# Vulnerabilities published in 2021


- [CVE-2021-39263](https://insights.sbomify.com/CVE-2021-39263/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39262](https://insights.sbomify.com/CVE-2021-39262/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39261](https://insights.sbomify.com/CVE-2021-39261/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39260](https://insights.sbomify.com/CVE-2021-39260/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39259](https://insights.sbomify.com/CVE-2021-39259/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39258](https://insights.sbomify.com/CVE-2021-39258/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39257](https://insights.sbomify.com/CVE-2021-39257/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2021-39256](https://insights.sbomify.com/CVE-2021-39256/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39255](https://insights.sbomify.com/CVE-2021-39255/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39254](https://insights.sbomify.com/CVE-2021-39254/): Integer overflow in debian:debian linux (medium 6.7)
- [CVE-2021-39253](https://insights.sbomify.com/CVE-2021-39253/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39252](https://insights.sbomify.com/CVE-2021-39252/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-39251](https://insights.sbomify.com/CVE-2021-39251/): Null dereference in debian:debian linux (medium 6.7)
- [CVE-2021-39250](https://insights.sbomify.com/CVE-2021-39250/): Cross-site scripting in invisioncommunity:invision power board (medium 5.4)
- [CVE-2021-39249](https://insights.sbomify.com/CVE-2021-39249/): Cross-site scripting in invisioncommunity:invision power board (medium 6.1)
- [CVE-2021-39248](https://insights.sbomify.com/CVE-2021-39248/): Cross-site scripting in edx:edx-platform (medium 6.1)
- [CVE-2021-39247](https://insights.sbomify.com/CVE-2021-39247/): Memory corruption in zint:barcode generator (medium 6.5)
- [CVE-2021-39246](https://insights.sbomify.com/CVE-2021-39246/): Information disclosure in torproject:tor browser (medium 6.1)
- [CVE-2021-39245](https://insights.sbomify.com/CVE-2021-39245/): Hardcoded credentials in altus:hadron xtorm hx3040 firmware (high 7.5)
- [CVE-2021-39244](https://insights.sbomify.com/CVE-2021-39244/): Command injection in altus:hadron xtorm hx3040 firmware (high 8.8)
- [CVE-2021-39243](https://insights.sbomify.com/CVE-2021-39243/): Cross-site request forgery in altus:hadron xtorm hx3040 firmware (medium 6.5)
- [CVE-2021-39242](https://insights.sbomify.com/CVE-2021-39242/): Other in debian:debian linux (high 7.5)
- [CVE-2021-39241](https://insights.sbomify.com/CVE-2021-39241/): Security feature bypass in debian:debian linux (medium 5.3)
- [CVE-2021-39240](https://insights.sbomify.com/CVE-2021-39240/): Security feature bypass in debian:debian linux (high 7.5)
- [CVE-2021-3924](https://insights.sbomify.com/CVE-2021-3924/): Path Traversal in getgrav/grav (high 8.8)
- [CVE-2021-39239](https://insights.sbomify.com/CVE-2021-39239/): XML External Entity (XXE) vulnerability (high 7.5)
- [CVE-2021-39238](https://insights.sbomify.com/CVE-2021-39238/): Memory corruption in HP Enterprise LaserJet; HP LaserJet Managed; HP Enterprise PageWide; HP PageWide Managed printers (critical 9.8)
- [CVE-2021-39237](https://insights.sbomify.com/CVE-2021-39237/): Information disclosure in HP LaserJet; HP LaserJet Managed; HP PageWide; HP PageWide Managed printers (medium 4.6)
- [CVE-2021-39236](https://insights.sbomify.com/CVE-2021-39236/): Owners of the S3 tokens are not validated (high 8.8)
- [CVE-2021-39235](https://insights.sbomify.com/CVE-2021-39235/): Access mode of block tokens are not enforced (medium 6.5)
- [CVE-2021-39234](https://insights.sbomify.com/CVE-2021-39234/): Raw block data can be read bypassing ACL/authorization (medium 6.8)
- [CVE-2021-39233](https://insights.sbomify.com/CVE-2021-39233/): Container-related datanode operations can be called without authorization (critical 9.1)
- [CVE-2021-39232](https://insights.sbomify.com/CVE-2021-39232/): Missing admin check for SCM related admin commands (high 8.8)
- [CVE-2021-39231](https://insights.sbomify.com/CVE-2021-39231/): Missing authentication/authorization on internal RPC endpoints (critical 9.1)
- [CVE-2021-39230](https://insights.sbomify.com/CVE-2021-39230/): Error in JPNS kernel of Butter (high 8.8)
- [CVE-2021-3923](https://insights.sbomify.com/CVE-2021-3923/): Information disclosure in kernel (low 2.3)
- [CVE-2021-39229](https://insights.sbomify.com/CVE-2021-39229/): Regular expression deinal of service in apprise (high 7.5)
- [CVE-2021-39228](https://insights.sbomify.com/CVE-2021-39228/): Memory Safety Issue when using patch or merge on state and assign the result back to state (medium 6.5)
- [CVE-2021-39227](https://insights.sbomify.com/CVE-2021-39227/): Fix prototype pollution in the zrender merge and clone helper methods (medium 6.2)
- [CVE-2021-39226](https://insights.sbomify.com/CVE-2021-39226/): Grafana Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2021-39225](https://insights.sbomify.com/CVE-2021-39225/): Missing permission check on Deck API (high 8.1)
- [CVE-2021-39224](https://insights.sbomify.com/CVE-2021-39224/): File path disclosure of shared files in OfficeOnline application (low 3.5)
- [CVE-2021-39223](https://insights.sbomify.com/CVE-2021-39223/): File path disclosure of shared files in Richdocuments application (medium 4.8)
- [CVE-2021-39222](https://insights.sbomify.com/CVE-2021-39222/): XSS in Talk (medium 6.4)
- [CVE-2021-39221](https://insights.sbomify.com/CVE-2021-39221/): XSS in Contacts (medium 6.4)
- [CVE-2021-39220](https://insights.sbomify.com/CVE-2021-39220/): Bypass of image blocking in Nextcloud Mail (low 3.5)
- [CVE-2021-3922](https://insights.sbomify.com/CVE-2021-3922/): Race condition in IMController (high 7.8)
- [CVE-2021-39219](https://insights.sbomify.com/CVE-2021-39219/): Wrong type for `Linker`-define functions when used across two `Engine`s (medium 6.3)
- [CVE-2021-39218](https://insights.sbomify.com/CVE-2021-39218/): Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime (medium 6.3)
- [CVE-2021-39217](https://insights.sbomify.com/CVE-2021-39217/): OpenMage LTS arbitrary command execution in custom layout update through blocks (high 7.2)
- [CVE-2021-39216](https://insights.sbomify.com/CVE-2021-39216/): Use after free passing `externref`s to Wasm in Wasmtime (medium 6.3)
- [CVE-2021-39215](https://insights.sbomify.com/CVE-2021-39215/): Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms (high 7.5)
- [CVE-2021-39214](https://insights.sbomify.com/CVE-2021-39214/): Lacking Protection against HTTP Request Smuggling in mitmproxy (high 8.1)
- [CVE-2021-39213](https://insights.sbomify.com/CVE-2021-39213/): IP restriction on GLPI API Bypass with custom header injection (medium 6.8)
- [CVE-2021-39212](https://insights.sbomify.com/CVE-2021-39212/): Issue when Configuring the ImageMagick Security Policy (medium 4.4)
- [CVE-2021-39211](https://insights.sbomify.com/CVE-2021-39211/): Disclosure of GLPI and server information in telemetry endpoint (medium 5.3)
- [CVE-2021-39210](https://insights.sbomify.com/CVE-2021-39210/): Autologin cookie accessible by scripts (medium 6.5)
- [CVE-2021-3921](https://insights.sbomify.com/CVE-2021-3921/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (medium 5.4)
- [CVE-2021-39209](https://insights.sbomify.com/CVE-2021-39209/): Bypassable CSRF protection (high 8.8)
- [CVE-2021-39208](https://insights.sbomify.com/CVE-2021-39208/): WriteEntryToDirectory used for an archive extraction is vulnerable to partial path traversal. (medium 4.3)
- [CVE-2021-39207](https://insights.sbomify.com/CVE-2021-39207/): Deserialization of Untrusted Data in parlai (high 8.4)
- [CVE-2021-39206](https://insights.sbomify.com/CVE-2021-39206/): Incorrect Authorization with specially crafted requests (high 8.6)
- [CVE-2021-39205](https://insights.sbomify.com/CVE-2021-39205/): DOM-based XSS/Content Spoofing via Prototype Pollution (medium 6.8)
- [CVE-2021-39204](https://insights.sbomify.com/CVE-2021-39204/): Excessive CPU usage in Pomerium (high 7.5)
- [CVE-2021-39203](https://insights.sbomify.com/CVE-2021-39203/): Private data disclosure/privilege escalation through the block editor in Wordpress (medium 6.8)
- [CVE-2021-39202](https://insights.sbomify.com/CVE-2021-39202/): WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget (high 7.6)
- [CVE-2021-39201](https://insights.sbomify.com/CVE-2021-39201/): Authenticated cross-site scripting (XSS) in WordPress editor (high 7.6)
- [CVE-2021-39200](https://insights.sbomify.com/CVE-2021-39200/): Information Disclosure in wp_die() via JSONP in wordpress (medium 5.3)
- [CVE-2021-3920](https://insights.sbomify.com/CVE-2021-3920/): Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin (medium 4.6)
- [CVE-2021-39199](https://insights.sbomify.com/CVE-2021-39199/): Cross site scripting via unsafe defaults in remark-html (critical 10.0)
- [CVE-2021-39198](https://insights.sbomify.com/CVE-2021-39198/): The disqualify lead action may be executed without CSRF token check (medium 4.2)
- [CVE-2021-39197](https://insights.sbomify.com/CVE-2021-39197/): Cross-Site Request Forgery in better_errors (medium 6.3)
- [CVE-2021-39196](https://insights.sbomify.com/CVE-2021-39196/): Authenticated non-privileged user can request unfiltered data without adequate permissions in pcapture (high 7.7)
- [CVE-2021-39195](https://insights.sbomify.com/CVE-2021-39195/): Server-Side Request Forgery vulnerability in misskey (high 7.7)
- [CVE-2021-39194](https://insights.sbomify.com/CVE-2021-39194/): Denial of service while parsing polymorphic input with tagged polymorphism style in kaml (medium 4.3)
- [CVE-2021-39193](https://insights.sbomify.com/CVE-2021-39193/): Transaction validity oversight in pallet-ethereum (medium 5.3)
- [CVE-2021-39192](https://insights.sbomify.com/CVE-2021-39192/): Privilege escalation: all users can access Admin-level API keys (medium 6.5)
- [CVE-2021-39191](https://insights.sbomify.com/CVE-2021-39191/): URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc (medium 4.7)
- [CVE-2021-39190](https://insights.sbomify.com/CVE-2021-39190/): SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2021-3919](https://insights.sbomify.com/CVE-2021-3919/): Privilege escalation in OMEN Gaming Hub and HP Command Center (critical 9.8)
- [CVE-2021-39189](https://insights.sbomify.com/CVE-2021-39189/): Observable Response Discrepancy in Lost Password Service (medium 5.3)
- [CVE-2021-39187](https://insights.sbomify.com/CVE-2021-39187/): Crash server with query parameter (high 7.5)
- [CVE-2021-39186](https://insights.sbomify.com/CVE-2021-39186/): Improper Input Validation in GlobalNewFiles (medium 4.3)
- [CVE-2021-39185](https://insights.sbomify.com/CVE-2021-39185/): Default CORS config allows any origin with credentials (critical 9.1)
- [CVE-2021-39184](https://insights.sbomify.com/CVE-2021-39184/): Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API (medium 6.8)
- [CVE-2021-39183](https://insights.sbomify.com/CVE-2021-39183/): Unsafe inline XSS Owncast (high 8.2)
- [CVE-2021-39182](https://insights.sbomify.com/CVE-2021-39182/): Improper hashing in enrocrypt (high 7.5)
- [CVE-2021-39181](https://insights.sbomify.com/CVE-2021-39181/): Unsafe Deserialization of User Data Using XStream (high 8.8)
- [CVE-2021-39180](https://insights.sbomify.com/CVE-2021-39180/): Path Traversal in Archive Handling Leading to Code Execution (high 8.1)
- [CVE-2021-3918](https://insights.sbomify.com/CVE-2021-3918/): Prototype Pollution in kriszyp/json-schema (critical 9.8)
- [CVE-2021-39179](https://insights.sbomify.com/CVE-2021-39179/): SQL Injection in DHIS2 Tracker API (high 8.8)
- [CVE-2021-39178](https://insights.sbomify.com/CVE-2021-39178/): XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0 (high 7.5)
- [CVE-2021-39177](https://insights.sbomify.com/CVE-2021-39177/): User impersonation due to incorrect handling of the login JWT (high 7.4)
- [CVE-2021-39176](https://insights.sbomify.com/CVE-2021-39176/): Missing Release of Memory after Effective Lifetime in detect-character-encoding (high 7.5)
- [CVE-2021-39175](https://insights.sbomify.com/CVE-2021-39175/): XSS vector in slide mode speaker-view (high 8.1)
- [CVE-2021-39174](https://insights.sbomify.com/CVE-2021-39174/): Configuration leak (high 8.8)
- [CVE-2021-39173](https://insights.sbomify.com/CVE-2021-39173/): Forced reinstall (high 8.8)
- [CVE-2021-39172](https://insights.sbomify.com/CVE-2021-39172/): New line injection during configuration edition (high 8.8)
- [CVE-2021-39171](https://insights.sbomify.com/CVE-2021-39171/): Unlimited transforms allowed for signed nodes (medium 5.3)
- [CVE-2021-39170](https://insights.sbomify.com/CVE-2021-39170/): Improper Encoding or Escaping of Output in Asset Metadata Component (high 8.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/107/