# Vulnerabilities published in 2021


- [CVE-2021-39376](https://insights.sbomify.com/CVE-2021-39376/): SQL injection in philips:tasy electronic medical record (high 8.8)
- [CVE-2021-39375](https://insights.sbomify.com/CVE-2021-39375/): SQL injection in philips:tasy electronic medical record (high 8.8)
- [CVE-2021-39373](https://insights.sbomify.com/CVE-2021-39373/): Information disclosure in samsung:drive manager (high 7.8)
- [CVE-2021-39371](https://insights.sbomify.com/CVE-2021-39371/): XML External Entity Injection in PyWPS (high 7.5)
- [CVE-2021-39369](https://insights.sbomify.com/CVE-2021-39369/): Path traversal in philips:myvue (medium 6.5)
- [CVE-2021-39368](https://insights.sbomify.com/CVE-2021-39368/): Cross-site scripting in canon:oce print exec workgroup (medium 6.1)
- [CVE-2021-39367](https://insights.sbomify.com/CVE-2021-39367/): Other in canon:oce print exec workgroup (medium 5.3)
- [CVE-2021-39365](https://insights.sbomify.com/CVE-2021-39365/): Security feature bypass in debian:debian linux (medium 5.9)
- [CVE-2021-39364](https://insights.sbomify.com/CVE-2021-39364/): Auth bypass in honeywell:hbw2per1 firmware (high 7.5)
- [CVE-2021-39363](https://insights.sbomify.com/CVE-2021-39363/): Other in honeywell:hbw2per1 firmware (critical 9.8)
- [CVE-2021-39362](https://insights.sbomify.com/CVE-2021-39362/): Cross-site scripting in recaptcha solver project:recaptcha solver (medium 6.1)
- [CVE-2021-39361](https://insights.sbomify.com/CVE-2021-39361/): Security feature bypass in gnome:evolution-rss (medium 5.9)
- [CVE-2021-39360](https://insights.sbomify.com/CVE-2021-39360/): Security feature bypass in fedoraproject:fedora (medium 5.9)
- [CVE-2021-39359](https://insights.sbomify.com/CVE-2021-39359/): Security feature bypass in fedoraproject:fedora (medium 5.9)
- [CVE-2021-39358](https://insights.sbomify.com/CVE-2021-39358/): Security feature bypass in fedoraproject:fedora (medium 5.9)
- [CVE-2021-39357](https://insights.sbomify.com/CVE-2021-39357/): Leaky Paywall <= 4.16.5 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39356](https://insights.sbomify.com/CVE-2021-39356/): Content Staging <= 2.0.1 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39355](https://insights.sbomify.com/CVE-2021-39355/): Indeed Job Importer <= 1.0.5 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39354](https://insights.sbomify.com/CVE-2021-39354/): Easy Digital Downloads <= 2.11.2 Authenticated Reflected Cross-Site Scripting (medium 4.8)
- [CVE-2021-39353](https://insights.sbomify.com/CVE-2021-39353/): Easy Registration Forms <= 2.1.1 Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-39352](https://insights.sbomify.com/CVE-2021-39352/): Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2021-39351](https://insights.sbomify.com/CVE-2021-39351/): WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection (high 7.7)
- [CVE-2021-39350](https://insights.sbomify.com/CVE-2021-39350/): FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-3935](https://insights.sbomify.com/CVE-2021-3935/): SQL injection in pgbouncer (high 8.1)
- [CVE-2021-39349](https://insights.sbomify.com/CVE-2021-39349/): Author Bio Box <= 3.3.1 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39348](https://insights.sbomify.com/CVE-2021-39348/): LearnPress – WordPress LMS Plugin <= 4.1.3.1 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39347](https://insights.sbomify.com/CVE-2021-39347/): Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking (medium 4.3)
- [CVE-2021-39346](https://insights.sbomify.com/CVE-2021-39346/): Google Maps Easy <= 1.9.33 Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-39345](https://insights.sbomify.com/CVE-2021-39345/): HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39344](https://insights.sbomify.com/CVE-2021-39344/): KJM Admin Notices <= 2.0.1 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39343](https://insights.sbomify.com/CVE-2021-39343/): MPL-Publisher – Self-publish your book & ebook <= 1.30.2 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39342](https://insights.sbomify.com/CVE-2021-39342/): Credova_Financial <= 1.4.8 Sensitive Information Disclosure (medium 5.3)
- [CVE-2021-39341](https://insights.sbomify.com/CVE-2021-39341/): OptinMonster <= 2.6.4 Unprotected REST-API Endpoints (high 8.2)
