Skip to content
OpenAdvisories

Archive

28 April 2021

Vulnerabilities first published on this day (UTC), newest first.

← March 2021 2021 / April /28 May 2021 →
  1. 165
  2. 2178
  3. 31
  4. 4 
  5. 565
  6. 694
  7. 758
  8. 865
  9. 955
  10. 102
  11. 119
  12. 1261
  13. 13207
  14. 1480
  15. 1549
  16. 1619
  17. 174
  18. 188
  19. 1952
  20. 2030
  21. 2140
  22. 22297
  23. 2347
  24. 244
  25. 256
  26. 2668
  27. 2750
  28. 2859
  29. 29118
  30. 3050
All Critical High Medium Low Exploited only Public exploit

59 results · Feed

  • Medium 5.3
    CVE-2021-30169

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2

    The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware
  • Critical 9.8
    CVE-2021-30167

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication

    The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices.

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware
  • Critical 9.8
    CVE-2021-30168

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1

    The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices.

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware
  • High 7.2
    CVE-2021-30166

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection

    The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.

    MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware
  • Critical 9.0
    CVE-2021-27648

    Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essen…

    Synology Synology Antivirus Essential
  • Unscored —
    CVE-2021-27933 EPSS 27%

    pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.

  • High 7.6
    CVE-2021-31777

    SQL Injection in t3/dce

    The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.

    t3/dce Packagist
  • Medium 6.4
    CVE-2021-31779

    Server-Side Request Forgery in yoast_seo

    The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.

    yoast-seo-for-typo3/yoast_seo Packagist
  • Medium 6.4
    CVE-2021-31778

    Cross-site scripting in media2click

    The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.

    amazing/media2click Packagist
  • Unscored —
    CVE-2021-31863

    Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x …

    redmine redmine Debian Ubuntu
  • Unscored —
    CVE-2021-31864

    Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permiss…

    redmine redmine Debian Ubuntu
  • Unscored —
    CVE-2021-31865

    Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extens…

    redmine redmine Debian Ubuntu
  • Unscored —
    CVE-2021-31866

    Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by o…

    redmine redmine Debian Ubuntu
  • Unscored —
    CVE-2021-31856 Public exploit Scanner template EPSS 75%

    A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL comma…

  • Critical 9.8
    CVE-2020-36326

    Object injection in PHPMailer/PHPMailer

    PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always conside…

    phpmailer/phpmailer libphp-phpmailer Debian Packagist
  • Unscored —
    CVE-2021-31815

    GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive infor…

  • Unscored —
    CVE-2021-3512

    Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH…

    BUFFALO Buffalo broadband routers
  • Unscored —
    CVE-2021-3511

    Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmwa…

    BUFFALO Buffalo broadband routers
  • Unscored —
    CVE-2021-20716

    Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04…

    BUFFALO Buffalo network devices