CVEs published April 27, 2021
50 CVEs were published on April 27, 2021: 1 critical, 7 high.
- Published
- 50
- Critical
- 1
- High
- 7
- Medium
- 8
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- IBM Content Navigator
- 3
- IBM Spectrum Scale
- 3
- alibaba nacos · com.alibaba.nacos:nacos-common
- 2
- Apache Software Foundation Apache OFBiz
- 2
- Delta Electronics CNCSoft-B
- 2
- Lenovo PCManager
- 2
- Apache Software Foundation Apache Ozone
- 1
- Apache Software Foundation Apache Superset · superset +1
- 1
- Apache Software Foundation Apache Tapestry · org.apache.tap…
- 1
- benjaminkott bootstrap_package · bk2k/bootstrap-package
- 1
Critical 1
High 7
- CVE-2021-29472Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composercomposer · composer/composer
- CVE-2021-29441Authentication bypassalibaba nacos · com.alibaba.nacos:nacos-common
- CVE-2021-29442Authentication bypassalibaba nacos · com.alibaba.nacos:nacos-common
- CVE-2021-29460Cross-site scripting (XSS) from unsanitized uploaded SVG filesgetkirby kirby · getkirby/cms
- CVE-2021-29667IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection.IBM Spectrum Scale
- CVE-2021-3464A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privilege escalation.Lenovo PCManager
- CVE-2021-30165EDIMAX Technology Co., Ltd. HD Wireless Day & Night Network Camera IC-3140W - Hard-coded passwordEDIMAX Technology Co. IC-3140W
Medium, low and unrated 42
- CVE-2021-21429Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven pluginOpenAPITools openapi-generator · org.openapitools:openapi-g…
- CVE-2021-30128Unsafe deserialization in Apache OFBizApache Software Foundation Apache OFBiz
- CVE-2021-29200RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMIApache Software Foundation Apache OFBiz
- CVE-2021-21365Cross-Site Scripting in Content Renderingbenjaminkott bootstrap_package · bk2k/bootstrap-package
- CVE-2021-30638An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and laterApache Software Foundation Apache Tapestry · org.apache.tap…
- CVE-2020-22001HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header wi
- CVE-2020-22000HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin.
- CVE-2020-21998In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redi
- CVE-2020-21989HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF).
- CVE-2020-21987HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS).
- CVE-2021-29666IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting.IBM Spectrum Scale
- CVE-2021-20550IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting.IBM Content Navigator
- CVE-2021-20549IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting.IBM Content Navigator
- CVE-2021-20448IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting.IBM Content Navigator
- CVE-2020-4981IBM Spectrum Scale 5.0.4.1 through 5.1.0.3 could allow a local privileged user to overwrite files due to improper input validation.IBM Spectrum Scale
- CVE-2021-3451A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to bLenovo PCManager
- CVE-2021-28269Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permis
- CVE-2021-30642An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.Symantec Security Analytics
- CVE-2021-28271Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to
- CVE-2021-22664CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.Delta Electronics CNCSoft-B
- CVE-2021-22660CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.Delta Electronics CNCSoft-B
- CVE-2021-27480Delta Industrial Automation COMMGR Versions 1.12 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to eDelta Industrial Automation COMMGR
- CVE-2020-35542Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field.
- CVE-2021-28125Apache Superset Open RedirectApache Software Foundation Apache Superset · superset +1
- CVE-2020-17517Ozone S3 Gateway allows bucket and key access to non authenticated usersApache Software Foundation Apache Ozone
- CVE-2021-20714Directory traversal vulnerability in WP Fastest Cache versions prior to 0.9.1.7 allows a remote attacker with administrator privileges to deEmre Vona WP Fastest Cache
- CVE-2021-20715Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier allRecruit Co. Hot Pepper Gourmet App
- CVE-2019-25031Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cle
- CVE-2019-25032Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc.
- CVE-2019-25033Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro.
- CVE-2019-25034Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write.
- CVE-2019-25035Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.
- CVE-2019-25036Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname.
- CVE-2019-25037Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet.
- CVE-2019-25038Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c.
- CVE-2019-25039Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c.
- CVE-2019-25040Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy.
- CVE-2019-25041Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy.
- CVE-2019-25042Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy.
- CVE-2021-31826Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature.
- CVE-2021-30635Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-relat
- CVE-2021-31671pgsync before 0.6.7 is affected by Information Disclosure of sensitive information.pgsync