CVEs published in April 2021
1,956 vulnerabilities, 217 critical, 16 exploited.
- mblog project mblogCross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.5.4 Medium
- mblog project mblogCross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.5.4 Medium
- mblog project mblogCross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.5.4 Medium
- flycms project flycmsServer Side Request Forgery (SSRF) vulnerability in saveUrlAs function in ImagesService.java in...7.5 High
- vmware carbon black cloud workloadVMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass...9.1 Critical
- hpe superdome flex server, superdome flex server firmware +1 moreA potential security vulnerability has been identified in HPE Superdome Flex server. A denial of...6.5 Medium
- hpe integrated lights-out amplifierA potential security vulnerability has been identified in HPE iLO Amplifier Pack. The...6.1 Medium
- pega infinity, pegasystems pega infinity +1 moreMisconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead...6.6 Medium
- atlassian confluence data center, confluence server +1 moreThe WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6...4.3 Medium
- zohocorp manageengine opmanagerManage Engine OpManager builds below 125346 are vulnerable to a remote denial of service...9.1 Critical
- kaspersky internet securityKIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker...5.5 Medium
- gocdIn GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing...8.8 High
- huawei emui, magic ui +1 moreAn application bypass mechanism vulnerability exists in a component interface of Huawei...5.5 Medium
- huawei emui, magic ui +1 moreAn application error verification vulnerability exists in a component interface of Huawei...5.5 Medium
- huawei emui, magic ui +1 moreA memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local...5.5 Medium
- huawei emui, magic ui +1 moreA memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local...7.8 High
- storage project storage, fedoraproject fedora, redhat enterprise linux +1 more +3 moreImproper Locking in github.com/containers/storage6.5 Medium
- gitlab gitlab-vscode-extensionClient side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to...8.6 High
OpenIPMISUSESecurity update for OpenIPMINo score- eclipse jetty, the eclipse foundation eclipse jetty, jenkins +19 more +21 moreJetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources7.5 High
- eclipse jetty, the eclipse foundation eclipse jetty, netapp cloud manager +15 more +17 moreAuthorization Before Parsing and Canonicalization in jetty5.3 Medium
- eclipse jetty, the eclipse foundation eclipse jetty, apache ignite +21 more +23 moreDirectory exposure in jetty2.7 Low
- gitlabPotential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which...4.3 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAcrobat Reader DC Missing Support for Integrity Check6.5 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAcrobat Reader DC Missing Support for Integrity Check8.1 High
rusttypecrates.iorusttype is UnmaintainedNo score- synology diskstation manager, diskstation manager (dsm) +1 moreImproper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in...7.2 High
- btcpayserver btcpay serverBTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server...6.5 Medium
- atlassian data center, jira, jira server +1 more +3 moreThe membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from...5.3 Medium
- atlassian data center, jira, jira server +1 more +3 moreThe SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from...3.5 Low
- atlassian data center, jira, jira server +1 more +3 moreThe /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from...5.3 Medium
- red hat ansible, redhat ansible tower, fedoraproject fedora +2 moreA flaw was found in several ansible modules, where parameters containing credentials, such as...5.5 Medium
- pikepdf project pikepdf, fedoraproject fedora +1 moreImproper Restriction of XML External Entity Reference in pikepdf7.5 High
- academysoftwarefoundation openexr, debian linux +1 moreA flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an...5.3 Medium
- google androidIn decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer...5.5 Medium
- google androidIn LK, there is a possible escalation of privilege due to an insecure default value. This could...6.6 Medium
- google androidIn ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking...7.3 High
- google androidIn start of WelcomeActivity.java, there is a possible residual profile due to a confused deputy....7.8 High
- google androidIn onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent....5.5 Medium
- google androidIn several functions of ScreenshotHelper.java and related files, there is a possible incorrectly...4.7 Medium
- google androidIn updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control...7.8 High
- google androidIn setPowerModeWithHandle of com_android_server_power_PowerManagerService.cpp, there is a...7.8 High
- google androidIn several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there...7.8 High
- google androidIn setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local...7.8 High
- google androidIn CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to...5.5 Medium
- google androidIn avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to...7.5 High
- google androidIn onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when...8.0 High
- google androidIn ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a...7.0 High
- google androidIn avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds...7.5 High
- google androidIn rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing...9.8 Critical
- Show moreLoading…