# Vulnerabilities published in 2021


- [CVE-2021-38933](https://insights.sbomify.com/CVE-2021-38933/): IBM Sterling Connect:Express for UNIX information disclosure (medium 5.9)
- [CVE-2021-38931](https://insights.sbomify.com/CVE-2021-38931/): Information disclosure in DB2 for Linux, UNIX and Windows (medium 6.5)
- [CVE-2021-38930](https://insights.sbomify.com/CVE-2021-38930/): Information disclosure in Hardware Management Console (medium 5.3)
- [CVE-2021-38929](https://insights.sbomify.com/CVE-2021-38929/): Information disclosure in Hardware Management Console (medium 5.3)
- [CVE-2021-38928](https://insights.sbomify.com/CVE-2021-38928/): IBM Sterling B2B Integrator Standard Edition cross-origin resource sharing (medium 5.4)
- [CVE-2021-38927](https://insights.sbomify.com/CVE-2021-38927/): IBM Aspera Console cross-site scripting (high 7.2)
- [CVE-2021-38926](https://insights.sbomify.com/CVE-2021-38926/): Privilege escalation in DB2 for Linux, UNIX and Windows (medium 5.5)
- [CVE-2021-38925](https://insights.sbomify.com/CVE-2021-38925/): Weak cryptography in Sterling B2B Integrator (medium 5.9)
- [CVE-2021-38924](https://insights.sbomify.com/CVE-2021-38924/): Information disclosure in Maximo Asset Management (medium 5.3)
- [CVE-2021-38923](https://insights.sbomify.com/CVE-2021-38923/): Privilege escalation in PowerVM Hypervisor (high 8.0)
- [CVE-2021-38921](https://insights.sbomify.com/CVE-2021-38921/): Weak cryptography in Security Verify Access (medium 5.9)
- [CVE-2021-38919](https://insights.sbomify.com/CVE-2021-38919/): Information disclosure in QRadar SIEM (medium 5.9)
- [CVE-2021-38918](https://insights.sbomify.com/CVE-2021-38918/): Security feature bypass in PowerVM Hypervisor (high 8.6)
- [CVE-2021-38917](https://insights.sbomify.com/CVE-2021-38917/): Memory corruption in PowerVM Hypervisor (high 7.4)
- [CVE-2021-38915](https://insights.sbomify.com/CVE-2021-38915/): Information disclosure in Data Risk Manager (medium 5.3)
- [CVE-2021-38911](https://insights.sbomify.com/CVE-2021-38911/): Information disclosure in Cloud Pak for Security (medium 4.4)
- [CVE-2021-38910](https://insights.sbomify.com/CVE-2021-38910/): Security feature bypass in DataPower Gateway (low 3.7)
- [CVE-2021-38909](https://insights.sbomify.com/CVE-2021-38909/): Cross-site scripting in Cognos Analytics (medium 5.4)
- [CVE-2021-38905](https://insights.sbomify.com/CVE-2021-38905/): Missing authorization in Cognos Analytics (medium 4.3)
- [CVE-2021-38904](https://insights.sbomify.com/CVE-2021-38904/): Information disclosure in Cognos Analytics (medium 4.6)
- [CVE-2021-38903](https://insights.sbomify.com/CVE-2021-38903/): Cross-site scripting in Cognos Analytics (medium 5.4)
- [CVE-2021-38901](https://insights.sbomify.com/CVE-2021-38901/): Information disclosure in Spectrum Protect Operations Center (medium 5.1)
- [CVE-2021-38900](https://insights.sbomify.com/CVE-2021-38900/): Missing authorization in Business Automation Workflow (medium 4.9)
- [CVE-2021-38899](https://insights.sbomify.com/CVE-2021-38899/): Information disclosure in Cloud Pak for Data (medium 4.4)
- [CVE-2021-38896](https://insights.sbomify.com/CVE-2021-38896/): Cross-site scripting in Qradar Advisor (medium 6.1)
- [CVE-2021-38895](https://insights.sbomify.com/CVE-2021-38895/): Cross-site scripting in Security Verify Access (low 3.0)
- [CVE-2021-38894](https://insights.sbomify.com/CVE-2021-38894/): Information disclosure in Security Verify Access (low 2.7)
- [CVE-2021-38893](https://insights.sbomify.com/CVE-2021-38893/): Cross-site scripting in Business Process Manager Standard (medium 6.4)
- [CVE-2021-38891](https://insights.sbomify.com/CVE-2021-38891/): Weak cryptography in Connect:Direct Web Services (medium 5.9)
- [CVE-2021-38890](https://insights.sbomify.com/CVE-2021-38890/): Auth bypass in Connect:Direct Web Services (medium 5.9)
- [CVE-2021-3889](https://insights.sbomify.com/CVE-2021-3889/): Use of Out-of-range Pointer Offset in bfabiszewski/libmobi (high 7.1)
- [CVE-2021-38887](https://insights.sbomify.com/CVE-2021-38887/): Information disclosure in InfoSphere Information Server (medium 4.3)
- [CVE-2021-38886](https://insights.sbomify.com/CVE-2021-38886/): Cross-site request forgery in Cognos Analytics (medium 4.3)
