CVEs published April 30, 2021
50 CVEs were published on April 30, 2021: 0 critical, 9 high.
- Published
- 50
- Critical
- 0
- High
- 9
- Medium
- 11
- Low
- 3
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Google Chrome
- 7
- Integrated Dell Remote Access Controller
- 6
- Dell Hybrid Client
- 4
- exiv2
- 2
- ampache
- 1
- Dell OpenManage Enterprise
- 1
- Dell Unisphere for PowerMax
- 1
- Dell Unity
- 1
- Dell VRTX Switch Modules
- 1
- DrPaulBrewer cumulative-distribution-function · cumulative-…
- 1
High 9
- CVE-2021-21531Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability.Dell Unisphere for PowerMax
- CVE-2021-21530Dell OpenManage Enterprise-Modular (OME-M) versions prior to 1.30.00 contain a security bypass vulnerability.Dell OpenManage Enterprise
- CVE-2021-21507Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.8Dell VRTX Switch Modules
- CVE-2021-31933A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uplo
- CVE-2021-21535Dell Hybrid Client versions prior to 1.5 contain a missing authentication for a critical function vulnerability.Dell Hybrid Client
- CVE-2021-29486Improper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-functionDrPaulBrewer cumulative-distribution-function · cumulative-…
- CVE-2020-7731Denial of Service (DoS)github.com/russellhaering/gosaml2 · github.com/russellhaeri…
- CVE-2020-4039Directory Traversal Vulnerability in SUSI.AI Serverfossasia susi_server
- CVE-2020-15153Unauthenticated SQL injection in Ampacheampache
Medium, low and unrated 41
- CVE-2021-31792XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field
- CVE-2021-31934OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the
- CVE-2021-31935OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling
- CVE-2021-21547Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell UpgDell Unity
- CVE-2020-28944OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data.
- CVE-2020-28943OX App Suite 7.10.4 and earlier allows SSRF via a snippet.
- CVE-2021-21544Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21543Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities.Integrated Dell Remote Access Controller
- CVE-2021-21542Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities.Integrated Dell Remote Access Controller
- CVE-2021-21541Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21540Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21539Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.Integrated Dell Remote Access Controller
- CVE-2020-18084Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field o
- CVE-2021-21232Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-21233Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2021-21231Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-21229Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing viGoogle Chrome
- CVE-2021-21230Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-21228Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a mGoogle Chrome
- CVE-2021-21227Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-31926AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local sys
- CVE-2021-21537Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability.Dell Hybrid Client
- CVE-2021-21536Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability.Dell Hybrid Client
- CVE-2021-21534Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability.Dell Hybrid Client
- CVE-2021-20515IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking.IBM Informix Dynamic Server
- CVE-2020-27519Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component.
- CVE-2021-31232The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used.github.com/cortexproject/cortex
- CVE-2021-31231The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when expe
- CVE-2021-28959Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive.
- CVE-2020-24918A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP
- CVE-2021-20266A flaw was found in RPM's hdrblobInit() in lib/header.c.rpm
- CVE-2020-1721A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID dupki-core
- CVE-2021-26807GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an a
- CVE-2021-20326Specially crafted query may result in a denial of service of mongodMongoDB Server
- CVE-2021-31870An issue was discovered in klibc before 2.0.9.
- CVE-2021-31872An issue was discovered in klibc before 2.0.9.
- CVE-2021-31871An issue was discovered in klibc before 2.0.9.
- CVE-2021-31919An issue was discovered in the rkyv crate before 0.6.0 for Rust.rkyv
- CVE-2021-29463Out-of-bounds read in Exiv2::WebPImage::doWriteMetadataexiv2
- CVE-2021-29464Heap buffer overflow in Exiv2::Jp2Image::encodeJp2Headerexiv2
- CVE-2021-31873An issue was discovered in klibc before 2.0.9.