Skip to content
OpenAdvisories

Archive

April 2021

Vulnerabilities first published in this month (UTC), newest first.

← March 2021 2021 / April May 2021 →
  1. 165
  2. 2178
  3. 31
  4. 4 
  5. 565
  6. 694
  7. 758
  8. 865
  9. 955
  10. 102
  11. 119
  12. 1261
  13. 13207
  14. 1480
  15. 1549
  16. 1619
  17. 174
  18. 188
  19. 1952
  20. 2030
  21. 2140
  22. 22297
  23. 2347
  24. 244
  25. 256
  26. 2668
  27. 2750
  28. 2859
  29. 29118
  30. 3050
All Critical High Medium Low Exploited only Public exploit

97 results · Clear filters · Feed

  • Unscored —
    CVE-2021-28142 Public exploit

    CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."

  • Unscored —
    CVE-2021-30149 Public exploit EPSS 10%

    Composr 10.0.36 allows upload and execution of PHP files.

  • Unscored —
    CVE-2021-30150 Public exploit

    Composr 10.0.36 allows XSS in an XML script.

  • Unscored —
    CVE-2021-24174 Public exploit

    Database Backups <= 1.2.2.6 - CSRF to Backup Download

    The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.

    Web / CMS
  • Unscored —
    CVE-2021-24169 Public exploit Scanner template EPSS 10%

    Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)

    This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.

    Web / CMS
  • Unscored —
    CVE-2021-24160 Public exploit

    Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload

    In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to…

    ExpressTech Systems Responsive Menu Pro Responsive Menu – Create Mobile-Friendly Menu
  • Unscored —
    CVE-2021-24155 Public exploit Scanner template EPSS 84%

    Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload

    The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to …

    Web / CMS
  • Medium 6.1
    CVE-2021-30109 Public exploit

    Cross-site Scripting in Froala Editor

    Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.

    froala-editor npm
  • Unscored —
    CVE-2020-17453 Public exploit Scanner template EPSS 26%

    WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

  • Unscored —
    CVE-2021-27973 Public exploit EPSS 11%

    SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.

  • High 7.0
    CVE-2021-1782 Exploited Public exploit

    A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…

    Apple macOS iOS and iPadOS macOS iOS
    KEV Nov 3, 2021
  • Unscored —
    CVE-2021-1748 Public exploit

    A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4, watchOS 7.3, iOS 1…

    Apple iOS and iPadOS watchOS tvOS iOS
  • Unscored —
    CVE-2020-27949 Public exploit

    This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Big Sur 11.…

    Apple macOS macOS
  • Unscored —
    CVE-2020-27935 Public exploit

    Multiple issues were addressed with improved logic. This issue is fixed in iOS 14.2 and iPadOS 14.2, macOS Big Sur 11.0…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Critical 9.6
    CVE-2021-22201 Public exploit

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2021-28165 Public exploit EPSS 54%

    Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-28164 Public exploit Scanner template EPSS 82%

    Authorization Before Parsing and Canonicalization in jetty

    In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …

    The Eclipse Foundation Eclipse Jetty jetty9 equinox-bundles Debian Ubuntu Maven