# CVEs published 2021-04-29

113 CVEs were published on April 29, 2021: 2 critical, 35 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-18070](https://cve.now/CVE-2020-18070.md): Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do\_del()" (no CVSS)
- [CVE-2020-18035](https://cve.now/CVE-2020-18035.md): Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNu (no CVSS)
- [CVE-2021-29468](https://cve.now/CVE-2021-29468.md): Arbitrary code execution when checking out an attacker-controlled Git branch (CVSS 8.8, me-and Cygwin-Git)
- [CVE-2021-29484](https://cve.now/CVE-2021-29484.md): DOM XSS in Theme Preview (CVSS 6.8, TryGhost Ghost · ghost)
- [CVE-2021-1086](https://cve.now/CVE-2021-1086.md): NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resource (CVSS 7.1, NVIDIA Virtual GPU Software)
- [CVE-2021-1087](https://cve.now/CVE-2021-1087.md): NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), which could allow an attacker to retrieve information (CVSS 5.5, NVIDIA Virtual GPU Software)
- [CVE-2021-1084](https://cve.now/CVE-2021-1084.md): NVIDIA vGPU driver contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2021-1085](https://cve.now/CVE-2021-1085.md): NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to write to a shared memo (CVSS 7.3, NVIDIA Virtual GPU Software)
- [CVE-2021-1083](https://cve.now/CVE-2021-1083.md): NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input lengt (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2021-1081](https://cve.now/CVE-2021-1081.md): NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU manager (vGPU plugin), in which an input lengt (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2021-1082](https://cve.now/CVE-2021-1082.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which may (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2021-1080](https://cve.now/CVE-2021-1080.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which certain input data is not validated, which (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2020-22808](https://cve.now/CVE-2020-22808.md): An issue was found in yii2\_fecshop 2.x. (no CVSS)
- [CVE-2020-22807](https://cve.now/CVE-2020-22807.md): An issue was dicovered in vtiger crm 7.2. (no CVSS)
- [CVE-2021-1504](https://cve.now/CVE-2021-1504.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services VPN Denial of Service Vulnerabilities (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1501](https://cve.now/CVE-2021-1501.md): Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software SIP Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1495](https://cve.now/CVE-2021-1495.md): Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2021-1493](https://cve.now/CVE-2021-1493.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability (CVSS 8.5, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1489](https://cve.now/CVE-2021-1489.md): Cisco Firepower Device Manager Software Filesystem Space Exhaustion Denial of Service Vulnerability (CVSS 4.9, Cisco Firepower Threat Defense Software)
- [CVE-2021-1488](https://cve.now/CVE-2021-1488.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000 and 2100 Series Appliances Command Injection Vulnerability (CVSS 6.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1477](https://cve.now/CVE-2021-1477.md): Cisco Firepower Management Center Software Policy Vulnerability (CVSS 4.3, Cisco Firepower Management Center)
- [CVE-2021-1476](https://cve.now/CVE-2021-1476.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Command Injection Vulnerability (CVSS 6.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1458](https://cve.now/CVE-2021-1458.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2021-1457](https://cve.now/CVE-2021-1457.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2021-1456](https://cve.now/CVE-2021-1456.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2021-1455](https://cve.now/CVE-2021-1455.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (no CVSS, Cisco Firepower Management Center)
- [CVE-2021-1448](https://cve.now/CVE-2021-1448.md): Cisco Firepower Threat Defense Software Command Injection Vulnerability (CVSS 7.8, Cisco Firepower Threat Defense Software)
- [CVE-2021-1445](https://cve.now/CVE-2021-1445.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services VPN Denial of Service Vulnerabilities (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1369](https://cve.now/CVE-2021-1369.md): Cisco Firepower Device Manager On-Box Software XML External Entity Vulnerability (CVSS 5.4, Cisco Firepower Threat Defense Software)
- [CVE-2021-1256](https://cve.now/CVE-2021-1256.md): Cisco Firepower Threat Defense Software Command File Overwrite Vulnerability (CVSS 6.0, Cisco Firepower Threat Defense Software)
- [CVE-2021-21388](https://cve.now/CVE-2021-21388.md): Command Injection Vulnerability in systeminformation (CVSS 8.9, sebhildebrandt systeminformation · systeminformation)
- [CVE-2020-18032](https://cve.now/CVE-2020-18032.md): Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2021-1402](https://cve.now/CVE-2021-1402.md): Cisco Firepower Threat Defense Software SSL Decryption Policy Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2021-21417](https://cve.now/CVE-2021-21417.md): Use after free in fluidsynth (CVSS 7.2, fluidsynth)
- [CVE-2020-21101](https://cve.now/CVE-2020-21101.md): Cross Site Scriptiong vulnerabilityin Screenly screenly-ose all versions, including v1.8.2 (2019-09-25-Screenly-OSE-lite.img), in the 'Add A (no CVSS)
