# CVEs published 2021-04-26

68 CVEs were published on April 26, 2021: 3 critical, 5 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-29474](https://cve.now/CVE-2021-29474.md): Relative Path Traversal Attack on note creation (CVSS 4.7, hedgedoc)
- [CVE-2021-22669](https://cve.now/CVE-2021-22669.md): Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and pr (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2021-29475](https://cve.now/CVE-2021-29475.md): PDF export allows arbitrary file reads (CVSS 10.0, hedgedoc)
- [CVE-2021-31646](https://cve.now/CVE-2021-31646.md): Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). (no CVSS)
- [CVE-2021-31783](https://cve.now/CVE-2021-31783.md): show\_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not (no CVSS)
- [CVE-2021-31784](https://cve.now/CVE-2021-31784.md): An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supporte (no CVSS)
- [CVE-2020-36325](https://cve.now/CVE-2020-36325.md): An issue was discovered in Jansson through 2.13.1. (no CVSS)
- [CVE-2021-21225](https://cve.now/CVE-2021-21225.md): Out of bounds memory access in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2021-21226](https://cve.now/CVE-2021-21226.md): Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to po (no CVSS, Google Chrome)
- [CVE-2021-21224](https://cve.now/CVE-2021-21224.md): Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craft (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-21222](https://cve.now/CVE-2021-21222.md): Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to bypa (no CVSS, Google Chrome)
- [CVE-2021-21223](https://cve.now/CVE-2021-21223.md): Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potent (no CVSS, Google Chrome)
- [CVE-2021-29694](https://cve.now/CVE-2021-29694.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h (CVSS 5.9, IBM Spectrum Protect Plus)
- [CVE-2021-29672](https://cve.now/CVE-2021-29672.md): IBM Spectrum Protect Client 8.1.0.0-8 through 1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when (CVSS 8.4, IBM Spectrum Protect for Space Management)
- [CVE-2021-20546](https://cve.now/CVE-2021-20546.md): IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. (CVSS 6.2, IBM Spectrum Protect for Space Management)
- [CVE-2021-20536](https://cve.now/CVE-2021-20536.md): IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a (CVSS 6.2, IBM Spectrum Protect Plus)
- [CVE-2021-20532](https://cve.now/CVE-2021-20532.md): IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the syste (CVSS 7.4, IBM Spectrum Protect for Virtual Environments)
- [CVE-2021-20432](https://cve.now/CVE-2021-20432.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privile (CVSS 6.5, IBM Spectrum Protect Plus)
- [CVE-2020-4562](https://cve.now/CVE-2020-4562.md): IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestr (CVSS 5.3, IBM Planning Analytics)
- [CVE-2021-21221](https://cve.now/CVE-2021-21221.md): Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the (no CVSS, Google Chrome)
- [CVE-2021-21219](https://cve.now/CVE-2021-21219.md): Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2021-21217](https://cve.now/CVE-2021-21217.md): Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2021-21218](https://cve.now/CVE-2021-21218.md): Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2021-21216](https://cve.now/CVE-2021-21216.md): Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted (no CVSS, Google Chrome)
- [CVE-2021-21214](https://cve.now/CVE-2021-21214.md): Use after free in Network API in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-21215](https://cve.now/CVE-2021-21215.md): Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted (no CVSS, Google Chrome)
- [CVE-2021-21213](https://cve.now/CVE-2021-21213.md): Use after free in WebMIDI in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2021-21211](https://cve.now/CVE-2021-21211.md): Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data (no CVSS, Google Chrome)
- [CVE-2021-21212](https://cve.now/CVE-2021-21212.md): Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compr (no CVSS, Google Chrome)
- [CVE-2021-21210](https://cve.now/CVE-2021-21210.md): Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP por (no CVSS, Google Chrome)
- [CVE-2021-21208](https://cve.now/CVE-2021-21208.md): Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform (no CVSS, Google Chrome)
- [CVE-2021-21209](https://cve.now/CVE-2021-21209.md): Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a cra (no CVSS, Google Chrome)
- [CVE-2021-21207](https://cve.now/CVE-2021-21207.md): Use after free in IndexedDB in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-21204](https://cve.now/CVE-2021-21204.md): Use after free in Blink in Google Chrome on OS X prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-21205](https://cve.now/CVE-2021-21205.md): Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation r (no CVSS, Google Chrome)