- [CVE-2021-38883](https://insights.sbomify.com/CVE-2021-38883/): Cross-site scripting in Business Automation Workflow (medium 5.4)
- [CVE-2021-38882](https://insights.sbomify.com/CVE-2021-38882/): Business logic in Spectrum Scale (medium 4.4)
- [CVE-2021-3888](https://insights.sbomify.com/CVE-2021-3888/): Use of Out-of-range Pointer Offset in bfabiszewski/libmobi (high 7.1)
- [CVE-2021-38879](https://insights.sbomify.com/CVE-2021-38879/): Misconfiguration in Jazz Team Server (low 3.7)
- [CVE-2021-38878](https://insights.sbomify.com/CVE-2021-38878/): Auth bypass in QRadar SIEM (medium 5.9)
- [CVE-2021-38877](https://insights.sbomify.com/CVE-2021-38877/): Cross-site scripting in Jazz for Service Management (medium 6.4)
- [CVE-2021-38876](https://insights.sbomify.com/CVE-2021-38876/): Cross-site scripting in i (medium 6.1)
- [CVE-2021-38875](https://insights.sbomify.com/CVE-2021-38875/): Denial of service in MQ (medium 6.5)
- [CVE-2021-38874](https://insights.sbomify.com/CVE-2021-38874/): Missing authorization in QRadar SIEM (medium 4.3)
- [CVE-2021-38873](https://insights.sbomify.com/CVE-2021-38873/): Code injection in Planning Analytics (medium 6.8)
- [CVE-2021-38872](https://insights.sbomify.com/CVE-2021-38872/): Denial of service in DataPower Gateway (medium 5.3)
- [CVE-2021-38871](https://insights.sbomify.com/CVE-2021-38871/): Cross-site scripting in Jazz Team Server (medium 5.4)
- [CVE-2021-38870](https://insights.sbomify.com/CVE-2021-38870/): Cross-site scripting in Aspera (medium 6.4)
- [CVE-2021-38869](https://insights.sbomify.com/CVE-2021-38869/): Auth bypass in QRadar SIEM (medium 4.3)
- [CVE-2021-38868](https://insights.sbomify.com/CVE-2021-38868/): Cross-site request forgery in Engineering Requirements Quality Assistant On-Premises (medium 6.5)
- [CVE-2021-38864](https://insights.sbomify.com/CVE-2021-38864/): Security feature bypass in Security Verify Bridge (medium 6.1)
- [CVE-2021-38863](https://insights.sbomify.com/CVE-2021-38863/): Information disclosure in Security Verify Bridge (medium 6.5)
- [CVE-2021-38862](https://insights.sbomify.com/CVE-2021-38862/): Weak cryptography in Data Risk Manager (medium 5.9)
- [CVE-2021-38859](https://insights.sbomify.com/CVE-2021-38859/): IBM Security Verify Privilege information disclosure (medium 4.3)
- [CVE-2021-38847](https://insights.sbomify.com/CVE-2021-38847/): File upload in s-cart:s-cart (high 8.8)
- [CVE-2021-38841](https://insights.sbomify.com/CVE-2021-38841/): File upload in simple water refilling station management system project:simple water refilling station management system (high 8.8)
- [CVE-2021-38840](https://insights.sbomify.com/CVE-2021-38840/): SQL injection in simple water refilling station management system project:simple water refilling station management system (critical 9.8)
- [CVE-2021-38834](https://insights.sbomify.com/CVE-2021-38834/): Security feature bypass in easy-mock project:easy mock (high 8.8)
- [CVE-2021-38833](https://insights.sbomify.com/CVE-2021-38833/): SQL injection in apartment visitors management system project:apartment visitors management system (critical 9.8)
- [CVE-2021-38828](https://insights.sbomify.com/CVE-2021-38828/): Information disclosure in xiongmaitech:xm-jpr2-lx firmware (medium 5.3)
- [CVE-2021-38827](https://insights.sbomify.com/CVE-2021-38827/): Auth bypass in xiongmaitech:xm-jpr2-lx firmware (high 7.5)
- [CVE-2021-38823](https://insights.sbomify.com/CVE-2021-38823/): Auth bypass in icehrm:icehrm (critical 9.8)
- [CVE-2021-38822](https://insights.sbomify.com/CVE-2021-38822/): Cross-site scripting in icehrm:icehrm (medium 5.4)
- [CVE-2021-3882](https://insights.sbomify.com/CVE-2021-3882/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb (medium 5.9)
- [CVE-2021-38819](https://insights.sbomify.com/CVE-2021-38819/): SQL injection in simple image gallery web app project:simple image gallery web app (high 8.8)
- [CVE-2021-3881](https://insights.sbomify.com/CVE-2021-3881/): Out-of-bounds Read in bfabiszewski/libmobi (high 7.1)
- [CVE-2021-3879](https://insights.sbomify.com/CVE-2021-3879/): Cross-site Scripting (XSS) - Stored in snipe/snipe-it (medium 6.8)
- [CVE-2021-38789](https://insights.sbomify.com/CVE-2021-38789/): Missing authorization in allwinnertech:android q sdk (high 7.5)
