# Vulnerabilities published in 2021


- [CVE-2021-39048](https://insights.sbomify.com/CVE-2021-39048/): Memory corruption in Spectrum Protect (medium 6.2)
- [CVE-2021-39047](https://insights.sbomify.com/CVE-2021-39047/): Cross-site scripting in Cognos Analytics (medium 6.1)
- [CVE-2021-39046](https://insights.sbomify.com/CVE-2021-39046/): Information disclosure in Business Automation Workflow (medium 4.9)
- [CVE-2021-39045](https://insights.sbomify.com/CVE-2021-39045/): Information disclosure in Cognos Analytics (medium 6.2)
- [CVE-2021-39044](https://insights.sbomify.com/CVE-2021-39044/): Cross-site request forgery in ibm:financial transaction manager (medium 4.3)
- [CVE-2021-39043](https://insights.sbomify.com/CVE-2021-39043/): Cross-site scripting in Jazz Team Server (medium 6.4)
- [CVE-2021-39041](https://insights.sbomify.com/CVE-2021-39041/): Denial of service in QRadar SIEM (low 3.7)
- [CVE-2021-39040](https://insights.sbomify.com/CVE-2021-39040/): File upload in Planning Analytics Workspace (medium 6.3)
- [CVE-2021-3904](https://insights.sbomify.com/CVE-2021-3904/): Cross-site Scripting (XSS) - Stored in getgrav/grav (medium 6.3)
- [CVE-2021-39038](https://insights.sbomify.com/CVE-2021-39038/): Other in WebSphere Application Server (medium 4.4)
- [CVE-2021-39036](https://insights.sbomify.com/CVE-2021-39036/): IBM Cognos Analytics cross-site scripting (medium 6.1)
- [CVE-2021-39035](https://insights.sbomify.com/CVE-2021-39035/): Cross-site scripting in Sterling B2B Integrator (medium 5.4)
- [CVE-2021-39034](https://insights.sbomify.com/CVE-2021-39034/): Denial of service in MQ (medium 5.3)
- [CVE-2021-39033](https://insights.sbomify.com/CVE-2021-39033/): Information disclosure in Sterling B2B Integrator (medium 4.3)
- [CVE-2021-39032](https://insights.sbomify.com/CVE-2021-39032/): Information disclosure in Sterling Gentran:Server for Microsoft Windows (medium 4.0)
- [CVE-2021-39031](https://insights.sbomify.com/CVE-2021-39031/): Other in WebSphere Application Server Liberty (high 7.5)
- [CVE-2021-3903](https://insights.sbomify.com/CVE-2021-3903/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2021-39028](https://insights.sbomify.com/CVE-2021-39028/): Other in Engineering Lifecycle Optimization Publishing (medium 5.4)
- [CVE-2021-39027](https://insights.sbomify.com/CVE-2021-39027/): Other in Guardium Data Encryption (low 3.0)
- [CVE-2021-39026](https://insights.sbomify.com/CVE-2021-39026/): Misconfiguration in Security Guardium Data Encryption (medium 5.9)
- [CVE-2021-39025](https://insights.sbomify.com/CVE-2021-39025/): Information disclosure in Security Guardium Data Encryption (medium 5.3)
- [CVE-2021-39024](https://insights.sbomify.com/CVE-2021-39024/): Cross-site scripting in Guardium Data Encryption (medium 4.8)
- [CVE-2021-39023](https://insights.sbomify.com/CVE-2021-39023/): Information disclosure in Guardium Data Encryption (low 2.7)
- [CVE-2021-39022](https://insights.sbomify.com/CVE-2021-39022/): Code injection in Security Guardium Data Encryption (medium 6.2)
- [CVE-2021-39021](https://insights.sbomify.com/CVE-2021-39021/): Information disclosure in Security Guardium Data Encryption (low 3.7)
- [CVE-2021-39020](https://insights.sbomify.com/CVE-2021-39020/): Information disclosure in Guardium Data Encryption (low 2.0)
- [CVE-2021-3902](https://insights.sbomify.com/CVE-2021-3902/): Improper Restriction of XML External Entity Reference in dompdf/dompdf (critical 9.8)
- [CVE-2021-39019](https://insights.sbomify.com/CVE-2021-39019/): Information disclosure in Engineering Lifecycle Optimization Publishing (medium 6.5)
- [CVE-2021-39018](https://insights.sbomify.com/CVE-2021-39018/): Information disclosure in Engineering Lifecycle Optimization Publishing (medium 4.3)
- [CVE-2021-39017](https://insights.sbomify.com/CVE-2021-39017/): File upload in Engineering Lifecycle Optimization Publishing (medium 5.7)
- [CVE-2021-39016](https://insights.sbomify.com/CVE-2021-39016/): Denial of service in Engineering Lifecycle Optimization Publishing (medium 4.3)
- [CVE-2021-39015](https://insights.sbomify.com/CVE-2021-39015/): Cross-site scripting in Engineering Lifecycle Optimization Publishing (medium 5.4)
