CVEs published in April 2021
1,956 vulnerabilities, 217 critical, 16 exploited.
- budget management system project management systemA stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0...5.4 Medium
- xinfu oa systemSQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information...7.5 High
- phpshe mall systemSQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by...9.8 Critical
- equipment inventory system project inventory systemMultiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory...5.4 Medium
- sonatype nexus repository managerA cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x...6.1 Medium
- huawei p30, p30 firmware +1 moreThere is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not...7.5 High
- huawei cloudengine 12800 firmware, cloudengine 5800 firmware, cloudengine 6800 firmware +1 more +3 moreThere is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine...7.5 High
- rkyv project rkyvUse of uninitialized buffer in rkyv7.5 High
- huawei p30, p30 firmware +1 moreThere is an out of bounds write vulnerability in Huawei Smartphone HUAWEI P30 versions 9.1.0.131...6.5 Medium
- huawei cloudengine 5800, cloudengine 12800 firmware, cloudengine 6800 firmware +1 more +3 moreThere is a denial of service vulnerability in some versions of CloudEngine 5800, CloudEngine 6800...7.5 High
- huawei p30, p30 firmware +1 moreThere is an arbitrary memory write vulnerability in Huawei smart phone when processing file...6.5 Medium
- microfocus application performance managementAn arbitrary code execution vulnerability exists in Micro Focus Application Performance...9.8 Critical
- merit lilin ent.co.,ltd. p2/z2/p3/z3 ip camera firmware, meritlilin p2g1022 firmware, p2g1022x firmware +39 more +41 moreMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-25.3 Medium
- merit lilin ent.co.,ltd. p2/z2/p3/z3 ip camera firmware, meritlilin p2g1022 firmware, p2g1022x firmware +39 more +41 moreMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-19.8 Critical
- merit lilin ent.co.,ltd. p2/z2/p3/z3 ip camera firmware, meritlilin p2g1022 firmware, p2g1022x firmware +39 more +41 moreMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication9.8 Critical
- merit lilin ent.co.,ltd. p2/z2/p3/z3 ip camera firmware, meritlilin p2g1022 firmware, p2g1022x firmware +39 more +41 moreMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection7.2 High
gdmSUSESecurity update for gdmNo score- synology antivirus essentialExternally controlled reference to a resource in another sphere in quarantine functionality in...9.0 Critical
- pfsensepfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.6.1 Medium
- dynamic content elements project content elementsSQL Injection in t3/dce4.9 Medium
- yoast seoServer-Side Request Forgery in yoast_seo6.4 Medium
- media2click project media2clickCross-site scripting in media2click5.4 Medium
- redmine, debian linux +1 moreInsufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x...7.5 High
- redmine, debian linux +1 moreRedmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the...5.3 Medium
- redmine, debian linux +1 moreRedmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the...5.3 Medium
- redmine, debian linux +1 moreRedmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal...5.3 Medium
- layer5 mesheryA SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to...9.8 Critical
- phpmailer project phpmailer, wordpress +1 moreObject injection in PHPMailer/PHPMailer9.8 Critical
- google google\/apple exposure notificationsGAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to...3.3 Low
- buffalo bhr-4grv firmware, dwr-hp-g300nh firmware, fs-600dhp firmware +22 more +24 moreImproper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99...8.8 High
- buffalo bhr-4grv firmware, dwr-hp-g300nh firmware, fs-600dhp firmware +22 more +24 moreDisclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband...4.3 Medium
- buffalo bhr-4rv firmware, fs-g54 firmware, wbr-b11 firmware +33 more +35 moreHidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS...9.8 Critical
wasm3OSS-FuzzUNKNOWN WRITE in m3_FreeModuleNo scorewasm3OSS-FuzzUNKNOWN READ in m3_ReallocNo scorecurlOSS-FuzzUNKNOWN READ in ntlm_decode_type2_targetNo scorekimageformatsOSS-FuzzStack-buffer-overflow in XCFImageFormat::loadTileRLENo score- isc bind, debian linux, isc bind9 +12 more +14 moreA second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack8.1 High
- isc bind, debian linux, fedoraproject fedora +14 more +16 moreAn assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself7.5 High
- isc bind, debian linux, fedoraproject fedora +13 more +15 moreA broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly6.5 Medium
- psf requestsInsecure Deserialization of untrusted data in rmccue/requests9.8 Critical
- composer, debian linux, fedoraproject fedora +2 moreMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer8.8 High
- getkirby kirbyCross-site scripting (XSS) from unsanitized uploaded SVG files7.6 High
- alibaba nacosAuthentication bypass8.6 High
- alibaba nacosAuthentication bypass8.6 High
- openapi-generator openapi generator, openapitools openapi-generator +1 moreCreation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin4.0 Medium
- apache ofbizUnsafe deserialization in Apache OFBiz9.8 Critical
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI9.8 Critical
- benjaminkott bootstrap package, typo3 +1 moreCross-Site Scripting in Content Rendering5.4 Medium
- apache tapestryAn Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later7.5 High
- homeautomation project homeautomationHomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP...9.8 Critical
- Show moreLoading…