- [CVE-2021-38788](https://insights.sbomify.com/CVE-2021-38788/): Missing authorization in allwinnertech:android q sdk (high 7.5)
- [CVE-2021-38787](https://insights.sbomify.com/CVE-2021-38787/): Integer overflow in allwinnertech:android q sdk (high 7.5)
- [CVE-2021-38786](https://insights.sbomify.com/CVE-2021-38786/): Null dereference in allwinnertech:android q sdk (high 7.5)
- [CVE-2021-38785](https://insights.sbomify.com/CVE-2021-38785/): Null dereference in allwinnertech:android q sdk (high 7.5)
- [CVE-2021-38784](https://insights.sbomify.com/CVE-2021-38784/): Null dereference in allwinnertech:android q sdk (high 7.5)
- [CVE-2021-38783](https://insights.sbomify.com/CVE-2021-38783/): Memory corruption in allwinnertech:android q sdk (high 7.5)
- [CVE-2021-3878](https://insights.sbomify.com/CVE-2021-3878/): Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp (critical 9.8)
- [CVE-2021-38772](https://insights.sbomify.com/CVE-2021-38772/): Memory corruption in tendacn:ac10 firmware (high 7.5)
- [CVE-2021-38759](https://insights.sbomify.com/CVE-2021-38759/): Hardcoded credentials in raspberrypi:raspberry pi os lite (critical 9.8)
- [CVE-2021-38758](https://insights.sbomify.com/CVE-2021-38758/): Path traversal in online catering reservation system project:online catering reservation system (high 7.5)
- [CVE-2021-38757](https://insights.sbomify.com/CVE-2021-38757/): Cross-site scripting in hospital management system project:hospital management system (medium 6.1)
- [CVE-2021-38756](https://insights.sbomify.com/CVE-2021-38756/): Cross-site scripting in hospital management system project:hospital management system (medium 6.1)
- [CVE-2021-38755](https://insights.sbomify.com/CVE-2021-38755/): Missing authorization in hospital management system project:hospital management system (medium 5.3)
- [CVE-2021-38754](https://insights.sbomify.com/CVE-2021-38754/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2021-38753](https://insights.sbomify.com/CVE-2021-38753/): File upload in simple image gallery web app project:simple image gallery web app (critical 9.8)
- [CVE-2021-38752](https://insights.sbomify.com/CVE-2021-38752/): Cross-site scripting in online catering reservation system project:online catering reservation system (medium 5.4)
- [CVE-2021-38751](https://insights.sbomify.com/CVE-2021-38751/): Other in exponentcms:exponentcms (medium 4.3)
- [CVE-2021-3875](https://insights.sbomify.com/CVE-2021-3875/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2021-38745](https://insights.sbomify.com/CVE-2021-38745/): Code injection in chamilo:chamilo (medium 6.8)
- [CVE-2021-3874](https://insights.sbomify.com/CVE-2021-3874/): Path Traversal in bookstackapp/bookstack (medium 4.3)
- [CVE-2021-38737](https://insights.sbomify.com/CVE-2021-38737/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38736](https://insights.sbomify.com/CVE-2021-38736/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38734](https://insights.sbomify.com/CVE-2021-38734/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38733](https://insights.sbomify.com/CVE-2021-38733/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38732](https://insights.sbomify.com/CVE-2021-38732/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38731](https://insights.sbomify.com/CVE-2021-38731/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38730](https://insights.sbomify.com/CVE-2021-38730/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38729](https://insights.sbomify.com/CVE-2021-38729/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-38728](https://insights.sbomify.com/CVE-2021-38728/): Cross-site scripting in sem-cms:semcms (medium 6.1)
- [CVE-2021-38727](https://insights.sbomify.com/CVE-2021-38727/): SQL injection in thedaylightstudio:fuel cms (critical 9.8)
- [CVE-2021-38725](https://insights.sbomify.com/CVE-2021-38725/): Auth bypass in thedaylightstudio:fuel cms (medium 5.3)
- [CVE-2021-38723](https://insights.sbomify.com/CVE-2021-38723/): SQL injection in thedaylightstudio:fuel cms (high 8.8)
- [CVE-2021-38721](https://insights.sbomify.com/CVE-2021-38721/): Cross-site request forgery in thedaylightstudio:fuel cms (medium 6.5)
- [CVE-2021-3872](https://insights.sbomify.com/CVE-2021-3872/): Heap-based Buffer Overflow in vim/vim (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/110/