CVEs published April 21, 2021
40 CVEs were published on April 21, 2021: 2 critical, 3 high.
- Published
- 40
- Critical
- 2
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- NVIDIA GPU Display Driver
- 5
- Jenkins project Jenkins Config File Provider Plugin · org.j…
- 4
- OpenMage magento-lts · openmage/magento-lts
- 2
- authelia · github.com/authelia/authelia/v4
- 1
- IBM i
- 1
- IBM WebSphere Application Server
- 1
- Jenkins project Jenkins CloudBees CD Plugin · org.jenkins-c…
- 1
- Jenkins project Jenkins Templating Engine Plugin · org.jenk…
- 1
- rexml
- 1
- The Eclipse Foundation Eclipse OpenJ9
- 1
Critical 2
High 3
- CVE-2021-1075NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxNVIDIA GPU Display Driver
- CVE-2021-1074NVIDIA GPU Display Driver for Windows installer contains a vulnerability where an attacker with local unprivileged system access may be ableNVIDIA GPU Display Driver
- CVE-2021-20454IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML daIBM WebSphere Application Server
Medium, low and unrated 35
- CVE-2021-1078NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointNVIDIA GPU Display Driver
- CVE-2020-27569Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier.
- CVE-2020-27568Insecure File Permissions exist in Aviatrix Controller 5.3.1516.
- CVE-2020-36324Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json con
- CVE-2020-28973The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface.
- CVE-2021-29456Authelia allows open redirects on the logout endpointauthelia · github.com/authelia/authelia/v4
- CVE-2021-31523The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which al
- CVE-2020-23930An issue was discovered in gpac through 20200801.
- CVE-2020-23931An issue was discovered in gpac before 1.0.1.
- CVE-2020-23932An issue was discovered in gpac before 1.0.1.
- CVE-2020-23907An issue was discovered in retdec v3.3.
- CVE-2020-23912An issue was discovered in Bento4 through v1.6.0-637.
- CVE-2020-23914An issue was discovered in cpp-peglib through v0.1.12.
- CVE-2020-23915An issue was discovered in cpp-peglib through v0.1.12.
- CVE-2020-23921An issue was discovered in fast_ber through v0.4.
- CVE-2020-23922An issue was discovered in giflib through 5.1.4.
- CVE-2020-23928An issue was discovered in gpac before 1.0.1.
- CVE-2021-28167In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain The Eclipse Foundation Eclipse OpenJ9
- CVE-2021-31327Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.
- CVE-2021-31329Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php
- CVE-2021-30139In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.
- CVE-2020-35979An issue was discovered in GPAC version 0.8.0 and 1.0.1.
- CVE-2020-35981An issue was discovered in GPAC version 0.8.0 and 1.0.1.
- CVE-2020-35982An issue was discovered in GPAC version 0.8.0 and 1.0.1.
- CVE-2021-21647Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read peJenkins project Jenkins CloudBees CD Plugin · org.jenkins-c…
- CVE-2021-21646Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackeJenkins project Jenkins Templating Engine Plugin · org.jenk…
- CVE-2021-21645Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/RJenkins project Jenkins Config File Provider Plugin · org.j…
- CVE-2021-21644A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configJenkins project Jenkins Config File Provider Plugin · org.j…
- CVE-2021-21642Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Config File Provider Plugin · org.j…
- CVE-2021-21643Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attacJenkins project Jenkins Config File Provider Plugin · org.j…
- CVE-2021-20501IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, causeIBM i
- CVE-2021-28965The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues.rexml
- CVE-2020-35980An issue was discovered in GPAC version 0.8.0 and 1.0.1.
- CVE-2021-1076NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys or nvidia.ko)NVIDIA GPU Display Driver
- CVE-2021-1077NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability where the software uses a reference cNVIDIA GPU Display Driver