CVEs published May 5, 2021
88 CVEs were published on May 5, 2021: 0 critical, 7 high.
- Published
- 88
- Critical
- 0
- High
- 7
- Medium
- 8
- Low
- 2
- Unrated
- 71
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- IBM QRadar SIEM
- 8
- Business Directory Team Business Directory Plugin – Easy Li…
- 6
- Drupal Core · drupal/core +1
- 4
- bitorbit WPBakery Page Builder (Visual Composer) Clipboard
- 2
- Trend Micro Home Network Security
- 2
- All-in-One Addons for Elementor – WidgetKit
- 1
- Classyfrieds
- 1
- CleverSoft Clever Addons for Elementor
- 1
- College publisher Import
- 1
- Contact Form by Supsystic
- 1
High 7
- CVE-2021-31409Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19Vaadin · vaadin-compatibility-server +1
- CVE-2021-29101ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.Esri ArcGIS GeoEvent Server
- CVE-2020-5013IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.IBM QRadar SIEM
- CVE-2020-4979IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication.IBM QRadar SIEM
- CVE-2021-29489Options structure open to XSS if passed unfilteredhighcharts
- CVE-2021-29100ArcGIS Earth has a File Parsing Directory Traversal VulnerabilityEsri ArcGIS Earth
- CVE-2021-25319virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers groupopenSUSE Factory
Medium, low and unrated 81
- CVE-2021-3501A flaw was found in the Linux kernel in versions before 5.12.Linux kernel
- CVE-2021-22211An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.GitLab
- CVE-2020-19114SQL Injection vulnerability in Online Book Store v1.0 via the publisher parameter to edit_book.php, which could let a remote malicious user
- CVE-2020-23128Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user
- CVE-2020-19113Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution.
- CVE-2020-23127Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user.
- CVE-2020-19112SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_delete.php, which could let a remote malicious use
- CVE-2020-19111Incorrect Access Control vulnerability in Online Book Store v1.0 via admin_verify.php, which could let a remote mailicious user bypass authe
- CVE-2020-19110SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to book.php parameter, which could let a remote malicious u
- CVE-2020-19109SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_edit.php, which could let a remote malicious user
- CVE-2020-19108SQL Injection vulnerability in Online Book Store v1.0 via the pubid parameter to bookPerPub.php, which could let a remote malicious user exe
- CVE-2020-19107SQL Injection vulnerability in Online Book Store v1.0 via the isbn parameter to edit_book.php, which could let a remote malicious user execu
- CVE-2021-24254College Publisher Import <= 0.1 - Arbitrary File Upload to RCECollege publisher Import
- CVE-2021-24246WorkScout Core < 1.3.4 - Authenticated Stored XSS & XFSPureThemes Workscout Core · PureThemes WorkScout
- CVE-2021-24247Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)MooveAgency Contact Form Check Tester
- CVE-2021-24248Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCEBusiness Directory Team Business Directory Plugin – Easy Li…
- CVE-2021-24249Business Directory Plugin < 5.11.2 - Arbitrary Listing ExportBusiness Directory Team Business Directory Plugin – Easy Li…
- CVE-2021-24250Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site ScriptingBusiness Directory Team Business Directory Plugin – Easy Li…
- CVE-2021-24251Business Directory Plugin < 5.11.2 - Arbitrary Payment History UpdateBusiness Directory Team Business Directory Plugin – Easy Li…
- CVE-2021-24252Event Banner <= 1.3 - Arbitrary File Upload to RCEEvent Banner
- CVE-2021-24253Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCEClassyfrieds
- CVE-2021-24178Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSSBusiness Directory Team Business Directory Plugin – Easy Li…
- CVE-2021-24179Business Directory Plugin < 5.11 - Arbitrary File Upload to RCEBusiness Directory Team Business Directory Plugin – Easy Li…
- CVE-2021-24214OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Errordaggerhart OpenID Connect Generic Client
- CVE-2021-24236Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCEwilliewonka Imagements
- CVE-2021-24243WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)bitorbit WPBakery Page Builder (Visual Composer) Clipboard
- CVE-2021-24244WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Updatebitorbit WPBakery Page Builder (Visual Composer) Clipboard
- CVE-2021-24245Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)Trumani Stop Spammers
- CVE-2021-32062MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enfor
- CVE-2021-24274Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)Ultimate Maps by Supsystic
- CVE-2021-24275Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)Popup by Supsystic
- CVE-2021-24276Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)Contact Form by Supsystic
