# CVEs published 2021-04-28

58 CVEs were published on April 28, 2021: 4 critical, 4 high. Days are UTC.

- [CVE-2020-7038](https://cve.now/CVE-2020-7038.md): Avaya Meetings Server Information Disclosure vulnerability (CVSS 7.5, Avaya Meetings Management)
- [CVE-2020-7037](https://cve.now/CVE-2020-7037.md): Avaya Equinox Conferencing XXE vulnerability (CVSS 8.1, Avaya Meetings Server)
- [CVE-2021-29483](https://cve.now/CVE-2021-29483.md): wikiconfig API leaked private config variables set through ManageWiki (CVSS 9.4, miraheze ManageWiki)
- [CVE-2021-2321](https://cve.now/CVE-2021-2321.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2020-22789](https://cve.now/CVE-2020-22789.md): Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbi (no CVSS)
- [CVE-2020-22790](https://cve.now/CVE-2020-22790.md): Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web sc (no CVSS)
- [CVE-2020-22781](https://cve.now/CVE-2020-22781.md): In Etherpad \< 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash (no CVSS)
- [CVE-2020-22782](https://cve.now/CVE-2020-22782.md): Etherpad \< 1.8.3 is affected by a denial of service in the import functionality. (no CVSS)
- [CVE-2020-22783](https://cve.now/CVE-2020-22783.md): Etherpad \<1.8.3 stored passwords used by users insecurely in the database and in log files. (no CVSS)
- [CVE-2020-22784](https://cve.now/CVE-2020-22784.md): In Etherpad UeberDB \< 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records (no CVSS)
- [CVE-2020-22785](https://cve.now/CVE-2020-22785.md): Etherpad \< 1.8.3 is affected by a missing lock check which could cause a denial of service. (no CVSS)
- [CVE-2021-25165](https://cve.now/CVE-2021-25165.md): A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25164](https://cve.now/CVE-2021-25164.md): A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25152](https://cve.now/CVE-2021-25152.md): A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25153](https://cve.now/CVE-2021-25153.md): A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25154](https://cve.now/CVE-2021-25154.md): A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25151](https://cve.now/CVE-2021-25151.md): A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-29482](https://cve.now/CVE-2021-29482.md): denial of service in github.com/ulikunitz/xz (CVSS 7.5, ulikunitz xz · github.com/ulikunitz/xz)
- [CVE-2021-23364](https://cve.now/CVE-2021-23364.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, browserslist)
- [CVE-2020-17999](https://cve.now/CVE-2020-17999.md): Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP reque (no CVSS)
- [CVE-2020-18022](https://cve.now/CVE-2020-18022.md): Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive informat (no CVSS)
- [CVE-2020-21996](https://cve.now/CVE-2020-21996.md): AVE DOMINAplus \<=1.10.x suffers from an unauthenticated reboot command execution. (no CVSS)
- [CVE-2020-21994](https://cve.now/CVE-2020-21994.md): AVE DOMINAplus \<=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a requ (no CVSS)
- [CVE-2020-21993](https://cve.now/CVE-2020-21993.md): In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the us (no CVSS)
- [CVE-2021-25147](https://cve.now/CVE-2021-25147.md): A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2020-7123](https://cve.now/CVE-2020-7123.md): A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2020-21991](https://cve.now/CVE-2020-21991.md): AVE DOMINAplus \<=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin (no CVSS)
- [CVE-2021-3508](https://cve.now/CVE-2021-3508.md): A flaw was found in PDFResurrect in version 0.22b. (no CVSS, PDFResurrect)
- [CVE-2021-29388](https://cve.now/CVE-2021-29388.md): A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary (no CVSS)
- [CVE-2020-18019](https://cve.now/CVE-2020-18019.md): SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "ty (no CVSS)
- [CVE-2020-18020](https://cve.now/CVE-2020-18020.md): SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user\_phone" p (no CVSS)
- [CVE-2021-29387](https://cve.now/CVE-2021-29387.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject (no CVSS)
- [CVE-2021-29159](https://cve.now/CVE-2021-29159.md): A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. (no CVSS)
- [CVE-2021-22331](https://cve.now/CVE-2021-22331.md): There is a JavaScript injection vulnerability in certain Huawei smartphones. (no CVSS, HUAWEI P30)
- [CVE-2021-22332](https://cve.now/CVE-2021-22332.md): There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2021-22330](https://cve.now/CVE-2021-22330.md): There is an out of bounds write vulnerability in Huawei Smartphone HUAWEI P30 versions 9.1.0.131(C00E130R1P21) when processing a message. (no CVSS, HUAWEI P30)
- [CVE-2021-22393](https://cve.now/CVE-2021-22393.md): There is a denial of service vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2021-22327](https://cve.now/CVE-2021-22327.md): There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. (no CVSS, HUAWEI P30)
- [CVE-2021-22514](https://cve.now/CVE-2021-22514.md): An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51. (no CVSS, Application Performance Management)
- [CVE-2021-30169](https://cve.now/CVE-2021-30169.md): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2 (CVSS 5.3, MERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware)
- [CVE-2021-30168](https://cve.now/CVE-2021-30168.md): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1 (CVSS 9.8, MERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware)
- [CVE-2021-30167](https://cve.now/CVE-2021-30167.md): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication (CVSS 9.8, MERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware)
- [CVE-2021-30166](https://cve.now/CVE-2021-30166.md): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection (CVSS 7.2, MERIT LILIN ENT.CO. P2/Z2/P3/Z3 IP camera firmware)
- [CVE-2021-27648](https://cve.now/CVE-2021-27648.md): Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-280 (CVSS 9.0, Synology Antivirus Essential)
- [CVE-2021-27933](https://cve.now/CVE-2021-27933.md): pfSense 2.5.0 allows XSS via the services\_wol\_edit.php Description field. (no CVSS)
- [CVE-2021-31777](https://cve.now/CVE-2021-31777.md): The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via (no CVSS, t3/dce)
- [CVE-2021-31779](https://cve.now/CVE-2021-31779.md): The yoast\_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account. (no CVSS, yoast-seo-for-typo3/yoast\_seo)
- [CVE-2021-31778](https://cve.now/CVE-2021-31778.md): The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account. (no CVSS, amazing/media2click)
- [CVE-2021-31863](https://cve.now/CVE-2021-31863.md): Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows R (no CVSS)
- [CVE-2021-31864](https://cve.now/CVE-2021-31864.md): Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add\_issue\_notes permission requirement by le (no CVSS)
- [CVE-2021-31865](https://cve.now/CVE-2021-31865.md): Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded atta (no CVSS)
- [CVE-2021-31866](https://cve.now/CVE-2021-31866.md): Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing diffe (no CVSS)
- [CVE-2021-31856](https://cve.now/CVE-2021-31856.md): A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experime (no CVSS)
- [CVE-2020-36326](https://cve.now/CVE-2020-36326.md): PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. (no CVSS, phpmailer/phpmailer)
- [CVE-2021-31815](https://cve.now/CVE-2021-31815.md): GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a use (no CVSS)
- [CVE-2021-3512](https://cve.now/CVE-2021-3512.md): Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 an (no CVSS, Buffalo broadband routers)
- [CVE-2021-3511](https://cve.now/CVE-2021-3511.md): Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior (no CVSS, Buffalo broadband routers)
- [CVE-2021-20716](https://cve.now/CVE-2021-20716.md): Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04 and prior, WBR2-B11 (no CVSS, Buffalo network devices)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.