- [CVE-2021-39340](https://insights.sbomify.com/CVE-2021-39340/): Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-3934](https://insights.sbomify.com/CVE-2021-3934/): OS Command Injection in ohmyzsh/ohmyzsh (high 7.8)
- [CVE-2021-39339](https://insights.sbomify.com/CVE-2021-39339/): Telefication <= 1.8.0 Open Proxy and Server-Side Request Forgery (medium 5.8)
- [CVE-2021-39338](https://insights.sbomify.com/CVE-2021-39338/): MyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39337](https://insights.sbomify.com/CVE-2021-39337/): job-portal <= 0.0.1 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39336](https://insights.sbomify.com/CVE-2021-39336/): Job Manager <= 0.7.25 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39335](https://insights.sbomify.com/CVE-2021-39335/): WpGenius Job Listing <= 1.0.2 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39334](https://insights.sbomify.com/CVE-2021-39334/): Job Board Vanila Plugin <= 1.0 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39333](https://insights.sbomify.com/CVE-2021-39333/): Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content Deletion (high 8.1)
- [CVE-2021-39332](https://insights.sbomify.com/CVE-2021-39332/): Cross-site scripting in Business Manager (medium 5.5)
- [CVE-2021-3933](https://insights.sbomify.com/CVE-2021-3933/): Integer overflow in openexr (medium 5.5)
- [CVE-2021-39329](https://insights.sbomify.com/CVE-2021-39329/): JobBoardWP – Job Board Listings and Submissions <= 1.0.7 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39328](https://insights.sbomify.com/CVE-2021-39328/): Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-39327](https://insights.sbomify.com/CVE-2021-39327/): BulletProof Security <= 5.1 Sensitive Information Disclosure (medium 5.3)
- [CVE-2021-39325](https://insights.sbomify.com/CVE-2021-39325/): OptinMonster <= 2.6.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39322](https://insights.sbomify.com/CVE-2021-39322/): Easy Social Icons <= 3.0.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39321](https://insights.sbomify.com/CVE-2021-39321/): Sassy Social Share 3.3.23 PHP Object Injection (high 8.8)
- [CVE-2021-39320](https://insights.sbomify.com/CVE-2021-39320/): underConstruction <= 1.18 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-3932](https://insights.sbomify.com/CVE-2021-3932/): Cross-Site Request Forgery (CSRF) in area17/twill (medium 6.3)
- [CVE-2021-39319](https://insights.sbomify.com/CVE-2021-39319/): duoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39318](https://insights.sbomify.com/CVE-2021-39318/): H5P CSS Editor <= 1.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39317](https://insights.sbomify.com/CVE-2021-39317/): AccessPress Themes - Authenticated Malicious File Upload (high 8.8)
- [CVE-2021-39316](https://insights.sbomify.com/CVE-2021-39316/): ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure (high 7.5)
- [CVE-2021-39315](https://insights.sbomify.com/CVE-2021-39315/): Magic Post Voice <= 1.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39314](https://insights.sbomify.com/CVE-2021-39314/): WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39313](https://insights.sbomify.com/CVE-2021-39313/): Simple Image Gallery <= 1.0.6 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39312](https://insights.sbomify.com/CVE-2021-39312/): True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read (high 7.5)
- [CVE-2021-39311](https://insights.sbomify.com/CVE-2021-39311/): link-list-manager <= 1.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39310](https://insights.sbomify.com/CVE-2021-39310/): Real WYSIWYG <= 0.0.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-3931](https://insights.sbomify.com/CVE-2021-3931/): Cross-Site Request Forgery (CSRF) in snipe/snipe-it (medium 4.3)
- [CVE-2021-39309](https://insights.sbomify.com/CVE-2021-39309/): Parsian Bank Gateway for Woocommerce <= 1.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39308](https://insights.sbomify.com/CVE-2021-39308/): WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-39307](https://insights.sbomify.com/CVE-2021-39307/): Cross-site scripting in pdftron:webviewer ui (medium 6.1)