- [CVE-2021-21415](https://cve.now/CVE-2021-21415.md): Visual Studio Code Prisma Extension Remote Code Execution Vulnerability (CVSS 7.8, prisma language-tools)
- [CVE-2021-31437](https://cve.now/CVE-2021-31437.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2021-31438](https://cve.now/CVE-2021-31438.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2021-31435](https://cve.now/CVE-2021-31435.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2021-31436](https://cve.now/CVE-2021-31436.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2021-31434](https://cve.now/CVE-2021-31434.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2021-31433](https://cve.now/CVE-2021-31433.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2021-31431](https://cve.now/CVE-2021-31431.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 6.0, Parallels Desktop)
- [CVE-2021-31432](https://cve.now/CVE-2021-31432.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 6.0, Parallels Desktop)
- [CVE-2021-31430](https://cve.now/CVE-2021-31430.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 6.0, Parallels Desktop)
- [CVE-2021-31428](https://cve.now/CVE-2021-31428.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 8.2, Parallels Desktop)
- [CVE-2021-31429](https://cve.now/CVE-2021-31429.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 8.2, Parallels Desktop)
- [CVE-2021-31427](https://cve.now/CVE-2021-31427.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 7.3, Parallels Desktop)
- [CVE-2021-31426](https://cve.now/CVE-2021-31426.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. (CVSS 8.8, Parallels Desktop)
- [CVE-2021-31424](https://cve.now/CVE-2021-31424.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 8.8, Parallels Desktop)
- [CVE-2021-31425](https://cve.now/CVE-2021-31425.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. (CVSS 8.8, Parallels Desktop)
- [CVE-2021-31423](https://cve.now/CVE-2021-31423.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. (CVSS 6.0, Parallels Desktop)
- [CVE-2021-31421](https://cve.now/CVE-2021-31421.md): This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. (CVSS 3.2, Parallels Desktop)
- [CVE-2021-31422](https://cve.now/CVE-2021-31422.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. (CVSS 7.5, Parallels Desktop)
- [CVE-2021-31420](https://cve.now/CVE-2021-31420.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950. (CVSS 8.8, Parallels Desktop)
- [CVE-2021-31418](https://cve.now/CVE-2021-31418.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. (CVSS 6.5, Parallels Desktop)
- [CVE-2021-31419](https://cve.now/CVE-2021-31419.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. (CVSS 6.5, Parallels Desktop)
- [CVE-2021-31417](https://cve.now/CVE-2021-31417.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. (CVSS 6.5, Parallels Desktop)
- [CVE-2020-21452](https://cve.now/CVE-2020-21452.md): An issue was discovered in uniview ISC2500-S. (no CVSS)
- [CVE-2020-35430](https://cve.now/CVE-2020-35430.md): SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu v2.0.6 via the ids parameter to admin/letter/delsyst (no CVSS)
- [CVE-2021-30048](https://cve.now/CVE-2021-30048.md): Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allow (no CVSS)
- [CVE-2021-30234](https://cve.now/CVE-2021-30234.md): The api/ZRIGMP/set\_MLD\_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands vi (no CVSS)
- [CVE-2021-25811](https://cve.now/CVE-2021-25811.md): MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen\_http\_lan parameter. (no CVSS)
- [CVE-2021-25812](https://cve.now/CVE-2021-25812.md): Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set\_online\_cli (no CVSS)
- [CVE-2021-30228](https://cve.now/CVE-2021-30228.md): The api/ZRAndlink/set\_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands (no CVSS)
- [CVE-2021-30229](https://cve.now/CVE-2021-30229.md): The api/zrDm/set\_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell (no CVSS)
- [CVE-2021-30230](https://cve.now/CVE-2021-30230.md): The api/ZRFirmware/set\_time\_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary command (no CVSS)
- [CVE-2021-30231](https://cve.now/CVE-2021-30231.md): The api/zrDm/set\_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via sh (no CVSS)
- [CVE-2021-30232](https://cve.now/CVE-2021-30232.md): The api/ZRIGMP/set\_IGMP\_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands v (no CVSS)
- [CVE-2021-30233](https://cve.now/CVE-2021-30233.md): The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via (no CVSS)
- [CVE-2021-25810](https://cve.now/CVE-2021-25810.md): Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src\_dport\_start', 'src\_dport\_end (no CVSS)
- [CVE-2021-20228](https://cve.now/CVE-2021-20228.md): A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no\_log feature when (no CVSS, ansible)
- [CVE-2021-29350](https://cve.now/CVE-2021-29350.md): SQL injection in the getip function in conn/function.php in 发货100-设计素材下载系统 1.1 allows remote attackers to inject arbitrary SQL commands via (no CVSS)
- [CVE-2021-30227](https://cve.now/CVE-2021-30227.md): Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0. (no CVSS)
- [CVE-2021-28280](https://cve.now/CVE-2021-28280.md): CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2021-30224](https://cve.now/CVE-2021-30224.md): Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials. (no CVSS)
