CVEs published April 29, 2021
113 CVEs were published on April 29, 2021: 2 critical, 35 high. 1 is now in CISA KEV.
- Published
- 113
- Critical
- 2
- High
- 35
- Medium
- 21
- Low
- 1
- Unrated
- 54
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- Parallels Desktop
- 16
- Aruba ClearPass Policy Manager
- 9
- NVIDIA Virtual GPU Software
- 8
- Cisco Adaptive Security Appliance (ASA) Software
- 6
- Cisco Firepower Threat Defense Software
- 6
- Foxit Studio Photo
- 6
- Cisco Firepower Management Center
- 5
- Aruba AirWave Management Platform
- 4
- Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3
- 3
- ISC BIND9
- 3
Critical 2
- CVE-2021-27651In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authenticaPegasystems Pega Infinity
- CVE-2021-20090A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3
High 35
- CVE-2021-29468Arbitrary code execution when checking out an attacker-controlled Git branchme-and Cygwin-Git
- CVE-2021-1086NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resourceNVIDIA Virtual GPU Software
- CVE-2021-1084NVIDIA vGPU driver contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length NVIDIA Virtual GPU Software
- CVE-2021-1085NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to write to a shared memoNVIDIA Virtual GPU Software
- CVE-2021-1083NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input lengtNVIDIA Virtual GPU Software
- CVE-2021-1081NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU manager (vGPU plugin), in which an input lengtNVIDIA Virtual GPU Software
- CVE-2021-1082NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which mayNVIDIA Virtual GPU Software
- CVE-2021-1080NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which certain input data is not validated, which NVIDIA Virtual GPU Software
- CVE-2021-1504Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services VPN Denial of Service VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-1501Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software SIP Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-1493Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-1448Cisco Firepower Threat Defense Software Command Injection VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-1445Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services VPN Denial of Service VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-21388Command Injection Vulnerability in systeminformationsebhildebrandt systeminformation · systeminformation
- CVE-2021-1402Cisco Firepower Threat Defense Software SSL Decryption Policy Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-21417Use after free in fluidsynthfluidsynth
- CVE-2021-21415Visual Studio Code Prisma Extension Remote Code Execution Vulnerabilityprisma language-tools
- CVE-2021-31437This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931.Foxit Studio Photo
- CVE-2021-31438This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931.Foxit Studio Photo
- CVE-2021-31435This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931.Foxit Studio Photo
- CVE-2021-31436This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931.Foxit Studio Photo
- CVE-2021-31434This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931.Foxit Studio Photo
- CVE-2021-31433This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931.Foxit Studio Photo
- CVE-2021-31428This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31429This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31427This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31426This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151.Parallels Desktop
- CVE-2021-31424This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31425This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151.Parallels Desktop
- CVE-2021-31422This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141.Parallels Desktop
- CVE-2021-31420This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950.Parallels Desktop
- CVE-2021-25216A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackISC BIND9
- CVE-2021-25215An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itselfISC BIND9
- CVE-2021-21414Command injection vulnerability in @prisma/sdk in getPackedPackage functionprisma · @prisma/sdk
- CVE-2020-15225Denial of Service vulnerability in django-filtercarltongibson django-filter · django-filter
Medium, low and unrated 76
- CVE-2020-18070Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()"
- CVE-2020-18035Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNu
- CVE-2021-29484DOM XSS in Theme PreviewTryGhost Ghost · ghost
- CVE-2021-1087NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), which could allow an attacker to retrieve information NVIDIA Virtual GPU Software
- CVE-2020-22808An issue was found in yii2_fecshop 2.x.
- CVE-2020-22807An issue was dicovered in vtiger crm 7.2.
- CVE-2021-1495Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-1489Cisco Firepower Device Manager Software Filesystem Space Exhaustion Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-1488Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-1477Cisco Firepower Management Center Software Policy VulnerabilityCisco Firepower Management Center
- CVE-2021-1476Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Command Injection VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-1458Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesCisco Firepower Management Center
- CVE-2021-1457Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesCisco Firepower Management Center
- CVE-2021-1456Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesCisco Firepower Management Center
- CVE-2021-1455Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesCisco Firepower Management Center
- CVE-2021-1369Cisco Firepower Device Manager On-Box Software XML External Entity VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-1256Cisco Firepower Threat Defense Software Command File Overwrite VulnerabilityCisco Firepower Threat Defense Software
- CVE-2020-18032Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code
- CVE-2020-21101Cross Site Scriptiong vulnerabilityin Screenly screenly-ose all versions, including v1.8.2 (2019-09-25-Screenly-OSE-lite.img), in the 'Add A
- CVE-2021-31431This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31432This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31430This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31423This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309.Parallels Desktop
- CVE-2021-31421This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141.Parallels Desktop
- CVE-2021-31418This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270.Parallels Desktop
- CVE-2021-31419This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270.Parallels Desktop
- CVE-2021-31417This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270.Parallels Desktop
- CVE-2020-21452An issue was discovered in uniview ISC2500-S.
- CVE-2020-35430SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu v2.0.6 via the ids parameter to admin/letter/delsyst
- CVE-2021-30048Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allow
- CVE-2021-30234The api/ZRIGMP/set_MLD_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands vi
- CVE-2021-25811MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter.
- CVE-2021-25812Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_cli
- CVE-2021-30228The api/ZRAndlink/set_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands
- CVE-2021-30229The api/zrDm/set_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell
- CVE-2021-30230The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary command
- CVE-2021-30231The api/zrDm/set_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via sh
- CVE-2021-30232The api/ZRIGMP/set_IGMP_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands v
- CVE-2021-30233The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via
- CVE-2021-25810Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end
- CVE-2021-20228A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature whenansible
- CVE-2021-29350SQL injection in the getip function in conn/function.php in 发货100-设计素材下载系统 1.1 allows remote attackers to inject arbitrary SQL commands via
- CVE-2021-30227Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
- CVE-2021-28280CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script o
- CVE-2021-30224Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials.
- CVE-2021-30027md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malform
- CVE-2021-30218samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
- CVE-2021-30219samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
- CVE-2021-20092The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict acceBuffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3
- CVE-2021-20091The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize userBuffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3
- CVE-2020-22002An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the Ge
- CVE-2020-21997Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability.
- CVE-2020-21995Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials.
- CVE-2021-28899Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDema
- CVE-2020-21992Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability.
- CVE-2020-21990Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to imp
- CVE-2021-29141A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9Aruba ClearPass Policy Manager
- CVE-2021-29139A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-Aruba ClearPass Policy Manager
- CVE-2021-29138A remote disclosure of privileged information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.Aruba ClearPass Policy Manager
- CVE-2021-29140A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14-Aruba ClearPass Policy Manager
- CVE-2021-29142A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-Aruba ClearPass Policy Manager
- CVE-2021-29147A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14Aruba ClearPass Policy Manager
- CVE-2021-29144A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9Aruba ClearPass Policy Manager
- CVE-2021-29145A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) Aruba ClearPass Policy Manager
- CVE-2021-29146A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-Aruba ClearPass Policy Manager
- CVE-2021-29137A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25167A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25166A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-25163A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.Aruba AirWave Management Platform
- CVE-2021-31879GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
- CVE-2020-36327Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which bundler
- CVE-2021-25214A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedlyISC BIND9
- CVE-2021-21391Regular expression Denial of Service in multiple packagesckeditor5 · @ckeditor/ckeditor5-engine +7
- CVE-2021-31776Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the
- CVE-2021-20294A flaw was found in binutils readelf 2.35 program.binutils
- CVE-2021-31875In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_j