- [CVE-2021-39014](https://insights.sbomify.com/CVE-2021-39014/): IBM Cloud Object Storage System cross-site scripting (medium 6.4)
- [CVE-2021-39013](https://insights.sbomify.com/CVE-2021-39013/): Information disclosure in Cloud Pak for Security (medium 4.3)
- [CVE-2021-39011](https://insights.sbomify.com/CVE-2021-39011/): IBM Cloud Pak for Security information disclosure (medium 4.2)
- [CVE-2021-3901](https://insights.sbomify.com/CVE-2021-3901/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (low 3.5)
- [CVE-2021-39009](https://insights.sbomify.com/CVE-2021-39009/): Information disclosure in Cognos Analytics (medium 4.4)
- [CVE-2021-39008](https://insights.sbomify.com/CVE-2021-39008/): IBM QRadar WinCollect Agent information disclosure (low 2.7)
- [CVE-2021-39006](https://insights.sbomify.com/CVE-2021-39006/): Information disclosure in QRadar WinCollect Agent (medium 5.3)
- [CVE-2021-39002](https://insights.sbomify.com/CVE-2021-39002/): Weak cryptography in DB2 for Linux, UNIX and Windows (medium 5.9)
- [CVE-2021-39000](https://insights.sbomify.com/CVE-2021-39000/): Information disclosure in MQ Appliance (medium 5.9)
- [CVE-2021-3900](https://insights.sbomify.com/CVE-2021-3900/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (medium 4.3)
- [CVE-2021-38999](https://insights.sbomify.com/CVE-2021-38999/): Information disclosure in MQ Appliance (medium 5.1)
- [CVE-2021-38997](https://insights.sbomify.com/CVE-2021-38997/): IBM API Connect HOST header injection (medium 5.4)
- [CVE-2021-38996](https://insights.sbomify.com/CVE-2021-38996/): Denial of service in AIX (medium 6.2)
- [CVE-2021-38995](https://insights.sbomify.com/CVE-2021-38995/): Denial of service in AIX (medium 6.2)
- [CVE-2021-38994](https://insights.sbomify.com/CVE-2021-38994/): Denial of service in AIX (medium 6.2)
- [CVE-2021-38993](https://insights.sbomify.com/CVE-2021-38993/): Denial of service in AIX (medium 6.2)
- [CVE-2021-38991](https://insights.sbomify.com/CVE-2021-38991/): Privilege escalation in AIX (high 8.4)
- [CVE-2021-38990](https://insights.sbomify.com/CVE-2021-38990/): Privilege escalation in AIX (high 8.4)
- [CVE-2021-3899](https://insights.sbomify.com/CVE-2021-3899/): Race condition in Apport (high 7.8)
- [CVE-2021-38989](https://insights.sbomify.com/CVE-2021-38989/): Denial of service in AIX (medium 6.2)
- [CVE-2021-38988](https://insights.sbomify.com/CVE-2021-38988/): Denial of service in AIX (medium 6.2)
- [CVE-2021-38986](https://insights.sbomify.com/CVE-2021-38986/): Auth bypass in MQ Appliance (medium 5.6)
- [CVE-2021-38985](https://insights.sbomify.com/CVE-2021-38985/): Other in Security Key Lifecycle Manager (medium 4.3)
- [CVE-2021-38984](https://insights.sbomify.com/CVE-2021-38984/): Weak cryptography in Security Key Lifecycle Manager (low 3.7)
- [CVE-2021-38983](https://insights.sbomify.com/CVE-2021-38983/): Weak cryptography in Security Key Lifecycle Manager (medium 4.4)
- [CVE-2021-38982](https://insights.sbomify.com/CVE-2021-38982/): Cross-site scripting in Security Key Lifecycle Manager (medium 5.4)
- [CVE-2021-38981](https://insights.sbomify.com/CVE-2021-38981/): Information disclosure in Security Key Lifecycle Manager (medium 5.3)
- [CVE-2021-38980](https://insights.sbomify.com/CVE-2021-38980/): Information disclosure in Security Key Lifecycle Manager (low 2.7)
- [CVE-2021-3898](https://insights.sbomify.com/CVE-2021-3898/): Security feature bypass in Device Help Android App (medium 6.8)
- [CVE-2021-38979](https://insights.sbomify.com/CVE-2021-38979/): Weak cryptography in Security Key Lifecycle Manager (medium 4.4)
- [CVE-2021-38978](https://insights.sbomify.com/CVE-2021-38978/): Misconfiguration in Security Key Lifecycle Manager (medium 5.9)
- [CVE-2021-38977](https://insights.sbomify.com/CVE-2021-38977/): Information disclosure in Security Key Lifecycle Manager (low 3.1)
- [CVE-2021-38976](https://insights.sbomify.com/CVE-2021-38976/): Information disclosure in Security Key Lifecycle Manager (medium 6.2)
- [CVE-2021-38975](https://insights.sbomify.com/CVE-2021-38975/): Information disclosure in Security Key Lifecycle Manager (medium 4.3)