- [CVE-2021-21203](https://cve.now/CVE-2021-21203.md): Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2021-21201](https://cve.now/CVE-2021-21201.md): Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to p (no CVSS, Google Chrome)
- [CVE-2021-21202](https://cve.now/CVE-2021-21202.md): Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extensio (no CVSS, Google Chrome)
- [CVE-2021-21206](https://cve.now/CVE-2021-21206.md): Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-27851](https://cve.now/CVE-2021-27851.md): Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed' (no CVSS, GNU Guix guix-daemon)
- [CVE-2021-23382](https://cve.now/CVE-2021-23382.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, postcss)
- [CVE-2021-3472](https://cve.now/CVE-2021-3472.md): A flaw was found in xorg-x11-server in versions before 1.20.11. (no CVSS, xorg-x11-server)
- [CVE-2021-3494](https://cve.now/CVE-2021-3494.md): A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle (no CVSS, foreman)
- [CVE-2021-28399](https://cve.now/CVE-2021-28399.md): OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function. (no CVSS)
- [CVE-2021-25839](https://cve.now/CVE-2021-25839.md): A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to e (no CVSS)
- [CVE-2021-25838](https://cve.now/CVE-2021-25838.md): The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload. (no CVSS)
- [CVE-2020-15078](https://cve.now/CVE-2020-15078.md): OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured (no CVSS, OpenVPN)
- [CVE-2021-31802](https://cve.now/CVE-2021-31802.md): NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. (no CVSS)
- [CVE-2021-28079](https://cve.now/CVE-2021-28079.md): Jamovi \<=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-26797](https://cve.now/CVE-2021-26797.md): An access control vulnerability in Hame SD1 Wi-Fi firmware \<=V.20140224154640 allows an attacker to get system administrator through an open (no CVSS)
- [CVE-2021-25928](https://cve.now/CVE-2021-25928.md): Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to (CVSS 9.8, safe-obj)
- [CVE-2021-25927](https://cve.now/CVE-2021-25927.md): Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead t (CVSS 9.8, safe-flat)
- [CVE-2021-23365](https://cve.now/CVE-2021-23365.md): Authentication Bypass (CVSS 4.8, github.com/TykTechnologies/tyk-identity-broker)
- [CVE-2021-31803](https://cve.now/CVE-2021-31803.md): cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). (no CVSS)
- [CVE-2021-31804](https://cve.now/CVE-2021-31804.md): LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document. (no CVSS)
- [CVE-2021-20711](https://cve.now/CVE-2021-20711.md): Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS, NEC Aterm WG2600HS)
- [CVE-2021-20712](https://cve.now/CVE-2021-20712.md): Improper access control vulnerability in NEC Aterm WG2600HS firmware Ver1.5.1 and earlier, and Aterm WX3000HP firmware Ver1.1.2 and earlier (no CVSS, NEC Aterm devices)
- [CVE-2021-20710](https://cve.now/CVE-2021-20710.md): Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an arbitrary script via (no CVSS, NEC Aterm WG2600HS)
- [CVE-2021-20708](https://cve.now/CVE-2021-20708.md): NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware V (no CVSS, NEC Aterm devices)
- [CVE-2021-20709](https://cve.now/CVE-2021-20709.md): Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1 (no CVSS, NEC Aterm devices)
- [CVE-2021-20697](https://cve.now/CVE-2021-20697.md): Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to login to the device (no CVSS, D-Link Japan K.K. DAP-1880AC)
- [CVE-2021-20696](https://cve.now/CVE-2021-20696.md): DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially (no CVSS, D-Link Japan K.K. DAP-1880AC)
- [CVE-2021-20694](https://cve.now/CVE-2021-20694.md): Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to bypass acces (no CVSS, D-Link Japan K.K. DAP-1880AC)
- [CVE-2021-20695](https://cve.now/CVE-2021-20695.md): Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authentic (no CVSS, D-Link Japan K.K. DAP-1880AC)
- [CVE-2021-20693](https://cve.now/CVE-2021-20693.md): Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote (no CVSS, Gurunavi App)
- [CVE-2021-20680](https://cve.now/CVE-2021-20680.md): Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 a (no CVSS, NEC Aterm devices)
- [CVE-2021-21220](https://cve.now/CVE-2021-21220.md): Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit he (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-29473](https://cve.now/CVE-2021-29473.md): Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata (CVSS 2.5, exiv2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.