# CVEs published 2021-04-30

50 CVEs were published on April 30, 2021: 0 critical, 9 high. Days are UTC.

- [CVE-2021-31792](https://cve.now/CVE-2021-31792.md): XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field (no CVSS)
- [CVE-2021-31934](https://cve.now/CVE-2021-31934.md): OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the (no CVSS)
- [CVE-2021-31935](https://cve.now/CVE-2021-31935.md): OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling (no CVSS)
- [CVE-2021-21547](https://cve.now/CVE-2021-21547.md): Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell Upg (CVSS 6.4, Dell Unity)
- [CVE-2021-21531](https://cve.now/CVE-2021-21531.md): Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. (CVSS 8.1, Dell Unisphere for PowerMax)
- [CVE-2021-21530](https://cve.now/CVE-2021-21530.md): Dell OpenManage Enterprise-Modular (OME-M) versions prior to 1.30.00 contain a security bypass vulnerability. (CVSS 8.3, Dell OpenManage Enterprise)
- [CVE-2021-21507](https://cve.now/CVE-2021-21507.md): Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.8 (CVSS 8.8, Dell VRTX Switch Modules)
- [CVE-2020-28944](https://cve.now/CVE-2020-28944.md): OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. (no CVSS)
- [CVE-2020-28943](https://cve.now/CVE-2020-28943.md): OX App Suite 7.10.4 and earlier allows SSRF via a snippet. (no CVSS)
- [CVE-2021-21544](https://cve.now/CVE-2021-21544.md): Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. (CVSS 2.7, Integrated Dell Remote Access Controller)
- [CVE-2021-21543](https://cve.now/CVE-2021-21543.md): Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. (CVSS 4.8, Integrated Dell Remote Access Controller)
- [CVE-2021-21542](https://cve.now/CVE-2021-21542.md): Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. (CVSS 4.8, Integrated Dell Remote Access Controller)
- [CVE-2021-21541](https://cve.now/CVE-2021-21541.md): Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. (CVSS 6.1, Integrated Dell Remote Access Controller)
- [CVE-2021-21540](https://cve.now/CVE-2021-21540.md): Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. (CVSS 5.9, Integrated Dell Remote Access Controller)
- [CVE-2021-21539](https://cve.now/CVE-2021-21539.md): Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. (CVSS 5.9, Integrated Dell Remote Access Controller)
- [CVE-2021-31933](https://cve.now/CVE-2021-31933.md): A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uplo (CVSS 7.2)
- [CVE-2020-18084](https://cve.now/CVE-2020-18084.md): Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field o (no CVSS)
- [CVE-2021-21232](https://cve.now/CVE-2021-21232.md): Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-21233](https://cve.now/CVE-2021-21233.md): Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corrup (no CVSS, Google Chrome)
- [CVE-2021-21231](https://cve.now/CVE-2021-21231.md): Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2021-21229](https://cve.now/CVE-2021-21229.md): Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing vi (no CVSS, Google Chrome)
- [CVE-2021-21230](https://cve.now/CVE-2021-21230.md): Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2021-21228](https://cve.now/CVE-2021-21228.md): Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a m (no CVSS, Google Chrome)
- [CVE-2021-21227](https://cve.now/CVE-2021-21227.md): Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2021-31926](https://cve.now/CVE-2021-31926.md): AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local sys (no CVSS)
- [CVE-2021-21537](https://cve.now/CVE-2021-21537.md): Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. (CVSS 6.2, Dell Hybrid Client)
- [CVE-2021-21536](https://cve.now/CVE-2021-21536.md): Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. (CVSS 6.2, Dell Hybrid Client)
- [CVE-2021-21535](https://cve.now/CVE-2021-21535.md): Dell Hybrid Client versions prior to 1.5 contain a missing authentication for a critical function vulnerability. (CVSS 7.4, Dell Hybrid Client)
- [CVE-2021-21534](https://cve.now/CVE-2021-21534.md): Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. (CVSS 4.0, Dell Hybrid Client)
- [CVE-2021-29486](https://cve.now/CVE-2021-29486.md): Improper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-function (CVSS 7.5, DrPaulBrewer cumulative-distribution-function · cumulative-…)
- [CVE-2020-7731](https://cve.now/CVE-2020-7731.md): Denial of Service (DoS) (CVSS 7.5, github.com/russellhaering/gosaml2 · github.com/russellhaeri…)
- [CVE-2021-20515](https://cve.now/CVE-2021-20515.md): IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. (CVSS 6.7, IBM Informix Dynamic Server)
- [CVE-2020-4039](https://cve.now/CVE-2020-4039.md): Directory Traversal Vulnerability in SUSI.AI Server (CVSS 8.6, fossasia susi\_server)
- [CVE-2020-15153](https://cve.now/CVE-2020-15153.md): Unauthenticated SQL injection in Ampache (CVSS 8.2, ampache)
- [CVE-2020-27519](https://cve.now/CVE-2020-27519.md): Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. (no CVSS)
- [CVE-2021-31232](https://cve.now/CVE-2021-31232.md): The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. (no CVSS, github.com/cortexproject/cortex)
- [CVE-2021-31231](https://cve.now/CVE-2021-31231.md): The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when expe (no CVSS)
- [CVE-2021-28959](https://cve.now/CVE-2021-28959.md): Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. (no CVSS)
- [CVE-2020-24918](https://cve.now/CVE-2020-24918.md): A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP (no CVSS)
- [CVE-2021-20266](https://cve.now/CVE-2021-20266.md): A flaw was found in RPM's hdrblobInit() in lib/header.c. (no CVSS, rpm)
- [CVE-2020-1721](https://cve.now/CVE-2020-1721.md): A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID du (no CVSS, pki-core)
- [CVE-2021-26807](https://cve.now/CVE-2021-26807.md): GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc\_s\_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an a (no CVSS)
- [CVE-2021-20326](https://cve.now/CVE-2021-20326.md): Specially crafted query may result in a denial of service of mongod (CVSS 6.5, MongoDB Server)
- [CVE-2021-31870](https://cve.now/CVE-2021-31870.md): An issue was discovered in klibc before 2.0.9. (no CVSS)
- [CVE-2021-31872](https://cve.now/CVE-2021-31872.md): An issue was discovered in klibc before 2.0.9. (no CVSS)
- [CVE-2021-31871](https://cve.now/CVE-2021-31871.md): An issue was discovered in klibc before 2.0.9. (no CVSS)
- [CVE-2021-31919](https://cve.now/CVE-2021-31919.md): An issue was discovered in the rkyv crate before 0.6.0 for Rust. (no CVSS, rkyv)
- [CVE-2021-29463](https://cve.now/CVE-2021-29463.md): Out-of-bounds read in Exiv2::WebPImage::doWriteMetadata (CVSS 3.3, exiv2)
- [CVE-2021-29464](https://cve.now/CVE-2021-29464.md): Heap buffer overflow in Exiv2::Jp2Image::encodeJp2Header (CVSS 3.3, exiv2)
- [CVE-2021-31873](https://cve.now/CVE-2021-31873.md): An issue was discovered in klibc before 2.0.9. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.