# CVEs published 2021-04-27

50 CVEs were published on April 27, 2021: 1 critical, 7 high. Days are UTC.

- [CVE-2021-29476](https://cve.now/CVE-2021-29476.md): Insecure Deserialization of untrusted data in rmccue/requests (CVSS 9.8, WordPress Requests · rmccue/requests)
- [CVE-2021-29472](https://cve.now/CVE-2021-29472.md): Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer (CVSS 8.8, composer · composer/composer)
- [CVE-2021-29441](https://cve.now/CVE-2021-29441.md): Authentication bypass (CVSS 8.6, alibaba nacos · com.alibaba.nacos:nacos-common)
- [CVE-2021-29442](https://cve.now/CVE-2021-29442.md): Authentication bypass (CVSS 8.6, alibaba nacos · com.alibaba.nacos:nacos-common)
- [CVE-2021-29460](https://cve.now/CVE-2021-29460.md): Cross-site scripting (XSS) from unsanitized uploaded SVG files (CVSS 7.6, getkirby kirby · getkirby/cms)
- [CVE-2021-21429](https://cve.now/CVE-2021-21429.md): Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin (CVSS 4.0, OpenAPITools openapi-generator · org.openapitools:openapi-g…)
- [CVE-2021-30128](https://cve.now/CVE-2021-30128.md): Unsafe deserialization in Apache OFBiz (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2021-29200](https://cve.now/CVE-2021-29200.md): RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2021-21365](https://cve.now/CVE-2021-21365.md): Cross-Site Scripting in Content Rendering (CVSS 5.4, benjaminkott bootstrap\_package · bk2k/bootstrap-package)
- [CVE-2021-30638](https://cve.now/CVE-2021-30638.md): An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later (no CVSS, Apache Software Foundation Apache Tapestry · org.apache.tap…)
- [CVE-2020-22001](https://cve.now/CVE-2020-22001.md): HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header wi (no CVSS)
- [CVE-2020-22000](https://cve.now/CVE-2020-22000.md): HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. (no CVSS)
- [CVE-2020-21998](https://cve.now/CVE-2020-21998.md): In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redi (no CVSS)
- [CVE-2020-21989](https://cve.now/CVE-2020-21989.md): HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2020-21987](https://cve.now/CVE-2020-21987.md): HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). (no CVSS)
- [CVE-2021-29667](https://cve.now/CVE-2021-29667.md): IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. (CVSS 7.0, IBM Spectrum Scale)
- [CVE-2021-29666](https://cve.now/CVE-2021-29666.md): IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Spectrum Scale)
- [CVE-2021-20550](https://cve.now/CVE-2021-20550.md): IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. (CVSS 5.4, IBM Content Navigator)
- [CVE-2021-20549](https://cve.now/CVE-2021-20549.md): IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. (CVSS 5.4, IBM Content Navigator)
- [CVE-2021-20448](https://cve.now/CVE-2021-20448.md): IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. (CVSS 5.4, IBM Content Navigator)
- [CVE-2020-4981](https://cve.now/CVE-2020-4981.md): IBM Spectrum Scale 5.0.4.1 through 5.1.0.3 could allow a local privileged user to overwrite files due to improper input validation. (CVSS 4.4, IBM Spectrum Scale)
- [CVE-2021-3451](https://cve.now/CVE-2021-3451.md): A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to b (CVSS 5.5, Lenovo PCManager)
- [CVE-2021-3464](https://cve.now/CVE-2021-3464.md): A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privilege escalation. (CVSS 7.8, Lenovo PCManager)
- [CVE-2021-28269](https://cve.now/CVE-2021-28269.md): Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permis (no CVSS)
- [CVE-2021-30642](https://cve.now/CVE-2021-30642.md): An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8. (no CVSS, Symantec Security Analytics)
- [CVE-2021-28271](https://cve.now/CVE-2021-28271.md): Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to (no CVSS)
