# CVEs published 2021-04-21

40 CVEs were published on April 21, 2021: 2 critical, 3 high. Days are UTC.

- [CVE-2021-1078](https://cve.now/CVE-2021-1078.md): NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL point (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2021-1075](https://cve.now/CVE-2021-1075.md): NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dx (CVSS 7.3, NVIDIA GPU Display Driver)
- [CVE-2021-1074](https://cve.now/CVE-2021-1074.md): NVIDIA GPU Display Driver for Windows installer contains a vulnerability where an attacker with local unprivileged system access may be able (CVSS 7.3, NVIDIA GPU Display Driver)
- [CVE-2020-27569](https://cve.now/CVE-2020-27569.md): Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. (no CVSS)
- [CVE-2020-27568](https://cve.now/CVE-2020-27568.md): Insecure File Permissions exist in Aviatrix Controller 5.3.1516. (no CVSS)
- [CVE-2021-21427](https://cve.now/CVE-2021-21427.md): Backport for CVE-2021-21024 Blind SQLi from Magento 2 (CVSS 9.1, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2021-21426](https://cve.now/CVE-2021-21426.md): Fixes a bug in Zend Framework's Stream HTTP Wrapper (CVSS 9.8, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2020-36324](https://cve.now/CVE-2020-36324.md): Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json con (no CVSS)
- [CVE-2020-28973](https://cve.now/CVE-2020-28973.md): The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. (no CVSS)
- [CVE-2021-29456](https://cve.now/CVE-2021-29456.md): Authelia allows open redirects on the logout endpoint (CVSS 5.7, authelia · github.com/authelia/authelia/v4)
- [CVE-2021-31523](https://cve.now/CVE-2021-31523.md): The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap\_net\_raw enabled for the /usr/libexec/xscreensaver/sonar file, which al (no CVSS)
- [CVE-2020-23930](https://cve.now/CVE-2020-23930.md): An issue was discovered in gpac through 20200801. (no CVSS)
- [CVE-2020-23931](https://cve.now/CVE-2020-23931.md): An issue was discovered in gpac before 1.0.1. (no CVSS)
- [CVE-2020-23932](https://cve.now/CVE-2020-23932.md): An issue was discovered in gpac before 1.0.1. (no CVSS)
- [CVE-2020-23907](https://cve.now/CVE-2020-23907.md): An issue was discovered in retdec v3.3. (no CVSS)
- [CVE-2020-23912](https://cve.now/CVE-2020-23912.md): An issue was discovered in Bento4 through v1.6.0-637. (no CVSS)
- [CVE-2020-23914](https://cve.now/CVE-2020-23914.md): An issue was discovered in cpp-peglib through v0.1.12. (no CVSS)
- [CVE-2020-23915](https://cve.now/CVE-2020-23915.md): An issue was discovered in cpp-peglib through v0.1.12. (no CVSS)
- [CVE-2020-23921](https://cve.now/CVE-2020-23921.md): An issue was discovered in fast\_ber through v0.4. (no CVSS)
- [CVE-2020-23922](https://cve.now/CVE-2020-23922.md): An issue was discovered in giflib through 5.1.4. (no CVSS)
- [CVE-2020-23928](https://cve.now/CVE-2020-23928.md): An issue was discovered in gpac before 1.0.1. (no CVSS)
- [CVE-2021-28167](https://cve.now/CVE-2021-28167.md): In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain (no CVSS, The Eclipse Foundation Eclipse OpenJ9)
- [CVE-2021-31327](https://cve.now/CVE-2021-31327.md): Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field. (no CVSS)
- [CVE-2021-31329](https://cve.now/CVE-2021-31329.md): Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php (no CVSS)
- [CVE-2021-30139](https://cve.now/CVE-2021-30139.md): In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash. (no CVSS)
- [CVE-2020-35979](https://cve.now/CVE-2020-35979.md): An issue was discovered in GPAC version 0.8.0 and 1.0.1. (no CVSS)
- [CVE-2020-35981](https://cve.now/CVE-2020-35981.md): An issue was discovered in GPAC version 0.8.0 and 1.0.1. (no CVSS)
- [CVE-2020-35982](https://cve.now/CVE-2020-35982.md): An issue was discovered in GPAC version 0.8.0 and 1.0.1. (no CVSS)
- [CVE-2021-21647](https://cve.now/CVE-2021-21647.md): Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read pe (no CVSS, Jenkins project Jenkins CloudBees CD Plugin · org.jenkins-c…)
- [CVE-2021-21646](https://cve.now/CVE-2021-21646.md): Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attacke (no CVSS, Jenkins project Jenkins Templating Engine Plugin · org.jenk…)
- [CVE-2021-21645](https://cve.now/CVE-2021-21645.md): Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/R (no CVSS, Jenkins project Jenkins Config File Provider Plugin · org.j…)
- [CVE-2021-21644](https://cve.now/CVE-2021-21644.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete config (no CVSS, Jenkins project Jenkins Config File Provider Plugin · org.j…)
- [CVE-2021-21642](https://cve.now/CVE-2021-21642.md): Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Config File Provider Plugin · org.j…)
- [CVE-2021-21643](https://cve.now/CVE-2021-21643.md): Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attac (no CVSS, Jenkins project Jenkins Config File Provider Plugin · org.j…)
- [CVE-2021-20501](https://cve.now/CVE-2021-20501.md): IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, cause (CVSS 5.9, IBM i)
- [CVE-2021-20454](https://cve.now/CVE-2021-20454.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML da (CVSS 8.2, IBM WebSphere Application Server)
- [CVE-2021-28965](https://cve.now/CVE-2021-28965.md): The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. (no CVSS, rexml)
- [CVE-2020-35980](https://cve.now/CVE-2020-35980.md): An issue was discovered in GPAC version 0.8.0 and 1.0.1. (no CVSS)
- [CVE-2021-1076](https://cve.now/CVE-2021-1076.md): NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys or nvidia.ko) (CVSS 6.6, NVIDIA GPU Display Driver)
- [CVE-2021-1077](https://cve.now/CVE-2021-1077.md): NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability where the software uses a reference c (CVSS 6.6, NVIDIA GPU Display Driver)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.