- [CVE-2021-27651](https://cve.now/CVE-2021-27651.md): In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentica (CVSS 9.8, Pegasystems Pega Infinity)
- [CVE-2021-30027](https://cve.now/CVE-2021-30027.md): md\_analyze\_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malform (no CVSS)
- [CVE-2021-30218](https://cve.now/CVE-2021-30218.md): samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file. (no CVSS)
- [CVE-2021-30219](https://cve.now/CVE-2021-30219.md): samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file. (no CVSS)
- [CVE-2021-20092](https://cve.now/CVE-2021-20092.md): The web interfaces of Buffalo WSR-2533DHPL2 firmware version \<= 1.02 and WSR-2533DHP3 firmware version \<= 1.24 do not properly restrict acce (no CVSS, Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3)
- [CVE-2021-20091](https://cve.now/CVE-2021-20091.md): The web interfaces of Buffalo WSR-2533DHPL2 firmware version \<= 1.02 and WSR-2533DHP3 firmware version \<= 1.24 do not properly sanitize user (no CVSS, Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3)
- [CVE-2020-22002](https://cve.now/CVE-2020-22002.md): An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI \<=6.x within the Ge (no CVSS)
- [CVE-2020-21997](https://cve.now/CVE-2020-21997.md): Smartwares HOME easy \<=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. (no CVSS)
- [CVE-2020-21995](https://cve.now/CVE-2020-21995.md): Inim Electronics Smartliving SmartLAN/G/SI \<=6.x uses default hardcoded credentials. (no CVSS)
- [CVE-2021-28899](https://cve.now/CVE-2021-28899.md): Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDema (no CVSS)
- [CVE-2020-21992](https://cve.now/CVE-2020-21992.md): Inim Electronics SmartLiving SmartLAN/G/SI \<=6.x suffers from an authenticated remote command injection vulnerability. (no CVSS)
- [CVE-2020-21990](https://cve.now/CVE-2020-21990.md): Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to imp (no CVSS)
- [CVE-2021-29141](https://cve.now/CVE-2021-29141.md): A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29139](https://cve.now/CVE-2021-29139.md): A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14- (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29138](https://cve.now/CVE-2021-29138.md): A remote disclosure of privileged information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8. (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29140](https://cve.now/CVE-2021-29140.md): A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14- (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29142](https://cve.now/CVE-2021-29142.md): A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14- (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29147](https://cve.now/CVE-2021-29147.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29144](https://cve.now/CVE-2021-29144.md): A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29145](https://cve.now/CVE-2021-29145.md): A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29146](https://cve.now/CVE-2021-29146.md): A remote cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14- (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29137](https://cve.now/CVE-2021-29137.md): A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25167](https://cve.now/CVE-2021-25167.md): A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25166](https://cve.now/CVE-2021-25166.md): A remote unauthorized access vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-25163](https://cve.now/CVE-2021-25163.md): A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-31879](https://cve.now/CVE-2021-31879.md): GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. (no CVSS)
- [CVE-2020-36327](https://cve.now/CVE-2020-36327.md): Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which (no CVSS, bundler)
- [CVE-2021-25216](https://cve.now/CVE-2021-25216.md): A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack (CVSS 8.1, ISC BIND9)
- [CVE-2021-25215](https://cve.now/CVE-2021-25215.md): An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself (CVSS 7.5, ISC BIND9)
- [CVE-2021-25214](https://cve.now/CVE-2021-25214.md): A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly (CVSS 6.5, ISC BIND9)
- [CVE-2021-21414](https://cve.now/CVE-2021-21414.md): Command injection vulnerability in @prisma/sdk in getPackedPackage function (CVSS 7.7, prisma · @prisma/sdk)
- [CVE-2021-21391](https://cve.now/CVE-2021-21391.md): Regular expression Denial of Service in multiple packages (CVSS 6.5, ckeditor5 · @ckeditor/ckeditor5-engine +7)
- [CVE-2021-31776](https://cve.now/CVE-2021-31776.md): Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the (no CVSS)
- [CVE-2020-15225](https://cve.now/CVE-2020-15225.md): Denial of Service vulnerability in django-filter (CVSS 7.5, carltongibson django-filter · django-filter)
- [CVE-2021-20090](https://cve.now/CVE-2021-20090.md): A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version \<= 1.02 and WSR-2533DHP3 firmware version \<= (CVSS 9.8, KEV, Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3)
- [CVE-2021-20294](https://cve.now/CVE-2021-20294.md): A flaw was found in binutils readelf 2.35 program. (no CVSS, binutils)
- [CVE-2021-31875](https://cve.now/CVE-2021-31875.md): In mjs\_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs\_j (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.