April 2021

1,841 results · Feed

• Unscored —
  CVE-2021-27113

  An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string cons…

  Apr 14, 2021
• Unscored —
  CVE-2021-26827

  Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Se…

  Apr 14, 2021
• Unscored —
  CVE-2021-29338

  Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS)…

  insighttoolkit4 openjpeg2 qtwebengine-opensource-src openjpeg2 Debian Ubuntu Azure Linux Alpine
  Apr 14, 2021
• Unscored —
  CVE-2021-28300

  NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to …

  gpac gpac ccextractor Debian Ubuntu
  Apr 14, 2021
• Unscored —
  CVE-2021-26805

  Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a…

  Apr 14, 2021
• Unscored —
  CVE-2020-36120

  Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of S…

  libsixel Ubuntu
  Apr 14, 2021
• Unscored —
  CVE-2020-21088

  Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by …

  Apr 14, 2021
• Unscored —
  CVE-2020-21087

  Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by inject…

  Apr 14, 2021
• Unscored —
  CVE-2021-27288

  Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting …

  Apr 14, 2021
• Unscored —
  CVE-2021-26832 Public exploit

  Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows atta…

  Apr 14, 2021
• Unscored —
  CVE-2021-22879

  Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allow…

  nextcloud-desktop nextcloud-desktop Web / CMS Debian Ubuntu
  Apr 14, 2021
• Unscored —
  CVE-2021-27989

  Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.…

  Apr 14, 2021
• Low 3.3
  CVE-2021-25316

  Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-tools

  A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions …

  SUSE SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server 15-SP2 Linux
  Apr 14, 2021
• Critical 9.8
  CVE-2021-28797

  Stack Buffer Overflow in Surveillance Station

  A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following ver…

  QNAP Systems Surveillance Station
  Apr 14, 2021
• Unscored —
  CVE-2017-20004

  In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards…

  rustc Debian
  Apr 14, 2021
• Unscored —
  CVE-2020-36323

  In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialize…

  rustc rustc rust chromium-rust Debian Ubuntu Alpine
  Apr 14, 2021
• Unscored —
  CVE-2018-25008

  In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchroni…

  rustc Debian
  Apr 14, 2021
• Unscored —
  CVE-2020-36322

  An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 14, 2021
• Unscored —
  CVE-2021-31152 Public exploit

  Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can en…

  Apr 14, 2021
• Unscored —
  CVE-2021-31162

  In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the el…

  rustc rustc rust chromium-rust Debian Ubuntu Alpine
  Apr 14, 2021
• Unscored —
  CVE-2021-27815

  NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and ea…

  exif exif Debian Ubuntu
  Apr 14, 2021
• Unscored —
  CVE-2021-24028

  An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code …

  Facebook Facebook Thrift
  Apr 13, 2021
• Unscored —
  CVE-2021-29370

  A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent sc…

  Apr 13, 2021
• Critical 9.4
  CVE-2019-10881

  Default hidden Privileged Account Vulnerability in multiple XEROX devices

  Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disa…

  Xerox Phaser 6700 WorkCentre 7220/7225 WorkCentre 5735/5740/5745/5755/5765/5775/5790
  Apr 13, 2021
• Medium 4.5
  CVE-2021-3473

  An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/res…

  Lenovo XClarity Controller (XCC)
  Apr 13, 2021
• Medium 5.5
  CVE-2021-3462

  A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, tha…

  Lenovo Power Management Driver for Windows 10 Windows
  Apr 13, 2021
• Medium 4.2
  CVE-2021-3463

  A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54,…

  Lenovo Power Management Driver for Windows 10 Windows
  Apr 13, 2021
• High 8.1
  CVE-2021-3460

  The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communica…

  Motorola MH702x
  Apr 13, 2021
• High 8.4
  CVE-2021-29440 Public exploit EPSS 30%

  Twig allowing dangerous PHP functions by default

  Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code executio…

  getgrav grav getgrav/grav Packagist
  Apr 13, 2021
• High 7.2
  CVE-2021-29439

  Plugins can be installed with minimal admin privileges

  The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obt…

  getgrav grav-plugin-admin
  Apr 13, 2021
• Critical 9.0
  CVE-2021-28483

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
  Apr 13, 2021
• High 8.8
  CVE-2021-28482 Public exploit EPSS 83%

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
  Apr 13, 2021
• Critical 9.8
  CVE-2021-28481 Scanner template EPSS 36%

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
  Apr 13, 2021
• Critical 9.8
  CVE-2021-28480 Public exploit Scanner template EPSS 71%

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
  Apr 13, 2021
• High 7.8
  CVE-2021-28475

  Visual Studio Code Remote Code Execution Vulnerability

  Visual Studio Code Remote Code Execution Vulnerability

  Microsoft Visual Studio Code
  Apr 13, 2021
• High 7.0
  CVE-2021-28477

  Visual Studio Code Remote Code Execution Vulnerability

  Visual Studio Code Remote Code Execution Vulnerability

  Microsoft Visual Studio Code
  Apr 13, 2021
• High 7.8
  CVE-2021-28473

  Visual Studio Code Remote Code Execution Vulnerability

  Visual Studio Code Remote Code Execution Vulnerability

  Microsoft Visual Studio Code
  Apr 13, 2021
• High 7.8
  CVE-2021-28472 EPSS 62%

  Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability

  Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability

  Microsoft Visual Studio Code - Maven for Java Extension
  Apr 13, 2021
• High 7.8
  CVE-2021-28471

  Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability

  Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability

  Microsoft Visual Studio Code
  Apr 13, 2021
• High 7.8
  CVE-2021-28470

  Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability

  Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability

  Microsoft Visual Studio Code - GitHub Pull Requests and Issues Extension
  Apr 13, 2021