CVEs published April 23, 2021
48 CVEs were published on April 23, 2021: 2 critical, 8 high. 3 are now in CISA KEV.
- Published
- 48
- Critical
- 2
- High
- 8
- Medium
- 13
- Low
- 4
- Unrated
- 21
- Now in CISA KEV
- 3
- Fix available
- 25
Most affected products
- Vaadin · com.vaadin:flow-server
- 7
- Vaadin · vaadin-server +2
- 3
- Automox Agent
- 2
- Cscape
- 2
- Apache Software Foundation Apache Maven · org.apache.mav… +1
- 1
- Avaya Aura Orchestration Designer
- 1
- Avaya Callback Assist
- 1
- Avaya Session Border Controller for Enterprise
- 1
- backbone-query-parameters
- 1
- ExifTool
- 1
Critical 2
High 8
- CVE-2020-7036XXE in Avaya Callback Assist AdministrationAvaya Callback Assist
- CVE-2020-7035XXE in Avaya Aura Orchestration DesignerAvaya Aura Orchestration Designer
- CVE-2020-7034Command injection in Avaya Session Border Controller for EnterpriseAvaya Session Border Controller for Enterprise
- CVE-2021-31410Project sources exposure in Vaadin DesignerVaadin Designer
- CVE-2021-31407Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19Vaadin · com.vaadin:flow-server
- CVE-2021-31405Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17Vaadin · vaadin-text-field-flow +1
- CVE-2020-36320Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7Vaadin · vaadin-server +2
- CVE-2020-7385Metasploit Framework 'drb_remote_codeexec' code executionRapid7 Metasploit Framework · metasploit-framework
Medium, low and unrated 38
- CVE-2021-31791In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command.
- CVE-2021-31584Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with adm
- CVE-2021-31583Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS
- CVE-2021-25899An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1.
- CVE-2021-25898An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1.
- CVE-2021-29158Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.
- CVE-2020-17542Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Tas
- CVE-2021-31780In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit.
- CVE-2021-20083Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicjquery-plugin-query-object · jquery-query-object
- CVE-2021-20085Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicibackbone-query-parameters
- CVE-2021-20089Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject prpurl
- CVE-2021-20086Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to injjquery-bbq
- CVE-2021-29469Potential exponential regex in monitor modeNodeRedis node-redis · redis
- CVE-2021-20087Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user tojquery-deparam
- CVE-2021-20088Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to mootools-more
- CVE-2021-20084Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious usjQuery Sparkle
- CVE-2021-22207Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injectiThe Wireshark Foundation Wireshark
- CVE-2021-22678Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files.Cscape
- CVE-2021-22204Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing…ExifTool
- CVE-2021-22682Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including reaCscape
- GHSA-JGPV-4H4C-XHW3Uncontrolled Resource Consumption in pillowpillow
- CVE-2021-31539Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file.
- CVE-2021-31540Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ director
- CVE-2021-31408Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19Vaadin · com.vaadin:vaadin-bom
- CVE-2021-31406Timing side channel vulnerability in endpoint request handler in Vaadin 15-19Vaadin · com.vaadin:flow-server
- CVE-2021-31404Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18Vaadin · com.vaadin:flow-server
- CVE-2021-31403Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8Vaadin · vaadin-server +2
- CVE-2020-36321Directory traversal in development mode handler in Vaadin 14 and 15-17Vaadin · com.vaadin:flow-server
- CVE-2020-36319Potential sensitive data exposure in applications using Vaadin 15Vaadin · com.vaadin:flow-server
- CVE-2019-25028Stored cross-site scripting in Grid component in Vaadin 7 and 8Vaadin · vaadin-server +2
- CVE-2019-25027Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13Vaadin · com.vaadin:flow-server
- CVE-2018-25007Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11Vaadin · com.vaadin:flow-server
- CVE-2021-26909Automox Agent Guessable S3 Bucket EndpointAutomox Agent
- CVE-2021-26908Automox Agent Sensitive Log Information DisclosureAutomox Agent
- CVE-2021-25382An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contentsSamsung Mobile Devices
- CVE-2021-26291block repositories using http by defaultApache Software Foundation Apache Maven · org.apache.mav… +1
- CVE-2021-29470Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Headerexiv2
- CVE-2021-31607In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escasalt