# CVEs published 2021-04-23

48 CVEs were published on April 23, 2021: 2 critical, 8 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-31791](https://cve.now/CVE-2021-31791.md): In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command. (no CVSS)
- [CVE-2020-7036](https://cve.now/CVE-2020-7036.md): XXE in Avaya Callback Assist Administration (CVSS 8.1, Avaya Callback Assist)
- [CVE-2020-7035](https://cve.now/CVE-2020-7035.md): XXE in Avaya Aura Orchestration Designer (CVSS 8.1, Avaya Aura Orchestration Designer)
- [CVE-2021-31584](https://cve.now/CVE-2021-31584.md): Sipwise C5 NGCP www\_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with adm (no CVSS)
- [CVE-2021-31583](https://cve.now/CVE-2021-31583.md): Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS (no CVSS)
- [CVE-2021-25899](https://cve.now/CVE-2021-25899.md): An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. (no CVSS)
- [CVE-2021-25898](https://cve.now/CVE-2021-25898.md): An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. (no CVSS)
- [CVE-2021-29158](https://cve.now/CVE-2021-29158.md): Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. (no CVSS)
- [CVE-2020-17542](https://cve.now/CVE-2020-17542.md): Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Tas (no CVSS)
- [CVE-2020-7034](https://cve.now/CVE-2020-7034.md): Command injection in Avaya Session Border Controller for Enterprise (CVSS 7.2, Avaya Session Border Controller for Enterprise)
- [CVE-2021-31780](https://cve.now/CVE-2021-31780.md): In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. (no CVSS)
- [CVE-2021-20083](https://cve.now/CVE-2021-20083.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malic (no CVSS, jquery-plugin-query-object · jquery-query-object)
- [CVE-2021-20085](https://cve.now/CVE-2021-20085.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malici (no CVSS, backbone-query-parameters)
- [CVE-2021-20089](https://cve.now/CVE-2021-20089.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject pr (no CVSS, purl)
- [CVE-2021-20086](https://cve.now/CVE-2021-20086.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inj (no CVSS, jquery-bbq)
- [CVE-2021-29469](https://cve.now/CVE-2021-29469.md): Potential exponential regex in monitor mode (CVSS 5.3, NodeRedis node-redis · redis)
- [CVE-2021-20087](https://cve.now/CVE-2021-20087.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to (no CVSS, jquery-deparam)
- [CVE-2021-20088](https://cve.now/CVE-2021-20088.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to (no CVSS, mootools-more)
- [CVE-2021-20084](https://cve.now/CVE-2021-20084.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious us (no CVSS, jQuery Sparkle)
- [CVE-2021-22205](https://cve.now/CVE-2021-22205.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. (CVSS 10.0, KEV, GitLab)
- [CVE-2021-22207](https://cve.now/CVE-2021-22207.md): Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injecti (CVSS 5.5, The Wireshark Foundation Wireshark)
- [CVE-2021-22678](https://cve.now/CVE-2021-22678.md): Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. (no CVSS, Cscape)
- [CVE-2021-22204](https://cve.now/CVE-2021-22204.md): Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing… (CVSS 6.8, KEV, ExifTool)
- [CVE-2021-22682](https://cve.now/CVE-2021-22682.md): Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including rea (no CVSS, Cscape)
- [GHSA-JGPV-4H4C-XHW3](https://cve.now/GHSA-JGPV-4H4C-XHW3.md): Uncontrolled Resource Consumption in pillow (medium (no CVSS), pillow)
- [CVE-2021-22893](https://cve.now/CVE-2021-22893.md): Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browse (CVSS 10.0, KEV, Pulse Connect Secure)
- [CVE-2021-31539](https://cve.now/CVE-2021-31539.md): Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. (no CVSS)
- [CVE-2021-31540](https://cve.now/CVE-2021-31540.md): Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ director (no CVSS)
- [CVE-2021-31410](https://cve.now/CVE-2021-31410.md): Project sources exposure in Vaadin Designer (CVSS 8.6, Vaadin Designer)
- [CVE-2021-31408](https://cve.now/CVE-2021-31408.md): Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 (CVSS 6.3, Vaadin · com.vaadin:vaadin-bom)
- [CVE-2021-31407](https://cve.now/CVE-2021-31407.md): Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 (CVSS 8.6, Vaadin · com.vaadin:flow-server)
- [CVE-2021-31406](https://cve.now/CVE-2021-31406.md): Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 (CVSS 4.0, Vaadin · com.vaadin:flow-server)
- [CVE-2021-31405](https://cve.now/CVE-2021-31405.md): Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 (CVSS 7.5, Vaadin · vaadin-text-field-flow +1)
- [CVE-2021-31404](https://cve.now/CVE-2021-31404.md): Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 (CVSS 4.0, Vaadin · com.vaadin:flow-server)
- [CVE-2021-31403](https://cve.now/CVE-2021-31403.md): Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8 (CVSS 4.0, Vaadin · vaadin-server +2)
- [CVE-2020-36321](https://cve.now/CVE-2020-36321.md): Directory traversal in development mode handler in Vaadin 14 and 15-17 (CVSS 5.9, Vaadin · com.vaadin:flow-server)
- [CVE-2020-36320](https://cve.now/CVE-2020-36320.md): Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 (CVSS 7.5, Vaadin · vaadin-server +2)
- [CVE-2020-36319](https://cve.now/CVE-2020-36319.md): Potential sensitive data exposure in applications using Vaadin 15 (CVSS 3.1, Vaadin · com.vaadin:flow-server)
- [CVE-2019-25028](https://cve.now/CVE-2019-25028.md): Stored cross-site scripting in Grid component in Vaadin 7 and 8 (CVSS 5.4, Vaadin · vaadin-server +2)
- [CVE-2019-25027](https://cve.now/CVE-2019-25027.md): Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 (CVSS 6.1, Vaadin · com.vaadin:flow-server)
- [CVE-2018-25007](https://cve.now/CVE-2018-25007.md): Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 (CVSS 2.6, Vaadin · com.vaadin:flow-server)
- [CVE-2021-26909](https://cve.now/CVE-2021-26909.md): Automox Agent Guessable S3 Bucket Endpoint (CVSS 3.7, Automox Agent)
- [CVE-2021-26908](https://cve.now/CVE-2021-26908.md): Automox Agent Sensitive Log Information Disclosure (CVSS 3.3, Automox Agent)
- [CVE-2020-7385](https://cve.now/CVE-2020-7385.md): Metasploit Framework 'drb\_remote\_codeexec' code execution (CVSS 8.1, Rapid7 Metasploit Framework · metasploit-framework)
- [CVE-2021-25382](https://cve.now/CVE-2021-25382.md): An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contents (CVSS 6.1, Samsung Mobile Devices)
- [CVE-2021-26291](https://cve.now/CVE-2021-26291.md): block repositories using http by default (no CVSS, Apache Software Foundation Apache Maven · org.apache.mav… +1)
- [CVE-2021-29470](https://cve.now/CVE-2021-29470.md): Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header (CVSS 4.7, exiv2)
- [CVE-2021-31607](https://cve.now/CVE-2021-31607.md): In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege esca (no CVSS, salt)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.