CVEs published in April 2021
1,956 vulnerabilities, 217 critical, 16 exploited.
- tribalsystems zenarioSQL Injection in tribalsystems/zenario9.1 Critical
- adobe genuine service, gocart +1 moreAdobe Genuine Service privilege escalation vulnerability6.5 Medium
- adobe genuine service, gocart +1 moreAGSService program mishandling symbolic links7.8 High
- adobe genuine service, gocart +1 moreUncontrolled Search Path Element in AGSService.exe6.5 Medium
- ibm spectrum protect server, spectrum protect +1 moreIBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by...4.4 Medium
- google bazel, google llc vscode-bazel +1 moreCode execution in VSCode-bazel via malicious Bazel config files8.2 High
- rpm spec project specThe unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code...9.8 Critical
- atlassian connect spring boot (acsb), connect spring boot +1 moreBroken Authentication in Atlassian Connect Spring Boot6.5 Medium
- atlassian connect express (ace), connect express +1 moreBroken Authentication in Atlassian Connect Express7.7 High
- qnap qts, quts hero, qutscloud +2 moreCross-site Scripting Vulnerability in File Station6.1 Medium
c-blosc2OSS-FuzzHeap-buffer-overflow in frame_get_metalayersNo scorec-blosc2OSS-FuzzHeap-buffer-overflow in blosc_dNo scoresmarty3Debiansmarty3 - regression updateNo score- tendacn g0 firmware, g1 firmware, g3 firmware +2 moreCommand Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5...9.8 Critical
- tendacn g1 firmware, g3 firmware +1 moreCommand Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15...9.8 Critical
- filecoin lotusBLS Signature "Malleability"5.9 Medium
- wordpress, debian linux, wordpress wordpress-develop +2 moreWordPress Authenticated disclosure of password-protected posts and pages6.5 Medium
- wordpress, debian linux, wordpress wordpress-develop +2 moreWordPress Authenticated XXE attack when installation is running PHP 87.1 High
- matrix sydentSSRF in Sydent due to missing validation of hostnames7.7 High
- matrix sydentMalicious users could control the content of invitation emails5.3 Medium
- matrix sydentDenial of service attack via memory exhaustion7.5 High
- apache openofficeCode execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks8.8 High
chromium-browser-stableMageiaUpdated chromium-browser-stable package fixes security vulnerabilitiesNo scoregstreamer1.0-libavMageia,gstreamer1.0-plugins-goodMageia,gstreamer1.0-plugins-uglyMageia +2 moreUpdated gstreamer1.0 packages fix security vulnerabilitiesNo score- centreonPredictable CSRF tokens in centreon/centreon6.5 Medium
- flutterchina diodio vulnerable to CRLF injection with HTTP method string7.5 High
- resourcexpressIn QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific...5.3 Medium
- matrix sydentDenial of service (via resource exhaustion) due to improper input validation4.3 Medium
- hp icewall sso dgfwA security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on...6.1 Medium
- linux kernel, ubuntu linux kernel, canonical ubuntu linux +2 moreThe overlayfs implementation in the linux kernel did not properly validate with respect to user...8.8 High
- canonical ubuntu linux, ubuntu linux kernel +1 moreUbuntu linux kernel shiftfs file system double free vulnerability8.8 High
- wfiltericf wfilter internet content filterWfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same...6.1 Medium
- pi-hole, pi-hole web interface, adminlte +1 more +3 moreStored DOM XSS in Pi-hole Admin Web Interface7.6 High
- lightcms project lightcmsLightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin...9.8 Critical
- ezxml project ezxml, debian linux +1 moreAn issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs...6.5 Medium
- adobe photoshopAdobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code execution7.8 High
- adobe coldfusionColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser5.4 Medium
- adobe bridgeAdobe Bridge DCM File Parsing Memory Corruption could lead to arbitrary code execution7.8 High
- adobe bridgeAdobe Bridge HEIC File Parsing Out-Of-Bounds Read vulnerability could lead to information disclosure3.3 Low
- adobe photoshopAdobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code execution7.8 High
- adobe bridgeAdobe Bridge TTF Font Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code execution7.8 High
- adobe bridgeAdobe Bridge SGI File Parsing Memory Corruption vulnerability could lead to arbitrary code execution7.8 High
- tribalsystems zenarioreflected XSS in tribalsystems/zenario4.8 Medium
- tribalsystems zenarioSQL Injection in tribalsystems/zenario4.9 Medium
- adobe digital editionsAdobe Digital Editions Arbitrary file system write vulnerability7.8 High
- b2evolutionSQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers...8.8 High
- adobe bridgeAdobe Bridge Genuine Software Service Incorrect Permission Assignment could lead to Denial-of-Service5.5 Medium
- adobe bridgeAdobe Bridge PDF File Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code execution7.8 High
- cosori cs158-af firmwareA unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8...8.1 High
- cosori cs158-af firmwareA heap-based buffer overflow vulnerability exists in the configuration server functionality of...8.1 High
- Show moreLoading…