- [CVE-2021-39306](https://insights.sbomify.com/CVE-2021-39306/): Memory corruption in realtek:rtl8195am firmware (critical 9.8)
- [CVE-2021-39304](https://insights.sbomify.com/CVE-2021-39304/): Security feature bypass in proofpoint:enterprise protection (high 7.5)
- [CVE-2021-39303](https://insights.sbomify.com/CVE-2021-39303/): Server-side request forgery in jamf:jamf (critical 9.8)
- [CVE-2021-39302](https://insights.sbomify.com/CVE-2021-39302/): SQL injection in misp-project:misp (critical 9.8)
- [CVE-2021-39301](https://insights.sbomify.com/CVE-2021-39301/): Privilege escalation in BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS (high 7.8)
- [CVE-2021-39300](https://insights.sbomify.com/CVE-2021-39300/): Privilege escalation in BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS (high 7.3)
- [CVE-2021-3930](https://insights.sbomify.com/CVE-2021-3930/): Memory corruption in QEMU (medium 6.5)
- [CVE-2021-39299](https://insights.sbomify.com/CVE-2021-39299/): Privilege escalation in BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS (high 7.8)
- [CVE-2021-39298](https://insights.sbomify.com/CVE-2021-39298/): Privilege escalation in 2nd Gen EPYC (medium 6.5)
- [CVE-2021-39297](https://insights.sbomify.com/CVE-2021-39297/): Privilege escalation in BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETAIL POINT-OF-SALE SYSTEMS BIOS; WORKSTATIONS BIOS (high 7.8)
- [CVE-2021-39296](https://insights.sbomify.com/CVE-2021-39296/): Auth bypass in openbmc-project:openbmc (critical 10.0)
- [CVE-2021-39295](https://insights.sbomify.com/CVE-2021-39295/): Denial of service in openbmc-project:openbmc (high 7.5)
- [CVE-2021-39293](https://insights.sbomify.com/CVE-2021-39293/): Denial of service in golang:go (high 7.5)
- [CVE-2021-39291](https://insights.sbomify.com/CVE-2021-39291/): Information disclosure in netmodule:netmodule router software (high 8.8)
- [CVE-2021-39290](https://insights.sbomify.com/CVE-2021-39290/): Auth bypass in netmodule:netmodule router software (critical 9.8)
- [CVE-2021-3929](https://insights.sbomify.com/CVE-2021-3929/): Use after free in QEMU (high 8.2)
- [CVE-2021-39289](https://insights.sbomify.com/CVE-2021-39289/): Weak cryptography in netmodule:netmodule router software (high 7.5)
- [CVE-2021-39286](https://insights.sbomify.com/CVE-2021-39286/): Cross-site scripting in pywb (medium 6.1)
- [CVE-2021-39285](https://insights.sbomify.com/CVE-2021-39285/): Cross-site scripting in versa-networks:versa director (medium 6.1)
- [CVE-2021-39283](https://insights.sbomify.com/CVE-2021-39283/): Denial of service in live555:live555 (medium 5.5)
- [CVE-2021-39282](https://insights.sbomify.com/CVE-2021-39282/): Denial of service in live555:live555 (high 7.5)
- [CVE-2021-39280](https://insights.sbomify.com/CVE-2021-39280/): Command injection in korenix:jetwave 2212g firmware (high 8.8)
- [CVE-2021-3928](https://insights.sbomify.com/CVE-2021-3928/): Use of Uninitialized Variable in vim/vim (high 7.3)
- [CVE-2021-39279](https://insights.sbomify.com/CVE-2021-39279/): Command injection in moxa:oncell g3470a-lte-eu-t firmware (high 8.8)
- [CVE-2021-39278](https://insights.sbomify.com/CVE-2021-39278/): Cross-site scripting in moxa:oncell g3470a-lte-eu-t firmware (medium 6.1)
- [CVE-2021-39275](https://insights.sbomify.com/CVE-2021-39275/): ap_escape_quotes buffer overflow (critical 9.8)
- [CVE-2021-39274](https://insights.sbomify.com/CVE-2021-39274/): Misconfiguration in xerosecurity:sn1per (critical 9.8)
- [CVE-2021-39273](https://insights.sbomify.com/CVE-2021-39273/): Misconfiguration in xerosecurity:sn1per (high 8.8)
- [CVE-2021-39272](https://insights.sbomify.com/CVE-2021-39272/): Weak cryptography in fedoraproject:fedora (medium 5.9)
- [CVE-2021-39271](https://insights.sbomify.com/CVE-2021-39271/): Code injection in bscw:bscw classic (high 8.8)
- [CVE-2021-39270](https://insights.sbomify.com/CVE-2021-39270/): Auth bypass in RSA SecurID Integration Kit (high 7.5)
- [CVE-2021-3927](https://insights.sbomify.com/CVE-2021-3927/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2021-39268](https://insights.sbomify.com/CVE-2021-39268/): Cross-site scripting in salesagility:suitecrm (medium 6.1)
- [CVE-2021-39267](https://insights.sbomify.com/CVE-2021-39267/): Cross-site scripting in salesagility:suitecrm (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/106/