CVEs published April 28, 2021
58 CVEs were published on April 28, 2021: 4 critical, 4 high.
- Published
- 58
- Critical
- 4
- High
- 4
- Medium
- 3
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Aruba AirWave Management Platform
- 7
- MERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware
- 4
- HUAWEI P30
- 3
- Buffalo broadband routers
- 2
- CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- 2
- amazing/media2click
- 1
- Application Performance Management
- 1
- Aruba ClearPass Policy Manager
- 1
- Avaya Meetings Management
- 1
- Avaya Meetings Server
- 1
Critical 4
- CVE-2021-29483wikiconfig API leaked private config variables set through ManageWikimiraheze ManageWiki
- CVE-2021-30168MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1MERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware
- CVE-2021-30167MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken AuthenticationMERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware
- CVE-2021-27648Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-280Synology Antivirus Essential
High 4
- CVE-2020-7038Avaya Meetings Server Information Disclosure vulnerabilityAvaya Meetings Management
- CVE-2020-7037Avaya Equinox Conferencing XXE vulnerabilityAvaya Meetings Server
- CVE-2021-29482denial of service in github.com/ulikunitz/xzulikunitz xz · github.com/ulikunitz/xz
- CVE-2021-30166MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command InjectionMERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware
Medium, low and unrated 50
- CVE-2021-2321Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2020-22789Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbi
- CVE-2020-22790Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web sc
- CVE-2020-22781In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash
- CVE-2020-22782Etherpad < 1.8.3 is affected by a denial of service in the import functionality.
- CVE-2020-22783Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files.
- CVE-2020-22784In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records
- CVE-2020-22785Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service.
- CVE-2021-25165A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25164A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25152A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25153A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25154A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25151A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-23364Regular Expression Denial of Service (ReDoS)browserslist
- CVE-2020-17999Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP reque
- CVE-2020-18022Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive informat
- CVE-2020-21996AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution.
- CVE-2020-21994AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a requ
- CVE-2020-21993In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the us
- CVE-2021-25147A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2020-7123A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1.Aruba ClearPass Policy Manager
- CVE-2020-21991AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin
- CVE-2021-3508A flaw was found in PDFResurrect in version 0.22b.PDFResurrect
- CVE-2021-29388A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary
- CVE-2020-18019SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "ty
- CVE-2020-18020SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" p
- CVE-2021-29387Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject
- CVE-2021-29159A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1.
- CVE-2021-22331There is a JavaScript injection vulnerability in certain Huawei smartphones.HUAWEI P30
- CVE-2021-22332There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2021-22330There is an out of bounds write vulnerability in Huawei Smartphone HUAWEI P30 versions 9.1.0.131(C00E130R1P21) when processing a message.HUAWEI P30
- CVE-2021-22393There is a denial of service vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2021-22327There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing.HUAWEI P30
- CVE-2021-22514An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51.Application Performance Management
- CVE-2021-30169MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2MERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware
- CVE-2021-27933pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.
- CVE-2021-31777The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection viat3/dce
- CVE-2021-31779The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.yoast-seo-for-typo3/yoast_seo
- CVE-2021-31778The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.amazing/media2click
- CVE-2021-31863Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows R
- CVE-2021-31864Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by le
- CVE-2021-31865Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded atta
- CVE-2021-31866Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing diffe
- CVE-2021-31856A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experime
- CVE-2020-36326PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.phpmailer/phpmailer
- CVE-2021-31815GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a use
- CVE-2021-3512Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 anBuffalo broadband routers
- CVE-2021-3511Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and priorBuffalo broadband routers
- CVE-2021-20716Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04 and prior, WBR2-B11 Buffalo network devices