- CVE-2021-24293NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)NextGen Gallery Pro
- CVE-2021-24265Rife Elementor Extensions & Templates < 1.1.6 - Contributor+ Stored XSSRife Elementor Extensions & Templates
- CVE-2021-24266The Plus Addons for Elementor Page Builder Lite < 2.0.6 - Contributor+ Stored XSSThe Plus Addons for Elementor Page Builder Lite
- CVE-2021-24267All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSSAll-in-One Addons for Elementor – WidgetKit
- CVE-2021-24268JetWidgets For Elementor < 1.0.9 - Contributor+ Stored XSSJetWidgets For Elementor
- CVE-2021-24269Sina Extension for Elementor < 3.3.12 - Contributor+ Stored XSSSina Extension for Elementor
- CVE-2021-24270DethemeKit For Elementor < 1.5.5.5 - Contributor+ Stored XSSDethemeKit For Elementor
- CVE-2021-24271Ultimate Addons for Elementor < 1.30.0 - Contributor+ Stored XSSUltimate Addons for Elementor
- CVE-2021-24272Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)fitness calculators
- CVE-2021-24273Clever Addons for Elementor < 2.1.0 - Contributor+ Stored XSSCleverSoft Clever Addons for Elementor
- CVE-2021-24257Premium Addons for Elementor < 4.2.8 - Contributor+ Stored Cross-Site Scripting (XSS)Premium Addons for Elementor
- CVE-2021-24258ElementsKit and ElementsKit Pro < 2.2.0 - Contributor+ Stored XSSWpmet Elements Kit Lite · Wpmet Elements Kit Pro
- CVE-2021-24259Elementor Addon Elements < 1.11.2 - Contributor+ Stored XSSElementor Addon Elements
- CVE-2021-24260Livemesh Addons for Elementor < 6.8 - Contributor+ Stored XSSLivemesh Addons for Elementor
- CVE-2021-24261HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSSHT Mega – Absolute Addons for Elementor Page Builder
- CVE-2021-24262WooLentor - WooCommerce Elementor Addons + Builder < 1.8.6 - Contributor+ Stored XSSWooLentor – WooCommerce Elementor Addons + Builder
- CVE-2021-24263PowerPack Addons for Elementor < 2.3.2 - Contributor+ Stored XSSPowerPack Addons for Elementor
- CVE-2021-24264Image Hover Effects - Elementor Addon < 1.3.4 - Contributor+ Stored XSSImage Hover Effects – Elementor Addon
- CVE-2021-24255Essential Addons for Elementor < 4.5.4 - Contributor+ Stored Cross-Site Scripting (XSS)Essential Addons for Elementor
- CVE-2021-24256Elementor - Header, Footer & Blocks Template < 1.5.8 - Contributor+ Stored XSSElementor – Header, Footer & Blocks Template
- CVE-2021-29490Unauthenticated GET requests through Remote Image endpointsjellyfin
- CVE-2021-31411Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19Vaadin · com.vaadin:vaadin-bom
- CVE-2021-20401IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authIBM QRadar SIEM
- CVE-2021-20397IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2020-4993IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be vulnerable to path trIBM QRadar SIEM
- CVE-2020-4932IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authIBM QRadar SIEM
- CVE-2020-4929IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2020-4883IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further attacks against the systIBM QRadar SIEM
- CVE-2021-32055Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out
- CVE-2021-31518Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploitTrend Micro Home Network Security
- CVE-2021-31517Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploitTrend Micro Home Network Security
- CVE-2020-13664Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances.Drupal Core · drupal/core +1
- CVE-2020-13662Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to aDrupal Core · drupal/core +1
- CVE-2020-13665Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode.Drupal Core · drupal/core +1
- CVE-2020-13666Cross-site scripting vulnerability in Drupal Core.Drupal Core · drupal/core +1
- CVE-2016-20010EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is un
- CVE-2021-20254A flaw was found in samba.samba
- CVE-2021-29250BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality.
- CVE-2021-29248BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a
- CVE-2021-29247BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for
- CVE-2021-29246BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution.
- CVE-2021-29245BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.
- CVE-2021-31800Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22.impacket
- CVE-2021-25317cups: ownership of /var/log/cups allows the lp user to create files as rootSUSE Linux Enterprise Server 11-SP4-LTSS · SUSE Manager… +3
- CVE-2020-36333themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.
- CVE-2020-36334themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database.
- CVE-2020-22428SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a J
- CVE-2021-25179SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header.
- CVE-2021-31542In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversadjango