# Vulnerabilities published in 2021


- [CVE-2021-3917](https://insights.sbomify.com/CVE-2021-3917/): coreos-installer < 0.10.0 writes world-readable Ignition config to installed system (medium 5.5)
- [CVE-2021-39169](https://insights.sbomify.com/CVE-2021-39169/): XSS vulnerability using dialog (high 8.0)
- [CVE-2021-39168](https://insights.sbomify.com/CVE-2021-39168/): TimelockController vulnerability in OpenZeppelin Contracts (critical 10.0)
- [CVE-2021-39167](https://insights.sbomify.com/CVE-2021-39167/): TimelockController vulnerability in OpenZeppelin Contracts (critical 10.0)
- [CVE-2021-39166](https://insights.sbomify.com/CVE-2021-39166/): Improper Neutralization of Text-Values in Object Version Preview (high 8.0)
- [CVE-2021-39165](https://insights.sbomify.com/CVE-2021-39165/): Unauthenticated SQL Injection (high 8.1)
- [CVE-2021-39164](https://insights.sbomify.com/CVE-2021-39164/): Improper authorisation of /members discloses room membership to non-members (low 3.1)
- [CVE-2021-39163](https://insights.sbomify.com/CVE-2021-39163/): Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. (low 3.1)
- [CVE-2021-39162](https://insights.sbomify.com/CVE-2021-39162/): Incorrect handling of H2 GOAWAY + SETTINGS frames (high 8.6)
- [CVE-2021-39161](https://insights.sbomify.com/CVE-2021-39161/): Cross-site scripting via category name in Discourse (medium 4.4)
- [CVE-2021-39160](https://insights.sbomify.com/CVE-2021-39160/): Code injection in nbgitpuller (critical 9.6)
- [CVE-2021-3916](https://insights.sbomify.com/CVE-2021-3916/): Path Traversal in bookstackapp/bookstack (medium 6.5)
- [CVE-2021-39159](https://insights.sbomify.com/CVE-2021-39159/): Remote code execution in Binderhub (critical 9.6)
- [CVE-2021-39158](https://insights.sbomify.com/CVE-2021-39158/): Dependency injection in NVCaffe (high 8.8)
- [CVE-2021-39157](https://insights.sbomify.com/CVE-2021-39157/): Improper Handling of Exceptional Conditions in detect-character-encoding (high 7.5)
- [CVE-2021-39156](https://insights.sbomify.com/CVE-2021-39156/): Fragments in Path May Lead to Authorization Policy Bypass (high 8.1)
- [CVE-2021-39155](https://insights.sbomify.com/CVE-2021-39155/): Authorization Policy Bypass Due to Case Insensitive Host Comparison (high 8.3)
- [CVE-2021-39154](https://insights.sbomify.com/CVE-2021-39154/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39153](https://insights.sbomify.com/CVE-2021-39153/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39152](https://insights.sbomify.com/CVE-2021-39152/): A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling (high 8.5)
- [CVE-2021-39151](https://insights.sbomify.com/CVE-2021-39151/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39150](https://insights.sbomify.com/CVE-2021-39150/): A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling (high 8.5)
- [CVE-2021-3915](https://insights.sbomify.com/CVE-2021-3915/): Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack (high 7.6)
- [CVE-2021-39149](https://insights.sbomify.com/CVE-2021-39149/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39148](https://insights.sbomify.com/CVE-2021-39148/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39147](https://insights.sbomify.com/CVE-2021-39147/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39146](https://insights.sbomify.com/CVE-2021-39146/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39145](https://insights.sbomify.com/CVE-2021-39145/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39144](https://insights.sbomify.com/CVE-2021-39144/): XStream Remote Code Execution (high 8.5, exploited in the wild)
- [CVE-2021-39143](https://insights.sbomify.com/CVE-2021-39143/): Path Traversal in spinnaker (medium 6.6)
- [CVE-2021-39141](https://insights.sbomify.com/CVE-2021-39141/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39140](https://insights.sbomify.com/CVE-2021-39140/): XStream can cause a Denial of Service (medium 6.5)
- [CVE-2021-3914](https://insights.sbomify.com/CVE-2021-3914/): SmallRye Health UI Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2021-39139](https://insights.sbomify.com/CVE-2021-39139/): XStream is vulnerable to an Arbitrary Code Execution attack (high 8.5)
- [CVE-2021-39138](https://insights.sbomify.com/CVE-2021-39138/): New anonymous user session acts as if it's created with password (medium 4.8)
- [CVE-2021-39137](https://insights.sbomify.com/CVE-2021-39137/): Consensus flaw during block processing in go-ethereum (medium 6.5)
- [CVE-2021-39136](https://insights.sbomify.com/CVE-2021-39136/): Cross-site scripting vulnerability in file upload (high 8.7)
- [CVE-2021-39135](https://insights.sbomify.com/CVE-2021-39135/): UNIX Symbolic Link (Symlink) Following in @npmcli/arborist (high 8.2)
- [CVE-2021-39134](https://insights.sbomify.com/CVE-2021-39134/): UNIX Symbolic Link (Symlink) Following in @npmcli/arborist (high 8.2)
- [CVE-2021-39133](https://insights.sbomify.com/CVE-2021-39133/): Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server (high 7.2)
- [CVE-2021-39132](https://insights.sbomify.com/CVE-2021-39132/): YAML deserialization can run untrusted code (high 8.8)
- [CVE-2021-39131](https://insights.sbomify.com/CVE-2021-39131/): Improper Handling of Unexpected Data Type in ced (high 7.5)
- [CVE-2021-39128](https://insights.sbomify.com/CVE-2021-39128/): Code injection in Jira Data Center (high 7.2)
- [CVE-2021-39127](https://insights.sbomify.com/CVE-2021-39127/): Missing authorization in Jira Data Center (medium 5.3)
- [CVE-2021-39126](https://insights.sbomify.com/CVE-2021-39126/): Cross-site request forgery in Jira Data Center (medium 6.5)
- [CVE-2021-39125](https://insights.sbomify.com/CVE-2021-39125/): Information disclosure in Jira Data Center (medium 5.3)
- [CVE-2021-39124](https://insights.sbomify.com/CVE-2021-39124/): Cross-site request forgery in Jira Data Center (medium 4.3)
- [CVE-2021-39123](https://insights.sbomify.com/CVE-2021-39123/): Denial of service in Jira Data Center (high 7.5)
- [CVE-2021-39122](https://insights.sbomify.com/CVE-2021-39122/): Information disclosure in Jira Data Center (medium 5.3)
- [CVE-2021-39121](https://insights.sbomify.com/CVE-2021-39121/): Information disclosure in Jira Data Center (medium 4.3)
- [CVE-2021-3912](https://insights.sbomify.com/CVE-2021-3912/): OctoRPKI crashes when processing GZIP bomb returned via malicious repository (medium 4.2)
- [CVE-2021-39119](https://insights.sbomify.com/CVE-2021-39119/): Missing authorization in Jira Data Center (medium 5.3)
- [CVE-2021-39118](https://insights.sbomify.com/CVE-2021-39118/): Information disclosure in Jira Data Center (medium 5.3)
- [CVE-2021-39117](https://insights.sbomify.com/CVE-2021-39117/): Cross-site scripting in Jira Data Center (medium 4.8)
- [CVE-2021-39116](https://insights.sbomify.com/CVE-2021-39116/): Denial of service in Jira Data Center (medium 5.5)
- [CVE-2021-39115](https://insights.sbomify.com/CVE-2021-39115/): Code injection in Jira Service Desk Data Center (high 7.2)
- [CVE-2021-39114](https://insights.sbomify.com/CVE-2021-39114/): Code injection in Confluence Data Center (high 8.8)
- [CVE-2021-39113](https://insights.sbomify.com/CVE-2021-39113/): Missing authorization in Jira Data Center (high 7.5)
- [CVE-2021-39112](https://insights.sbomify.com/CVE-2021-39112/): Open redirect in Jira Data Center (medium 4.8)
- [CVE-2021-39111](https://insights.sbomify.com/CVE-2021-39111/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2021-3911](https://insights.sbomify.com/CVE-2021-3911/): Misconfigured IP address field in ROA leads to OctoRPKI crash (medium 4.2)
- [CVE-2021-39109](https://insights.sbomify.com/CVE-2021-39109/): Path traversal in atlasboard (high 7.5)
- [CVE-2021-3910](https://insights.sbomify.com/CVE-2021-3910/): NUL character in ROA causes OctoRPKI to crash (medium 4.4)
- [CVE-2021-39090](https://insights.sbomify.com/CVE-2021-39090/): IBM Cloud Pak for Security information disclosure (medium 5.9)
- [CVE-2021-3909](https://insights.sbomify.com/CVE-2021-3909/): Infinite open connection causes OctoRPKI to hang forever (medium 4.4)
- [CVE-2021-39089](https://insights.sbomify.com/CVE-2021-39089/): IBM Cloud Pak for Security information disclosure (medium 4.3)
- [CVE-2021-39088](https://insights.sbomify.com/CVE-2021-39088/): Privilege escalation in QRadar SIEM (high 7.4)
- [CVE-2021-39087](https://insights.sbomify.com/CVE-2021-39087/): Information disclosure in Sterling B2B Integrator (medium 4.3)
- [CVE-2021-39086](https://insights.sbomify.com/CVE-2021-39086/): Information disclosure in Sterling File Gateway (medium 4.3)
- [CVE-2021-39085](https://insights.sbomify.com/CVE-2021-39085/): SQL injection in Sterling B2B Integrator (medium 6.3)
- [CVE-2021-39082](https://insights.sbomify.com/CVE-2021-39082/): Weak cryptography in UrbanCode Deploy (medium 5.9)
- [CVE-2021-39081](https://insights.sbomify.com/CVE-2021-39081/): IBM Cognos Analytics Mobile information disclosure (medium 5.9)
- [CVE-2021-39080](https://insights.sbomify.com/CVE-2021-39080/): Information disclosure in Cognos Analytics Mobile (medium 4.8)
- [CVE-2021-3908](https://insights.sbomify.com/CVE-2021-3908/): Infinite certificate chain depth results in OctoRPKI running forever (medium 5.9)
- [CVE-2021-39079](https://insights.sbomify.com/CVE-2021-39079/): Cross-site scripting in Cognos Analytics Mobile (medium 5.4)
- [CVE-2021-39078](https://insights.sbomify.com/CVE-2021-39078/): Information disclosure in Security Guardium (medium 4.1)
- [CVE-2021-39077](https://insights.sbomify.com/CVE-2021-39077/): IBM Security Guardium information disclosure (medium 4.4)
- [CVE-2021-39076](https://insights.sbomify.com/CVE-2021-39076/): Weak cryptography in Security Guardium (low 3.7)
- [CVE-2021-39074](https://insights.sbomify.com/CVE-2021-39074/): Cross-site scripting in Security Guardium (medium 6.1)
- [CVE-2021-39072](https://insights.sbomify.com/CVE-2021-39072/): Misconfiguration in Security Guardium (medium 5.9)
- [CVE-2021-39070](https://insights.sbomify.com/CVE-2021-39070/): Auth bypass in ibm:security verify access (critical 9.8)
- [CVE-2021-3907](https://insights.sbomify.com/CVE-2021-3907/): Arbitrary filepath traversal via URI injection (high 7.4)
- [CVE-2021-39068](https://insights.sbomify.com/CVE-2021-39068/): Cross-site scripting in Curam Social Program Management (medium 5.4)
- [CVE-2021-39066](https://insights.sbomify.com/CVE-2021-39066/): Auth bypass in ibm:financial transaction manager (medium 6.3)
- [CVE-2021-39065](https://insights.sbomify.com/CVE-2021-39065/): Command injection in Spectrum Copy Data Management (high 8.1)
- [CVE-2021-39064](https://insights.sbomify.com/CVE-2021-39064/): Auth bypass in Spectrum Copy Data Management (medium 5.9)
- [CVE-2021-39063](https://insights.sbomify.com/CVE-2021-39063/): Misconfiguration in Spectrum Protect Plus (medium 6.5)
- [CVE-2021-3906](https://insights.sbomify.com/CVE-2021-3906/): Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack (medium 5.4)
- [CVE-2021-39059](https://insights.sbomify.com/CVE-2021-39059/): Cross-site scripting in Jazz Team Server (medium 5.4)
- [CVE-2021-39058](https://insights.sbomify.com/CVE-2021-39058/): Weak cryptography in Spectrum Copy Data Management (medium 5.9)
- [CVE-2021-39057](https://insights.sbomify.com/CVE-2021-39057/): Server-side request forgery in Spectrum Protect Plus (medium 4.2)
- [CVE-2021-39056](https://insights.sbomify.com/CVE-2021-39056/): Denial of service in i (medium 6.5)
- [CVE-2021-39055](https://insights.sbomify.com/CVE-2021-39055/): Cross-site scripting in Spectrum Copy Data Management (medium 5.4)
- [CVE-2021-39054](https://insights.sbomify.com/CVE-2021-39054/): Other in Spectrum Copy Data Management (medium 5.4)
- [CVE-2021-39053](https://insights.sbomify.com/CVE-2021-39053/): Information disclosure in Spectrum Copy Data Management (medium 5.9)
- [CVE-2021-39052](https://insights.sbomify.com/CVE-2021-39052/): Missing authorization in Spectrum Copy Data Management (medium 5.6)
- [CVE-2021-39051](https://insights.sbomify.com/CVE-2021-39051/): Server-side request forgery in Spectrum Copy Data Management (medium 4.8)
- [CVE-2021-39050](https://insights.sbomify.com/CVE-2021-39050/): Memory corruption in i2 Analyst's Notebook (medium 5.3)
- [CVE-2021-3905](https://insights.sbomify.com/CVE-2021-3905/): Denial of service in openvswitch (ovs) (high 7.5)
- [CVE-2021-39049](https://insights.sbomify.com/CVE-2021-39049/): Memory corruption in i2 Analyst's Notebook (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/108/