CVEs published April 26, 2021
68 CVEs were published on April 26, 2021: 3 critical, 5 high. 3 are now in CISA KEV.
- Published
- 68
- Critical
- 3
- High
- 5
- Medium
- 8
- Low
- 1
- Unrated
- 51
- Now in CISA KEV
- 3
- Fix available
- 33
Most affected products
- Google Chrome
- 26
- D-Link Japan K.K. DAP-1880AC
- 4
- NEC Aterm devices
- 4
- IBM Spectrum Protect Plus
- 3
- hedgedoc
- 2
- IBM Spectrum Protect for Space Management
- 2
- NEC Aterm WG2600HS
- 2
- Advantech WebAccess/SCADA
- 1
- exiv2
- 1
- foreman
- 1
Critical 3
- CVE-2021-29475PDF export allows arbitrary file readshedgedoc
- CVE-2021-25928Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead tosafe-obj
- CVE-2021-25927Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead tsafe-flat
High 5
- CVE-2021-21224Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftGoogle Chrome
- CVE-2021-29672IBM Spectrum Protect Client 8.1.0.0-8 through 1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking whenIBM Spectrum Protect for Space Management
- CVE-2021-20532IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the systeIBM Spectrum Protect for Virtual Environments
- CVE-2021-21206Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-21220Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heGoogle Chrome
Medium, low and unrated 60
- CVE-2021-29474Relative Path Traversal Attack on note creationhedgedoc
- CVE-2021-22669Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prAdvantech WebAccess/SCADA
- CVE-2021-31646Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote).
- CVE-2021-31783show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not
- CVE-2021-31784An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supporte
- CVE-2020-36325An issue was discovered in Jansson through 2.13.1.
- CVE-2021-21225Out of bounds memory access in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2021-21226Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2021-21222Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to bypaGoogle Chrome
- CVE-2021-21223Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2021-29694IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hIBM Spectrum Protect Plus
- CVE-2021-20546IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.IBM Spectrum Protect for Space Management
- CVE-2021-20536IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by aIBM Spectrum Protect Plus
- CVE-2021-20432IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileIBM Spectrum Protect Plus
- CVE-2020-4562IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestrIBM Planning Analytics
- CVE-2021-21221Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the Google Chrome
- CVE-2021-21219Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2021-21217Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2021-21218Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2021-21216Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a craftedGoogle Chrome
- CVE-2021-21214Use after free in Network API in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2021-21215Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a craftedGoogle Chrome
- CVE-2021-21213Use after free in WebMIDI in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2021-21211Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin dataGoogle Chrome
- CVE-2021-21212Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially comprGoogle Chrome
- CVE-2021-21210Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP porGoogle Chrome
- CVE-2021-21208Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to performGoogle Chrome
- CVE-2021-21209Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2021-21207Use after free in IndexedDB in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2021-21204Use after free in Blink in Google Chrome on OS X prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2021-21205Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation rGoogle Chrome
- CVE-2021-21203Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2021-21201Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2021-21202Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extensioGoogle Chrome
- CVE-2021-27851Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'GNU Guix guix-daemon
- CVE-2021-23382Regular Expression Denial of Service (ReDoS)postcss
- CVE-2021-3472A flaw was found in xorg-x11-server in versions before 1.20.11.xorg-x11-server
- CVE-2021-3494A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle foreman
- CVE-2021-28399OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.
- CVE-2021-25839A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to e
- CVE-2021-25838The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload.
- CVE-2020-15078OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured OpenVPN
- CVE-2021-31802NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication.
- CVE-2021-28079Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability.
- CVE-2021-26797An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open
- CVE-2021-23365Authentication Bypassgithub.com/TykTechnologies/tyk-identity-broker
- CVE-2021-31803cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
- CVE-2021-31804LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document.
- CVE-2021-20711Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.NEC Aterm WG2600HS
- CVE-2021-20712Improper access control vulnerability in NEC Aterm WG2600HS firmware Ver1.5.1 and earlier, and Aterm WX3000HP firmware Ver1.1.2 and earlier NEC Aterm devices
- CVE-2021-20710Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an arbitrary script viaNEC Aterm WG2600HS
- CVE-2021-20708NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware VNEC Aterm devices
- CVE-2021-20709Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1NEC Aterm devices
- CVE-2021-20697Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to login to the deviceD-Link Japan K.K. DAP-1880AC
- CVE-2021-20696DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially D-Link Japan K.K. DAP-1880AC
- CVE-2021-20694Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to bypass accesD-Link Japan K.K. DAP-1880AC
- CVE-2021-20695Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticD-Link Japan K.K. DAP-1880AC
- CVE-2021-20693Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remoteGurunavi App
- CVE-2021-20680Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 aNEC Aterm devices
- CVE-2021-29473Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadataexiv2