CVEs published April 20, 2021
30 CVEs were published on April 20, 2021: 2 critical, 7 high. 1 is now in CISA KEV.
- Published
- 30
- Critical
- 2
- High
- 7
- Medium
- 8
- Low
- 1
- Unrated
- 12
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Dell PowerScale OneFS
- 2
- Palo Alto Networks PAN-OS
- 2
- TIBCO Software TIBCO Administrator - Enterprise Edition
- 2
- Cnesty Helpcom
- 1
- DEMON1A Discord-Recon
- 1
- github.com/hashicorp/consul
- 1
- IBM WebSphere Application Server
- 1
- NVIDIA GeForce Experience Software
- 1
- Palo Alto Networks Bridgecrew Checkov
- 1
- Palo Alto Networks GlobalProtect App
- 1
Critical 2
High 7
- CVE-2021-29462DNS rebinding in pupnppupnp
- CVE-2020-7857A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command.Tobesoft XPlatform
- CVE-2021-29461LFI and possible code execution on discord-recon using tools argumentsDEMON1A Discord-Recon
- CVE-2021-28828TIBCO Administrator SQL injection vulnerabilityTIBCO Software TIBCO Administrator - Enterprise Edition
- CVE-2020-26197Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability.Dell PowerScale OneFS
- CVE-2020-7856A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command.Cnesty Helpcom
- CVE-2021-20453IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM WebSphere Application Server
Medium, low and unrated 21
- CVE-2020-35314A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attacker
- CVE-2020-35313A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows rem
- CVE-2021-28829TIBCO Administrator CSV injection vulnerabilityTIBCO Software TIBCO Administrator - Enterprise Edition
- CVE-2021-30464OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to
- CVE-2021-21526Dell PowerScale OneFS 8.1.0 - 9.1.0 contains a privilege escalation in SmartLock compliance mode that may allow compadmin to execute arbitraDell PowerScale OneFS
- CVE-2020-14105The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.Xiaomi
- CVE-2021-28156HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events.
- CVE-2021-1079NVIDIA GeForce Experience, all versions prior to 3.22, contains a vulnerability in GameStream plugins where log files are created using NT/SNVIDIA GeForce Experience Software
- CVE-2020-25864HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting.github.com/hashicorp/consul
- CVE-2021-28492Unisys Stealth (core) 5.x before 5.0.048.0, 5.1.x before 5.1.017.0, and 6.x before 6.0.037.0 stores passwords in a recoverable format.
- CVE-2021-28793vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbi
- CVE-2021-20023SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on thSonicWall Email Security
- CVE-2021-25681AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS.
- CVE-2021-25680The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues.
- CVE-2021-25679The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues.
- CVE-2021-3038GlobalProtect App: Windows VPN kernel driver denial of service (DoS)Palo Alto Networks GlobalProtect App
- CVE-2021-3037PAN-OS: Secrets for scheduled configuration exports are logged in system logsPalo Alto Networks PAN-OS
- CVE-2021-3036PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectlyPalo Alto Networks PAN-OS
- CVE-2021-3035Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code executionPalo Alto Networks Bridgecrew Checkov
- CVE-2021-29155An issue was discovered in the Linux kernel through 5.11.x.
- CVE-2021-30496The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an at