVE-2021-27031.md): A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the applica (no CVSS, Autodesk FBX Review)
- [CVE-2021-27030](https://cve.now/CVE-2021-27030.md): A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s (no CVSS, Autodesk FBX Review)
- [CVE-2021-27029](https://cve.now/CVE-2021-27029.md): The user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review version (no CVSS, Autodesk FBX Review)
- [CVE-2021-27028](https://cve.now/CVE-2021-27028.md): A Memory Corruption Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to remote code execution through maliciously craft (no CVSS, Autodesk FBX Review)
- [CVE-2021-27027](https://cve.now/CVE-2021-27027.md): An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.0 and prior may lead to code execution through maliciously crafted DL (no CVSS, Autodesk FBX Review)
- [CVE-2021-21981](https://cve.now/CVE-2021-21981.md): VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. (no CVSS, VMware NSX-T)
- [CVE-2021-20992](https://cve.now/CVE-2021-20992.md): Fibaro Home Center Unencrypted management interface (CVSS 8.1, Fibar Group S.A Fibaro Home Center)
- [CVE-2021-20991](https://cve.now/CVE-2021-20991.md): Fibaro Home Center Authenticated remote command execution (CVSS 9.8, Fibar Group S.A Fibaro Home Center)
- [CVE-2021-20990](https://cve.now/CVE-2021-20990.md): Fibaro Home Center Unauthenticated access to shutdown, reboot and reboot to recovery mode (CVSS 7.5, Fibar Group S.A Fibaro Home Center)
- [CVE-2021-20989](https://cve.now/CVE-2021-20989.md): Fibaro Home Center Insufficient remote access server authorization (CVSS 5.9, Fibar Group S.A Fibaro Home Center)
- [CVE-2020-7851](https://cve.now/CVE-2020-7851.md): Innorix File Transfer Solution File Download and Execution Vulnerability (CVSS 7.8, INNORIX Agent.exe)
- [CVE-2021-21070](https://cve.now/CVE-2021-21070.md): Privilege Escalation Vulnerability in Adobe RoboHelp (CVSS 6.5, Adobe RoboHelp)
- [CVE-2021-29399](https://cve.now/CVE-2021-29399.md): XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. (no CVSS)
- [CVE-2021-29457](https://cve.now/CVE-2021-29457.md): Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadata (no CVSS, exiv2)
- [CVE-2021-29458](https://cve.now/CVE-2021-29458.md): Out-of-bounds read in Exiv2::Internal::CrwMap::encode (no CVSS, exiv2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.