# CVEs published 2021-04-20

30 CVEs were published on April 20, 2021: 2 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-29462](https://cve.now/CVE-2021-29462.md): DNS rebinding in pupnp (CVSS 7.6, pupnp)
- [CVE-2020-7857](https://cve.now/CVE-2020-7857.md): A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. (CVSS 7.5, Tobesoft XPlatform)
- [CVE-2021-29461](https://cve.now/CVE-2021-29461.md): LFI and possible code execution on discord-recon using tools arguments (CVSS 8.1, DEMON1A Discord-Recon)
- [CVE-2020-35314](https://cve.now/CVE-2020-35314.md): A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attacker (no CVSS)
- [CVE-2020-35313](https://cve.now/CVE-2020-35313.md): A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows rem (no CVSS)
- [CVE-2021-29459](https://cve.now/CVE-2021-29459.md): XSS Cross Site Scripting (CVSS 9.6, xwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1)
- [CVE-2021-28829](https://cve.now/CVE-2021-28829.md): TIBCO Administrator CSV injection vulnerability (CVSS 6.5, TIBCO Software TIBCO Administrator - Enterprise Edition)
- [CVE-2021-28828](https://cve.now/CVE-2021-28828.md): TIBCO Administrator SQL injection vulnerability (CVSS 7.6, TIBCO Software TIBCO Administrator - Enterprise Edition)
- [CVE-2021-28827](https://cve.now/CVE-2021-28827.md): TIBCO Administrator Stored Cross Site Scripting vulnerability (CVSS 9.6, TIBCO Software TIBCO Administrator - Enterprise Edition · T…)
- [CVE-2021-30464](https://cve.now/CVE-2021-30464.md): OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to (no CVSS)
- [CVE-2021-21526](https://cve.now/CVE-2021-21526.md): Dell PowerScale OneFS 8.1.0 - 9.1.0 contains a privilege escalation in SmartLock compliance mode that may allow compadmin to execute arbitra (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2020-26197](https://cve.now/CVE-2020-26197.md): Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2020-14105](https://cve.now/CVE-2020-14105.md): The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI \< 2020.01.15. (no CVSS, Xiaomi)
- [CVE-2021-28156](https://cve.now/CVE-2021-28156.md): HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. (no CVSS)
- [CVE-2021-1079](https://cve.now/CVE-2021-1079.md): NVIDIA GeForce Experience, all versions prior to 3.22, contains a vulnerability in GameStream plugins where log files are created using NT/S (CVSS 6.1, NVIDIA GeForce Experience Software)
- [CVE-2020-25864](https://cve.now/CVE-2020-25864.md): HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. (no CVSS, github.com/hashicorp/consul)
- [CVE-2021-28492](https://cve.now/CVE-2021-28492.md): Unisys Stealth (core) 5.x before 5.0.048.0, 5.1.x before 5.1.017.0, and 6.x before 6.0.037.0 stores passwords in a recoverable format. (no CVSS)
- [CVE-2021-28793](https://cve.now/CVE-2021-28793.md): vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbi (no CVSS)
- [CVE-2020-7856](https://cve.now/CVE-2020-7856.md): A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. (CVSS 7.5, Cnesty Helpcom)
- [CVE-2021-20023](https://cve.now/CVE-2021-20023.md): SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on th (CVSS 4.9, KEV, SonicWall Email Security)
- [CVE-2021-20453](https://cve.now/CVE-2021-20453.md): IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (CVSS 8.2, IBM WebSphere Application Server)
- [CVE-2021-25681](https://cve.now/CVE-2021-25681.md): AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. (no CVSS)
- [CVE-2021-25680](https://cve.now/CVE-2021-25680.md): The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. (no CVSS)
- [CVE-2021-25679](https://cve.now/CVE-2021-25679.md): The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. (no CVSS)
- [CVE-2021-3038](https://cve.now/CVE-2021-3038.md): GlobalProtect App: Windows VPN kernel driver denial of service (DoS) (CVSS 5.5, Palo Alto Networks GlobalProtect App)
- [CVE-2021-3037](https://cve.now/CVE-2021-3037.md): PAN-OS: Secrets for scheduled configuration exports are logged in system logs (CVSS 2.3, Palo Alto Networks PAN-OS)
- [CVE-2021-3036](https://cve.now/CVE-2021-3036.md): PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly (CVSS 4.4, Palo Alto Networks PAN-OS)
- [CVE-2021-3035](https://cve.now/CVE-2021-3035.md): Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution (CVSS 6.7, Palo Alto Networks Bridgecrew Checkov)
- [CVE-2021-29155](https://cve.now/CVE-2021-29155.md): An issue was discovered in the Linux kernel through 5.11.x. (no CVSS)
- [CVE-2021-30496](https://cve.now/CVE-2021-30496.md): The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an at (CVSS 5.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.