- [CVE-2021-38974](https://insights.sbomify.com/CVE-2021-38974/): Denial of service in Security Key Lifecycle Manager (medium 5.4)
- [CVE-2021-38973](https://insights.sbomify.com/CVE-2021-38973/): Other in Security Key Lifecycle Manager (low 2.4)
- [CVE-2021-38972](https://insights.sbomify.com/CVE-2021-38972/): Other in Security Key Lifecycle Manager (medium 4.3)
- [CVE-2021-38971](https://insights.sbomify.com/CVE-2021-38971/): Security feature bypass in Data Virtualization on Cloud Pak for Data (medium 4.9)
- [CVE-2021-3897](https://insights.sbomify.com/CVE-2021-3897/): Auth bypass in Fan Power Controller2 (FPC2) (critical 9.8)
- [CVE-2021-38969](https://insights.sbomify.com/CVE-2021-38969/): Hardcoded credentials in Spectrum Virtualize (medium 5.6)
- [CVE-2021-38967](https://insights.sbomify.com/CVE-2021-38967/): Code injection in MQ Appliance (high 8.2)
- [CVE-2021-38966](https://insights.sbomify.com/CVE-2021-38966/): Cross-site scripting in Cloud Pak for Automation (medium 5.4)
- [CVE-2021-38965](https://insights.sbomify.com/CVE-2021-38965/): Command injection in FileNet Content Manager (medium 6.3)
- [CVE-2021-38963](https://insights.sbomify.com/CVE-2021-38963/): IBM Aspera Console CSV injection (high 8.0)
- [CVE-2021-38961](https://insights.sbomify.com/CVE-2021-38961/): Cross-site scripting in OPENBMC (medium 6.1)
- [CVE-2021-38960](https://insights.sbomify.com/CVE-2021-38960/): Information disclosure in HMC (medium 5.3)
- [CVE-2021-38959](https://insights.sbomify.com/CVE-2021-38959/): Other in SPSS Statistics (medium 6.2)
- [CVE-2021-38958](https://insights.sbomify.com/CVE-2021-38958/): Race condition in MQ Appliance (medium 5.1)
- [CVE-2021-38957](https://insights.sbomify.com/CVE-2021-38957/): Information disclosure in Security Verify Access (low 3.1)
- [CVE-2021-38956](https://insights.sbomify.com/CVE-2021-38956/): Information disclosure in Security Verify Access (medium 5.3)
- [CVE-2021-38955](https://insights.sbomify.com/CVE-2021-38955/): Denial of service in AIX (medium 4.4)
- [CVE-2021-38954](https://insights.sbomify.com/CVE-2021-38954/): Information disclosure in Sterling B2B Integrator (medium 4.3)
- [CVE-2021-38952](https://insights.sbomify.com/CVE-2021-38952/): Cross-site scripting in InfoSphere Information Server (medium 5.4)
- [CVE-2021-38951](https://insights.sbomify.com/CVE-2021-38951/): Denial of service in WebSphere Application Server (high 7.5)
- [CVE-2021-38950](https://insights.sbomify.com/CVE-2021-38950/): Privilege escalation in MQ for HPE NonStop (high 7.4)
- [CVE-2021-38949](https://insights.sbomify.com/CVE-2021-38949/): Information disclosure in MQ (medium 6.2)
- [CVE-2021-38948](https://insights.sbomify.com/CVE-2021-38948/): XML external entity in InfoSphere Information Server (high 7.1)
- [CVE-2021-38947](https://insights.sbomify.com/CVE-2021-38947/): Weak cryptography in Spectrum Copy Data Management (medium 5.9)
- [CVE-2021-38946](https://insights.sbomify.com/CVE-2021-38946/): Cross-site scripting in Cognos Analytics (medium 5.4)
- [CVE-2021-38945](https://insights.sbomify.com/CVE-2021-38945/): File upload in Cognos Analytics (medium 6.3)
- [CVE-2021-38944](https://insights.sbomify.com/CVE-2021-38944/): Cross-site scripting in DataPower Gateway (medium 4.8)
- [CVE-2021-38941](https://insights.sbomify.com/CVE-2021-38941/): Misconfiguration in Cloud Pak for Multicloud Management Monitoring (medium 5.3)
- [CVE-2021-38939](https://insights.sbomify.com/CVE-2021-38939/): Information disclosure in QRadar SIEM (low 3.7)
- [CVE-2021-38938](https://insights.sbomify.com/CVE-2021-38938/): IBM Host Access Transformation Services information disclosure (medium 6.2)
- [CVE-2021-38937](https://insights.sbomify.com/CVE-2021-38937/): Denial of service in PowerVM Hypervisor (medium 6.3)
- [CVE-2021-38936](https://insights.sbomify.com/CVE-2021-38936/): Information disclosure in QRadar SIEM (medium 4.9)
- [CVE-2021-38935](https://insights.sbomify.com/CVE-2021-38935/): Misconfiguration in Maximo Asset Management (medium 5.9)
- [CVE-2021-38934](https://insights.sbomify.com/CVE-2021-38934/): Cross-site scripting in Engineering Test Management (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/109/