- [CVE-2021-22664](https://cve.now/CVE-2021-22664.md): CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code. (no CVSS, Delta Electronics CNCSoft-B)
- [CVE-2021-22660](https://cve.now/CVE-2021-22660.md): CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code. (no CVSS, Delta Electronics CNCSoft-B)
- [CVE-2021-27480](https://cve.now/CVE-2021-27480.md): Delta Industrial Automation COMMGR Versions 1.12 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to e (no CVSS, Delta Industrial Automation COMMGR)
- [CVE-2020-35542](https://cve.now/CVE-2020-35542.md): Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field. (no CVSS)
- [CVE-2021-28125](https://cve.now/CVE-2021-28125.md): Apache Superset Open Redirect (no CVSS, Apache Software Foundation Apache Superset · superset +1)
- [CVE-2020-17517](https://cve.now/CVE-2020-17517.md): Ozone S3 Gateway allows bucket and key access to non authenticated users (no CVSS, Apache Software Foundation Apache Ozone)
- [CVE-2021-20714](https://cve.now/CVE-2021-20714.md): Directory traversal vulnerability in WP Fastest Cache versions prior to 0.9.1.7 allows a remote attacker with administrator privileges to de (no CVSS, Emre Vona WP Fastest Cache)
- [CVE-2021-20715](https://cve.now/CVE-2021-20715.md): Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier all (no CVSS, Recruit Co. Hot Pepper Gourmet App)
- [CVE-2019-25031](https://cve.now/CVE-2019-25031.md): Unbound before 1.9.5 allows configuration injection in create\_unbound\_ad\_servers.sh upon a successful man-in-the-middle attack against a cle (no CVSS)
- [CVE-2019-25032](https://cve.now/CVE-2019-25032.md): Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional\_alloc. (no CVSS)
- [CVE-2019-25033](https://cve.now/CVE-2019-25033.md): Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN\_UP macro. (no CVSS)
- [CVE-2019-25034](https://cve.now/CVE-2019-25034.md): Unbound before 1.9.5 allows an integer overflow in sldns\_str2wire\_dname\_buf\_origin, leading to an out-of-bounds write. (no CVSS)
- [CVE-2019-25035](https://cve.now/CVE-2019-25035.md): Unbound before 1.9.5 allows an out-of-bounds write in sldns\_bget\_token\_par. (no CVSS)
- [CVE-2019-25036](https://cve.now/CVE-2019-25036.md): Unbound before 1.9.5 allows an assertion failure and denial of service in synth\_cname. (no CVSS)
- [CVE-2019-25037](https://cve.now/CVE-2019-25037.md): Unbound before 1.9.5 allows an assertion failure and denial of service in dname\_pkt\_copy via an invalid packet. (no CVSS)
- [CVE-2019-25038](https://cve.now/CVE-2019-25038.md): Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. (no CVSS)
- [CVE-2019-25039](https://cve.now/CVE-2019-25039.md): Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. (no CVSS)
- [CVE-2019-25040](https://cve.now/CVE-2019-25040.md): Unbound before 1.9.5 allows an infinite loop via a compressed name in dname\_pkt\_copy. (no CVSS)
- [CVE-2019-25041](https://cve.now/CVE-2019-25041.md): Unbound before 1.9.5 allows an assertion failure via a compressed name in dname\_pkt\_copy. (no CVSS)
- [CVE-2019-25042](https://cve.now/CVE-2019-25042.md): Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata\_copy. (no CVSS)
- [CVE-2021-31826](https://cve.now/CVE-2021-31826.md): Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. (no CVSS)
- [CVE-2021-30165](https://cve.now/CVE-2021-30165.md): EDIMAX Technology Co., Ltd. HD Wireless Day & Night Network Camera IC-3140W - Hard-coded password (CVSS 7.5, EDIMAX Technology Co. IC-3140W)
- [CVE-2021-30635](https://cve.now/CVE-2021-30635.md): Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-relat (no CVSS)
- [CVE-2021-31671](https://cve.now/CVE-2021-31671.md): pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. (no CVSS, pgsync)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.