CVEs published in April 2021
1,956 vulnerabilities, 217 critical, 16 exploited.
- devolutions serverAn overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS...6.5 Medium
- stackpath ajaxsearchproAjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database...7.2 High
- joomla joomla\!, joomla! project cms +1 more[20210402] - Core - Inadequate filters on module layout settings5.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20210401] - Core - Escape xss in logo parameter error pages6.1 Medium
- jazzband django debug toolbarSQL Injection via in django-debug-toolbar9.8 Critical
- intelbras win 300 firmware, wrn 342 firmware +1 moreThe web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote...7.5 High
- fedoraproject fedora, yubico yubihsm connector +1 moreInfinite loop in Yubico yubihsm-connector7.5 High
- totolink a720r firmware, x5000r firmware +1 moreCommand Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK...9.8 Critical
- monicahq monicaCross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.5.4 Medium
- lavaliteCross Site Scripting (XSS) in LavaLite 5.8.05.4 Medium
- tibco messaging - eclipse mosquitto distribution - bridge, tibco software inc. messaging - eclipse mosquitto distribution - bridge - community edition, messaging - eclipse mosquitto distribution - bridge - enterprise edition +2 moreTIBCO Messaging - Eclipse Mosquitto Distribution - Bridge Windows Platform Installation vulnerability8.8 High
- tibco messaging - eclipse mosquitto distribution - core, tibco software inc. messaging - eclipse mosquitto distribution - core - community edition, messaging - eclipse mosquitto distribution - core - enterprise edition +2 moreTIBCO Messaging - Eclipse Mosquitto Distribution - Core Windows Platform Installation vulnerability8.8 High
- group-office group officeA Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote...5.3 Medium
- group-office group officeCross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted...5.4 Medium
- group-office group officeCross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.6.1 Medium
- entropymine dearkIn Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the...5.5 Medium
- entropymine dearkIn Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src...5.5 Medium
- parallels desktopThis vulnerability allows local attackers to disclose sensitive information on affected...3.2 Low
- parallels desktopThis vulnerability allows local attackers to escalate privileges on affected installations of...7.8 High
- solarwinds orion platformThis vulnerability allows remote attackers to execute escalate privileges on affected...9.8 Critical
- netgear r7800, br200 firmware, br500 firmware +41 more +43 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...8.8 High
- netgear r7800, r7800 firmware, br200 firmware +41 more +43 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...8.8 High
- netgear r7800, br200 firmware, br500 firmware +41 more +43 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...8.8 High
- d-link dap-2020, dlink dap-2020 firmware +1 moreThis vulnerability allows network-adjacent attackers to disclose sensitive information on...6.5 Medium
- d-link dap-2020, dlink dap-2020 firmware +1 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...8.8 High
- d-link dap-2020, dlink dap-2020 firmware +1 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...8.8 High
- tencent wechatThis vulnerability allows remote attackers to disclose sensitive information on affected...6.5 Medium
- tp-link ac1750, ac1750 firmware +1 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...8.0 High
- totolink a720r firmware, x5000r firmware +1 moreCommand Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK...9.8 Critical
- tenda g1 firmware, g3 firmware +1 moreBuffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote...9.8 Critical
- janobe online reviewer systemOnline Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass,...9.8 Critical
- forescout counteractAn issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation...7.8 High
- tenda g1 firmware, g3 firmware +1 moreBuffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows...9.8 Critical
- tenda g1 firmware, g3 firmware +1 moreBuffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote...9.8 Critical
- razer synapseMultiple system services installed alongside the Razer Synapse 3 software suite perform...5.5 Medium
- razer synapseMultiple system services installed alongside the Razer Synapse 3 software suite perform...5.5 Medium
- orchardproject orchardAn issue was discovered in Orchard before 1.10. The Media Settings Allowed File Types list field...5.4 Medium
- sap setupAn unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during...7.5 High
- orchardproject orchardAn issue was discovered in Orchard before 1.10. A broken access control issue in Orchard...9.8 Critical
- sap netweaver process integration, sap se process integration (integration builder framework) +1 moreSAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework)...6.5 Medium
- sap netweaver process integration, sap se process integration (enterprise service repository java mappings) +1 moreIn order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP...7.7 High
- appspaceAppspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet...7.5 High
- jitsi meetCross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the ...6.1 Medium
- shopxoIncorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges...9.8 Critical
- dlink dir-816 firmwareAn issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the...9.8 Critical
- dlink dir-816 firmwareAn issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used...9.8 Critical
- tp-link tl-wr2041\+ firmwareBuffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers...7.5 High
- uclouvain openjpeg, debian linux, fedoraproject fedora +2 moreInteger Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a...5.5 Medium
- gpacNULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5...9.8 Critical
- tsmuxer project tsmuxerBuffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running...5.5 Medium
- Show moreLoading…