# Vulnerabilities published in 2021


- [CVE-2021-38714](https://insights.sbomify.com/CVE-2021-38714/): Integer overflow in debian:debian linux (high 8.8)
- [CVE-2021-38713](https://insights.sbomify.com/CVE-2021-38713/): Cross-site scripting in imgURL (medium 5.4)
- [CVE-2021-38712](https://insights.sbomify.com/CVE-2021-38712/): Information disclosure in onenav:onenav (high 7.5)
- [CVE-2021-38711](https://insights.sbomify.com/CVE-2021-38711/): Information disclosure in gitit project:gitit (high 7.5)
- [CVE-2021-38710](https://insights.sbomify.com/CVE-2021-38710/): Cross-site scripting in yclas:yclas (medium 6.1)
- [CVE-2021-38709](https://insights.sbomify.com/CVE-2021-38709/): Cross-site scripting in compo:composr cms (medium 6.1)
- [CVE-2021-38708](https://insights.sbomify.com/CVE-2021-38708/): Cross-site scripting in compo:composr cms (medium 5.4)
- [CVE-2021-38707](https://insights.sbomify.com/CVE-2021-38707/): Cross-site scripting in cliniccases:cliniccases (medium 5.4)
- [CVE-2021-38706](https://insights.sbomify.com/CVE-2021-38706/): SQL injection in cliniccases:cliniccases (high 8.8)
- [CVE-2021-38705](https://insights.sbomify.com/CVE-2021-38705/): Cross-site request forgery in cliniccases:cliniccases (high 8.8)
- [CVE-2021-38704](https://insights.sbomify.com/CVE-2021-38704/): Cross-site scripting in cliniccases:cliniccases (medium 6.1)
- [CVE-2021-38703](https://insights.sbomify.com/CVE-2021-38703/): Code injection in kpn:experia wifi firmware (high 8.8)
- [CVE-2021-38702](https://insights.sbomify.com/CVE-2021-38702/): Cross-site scripting in cyberoamworks:netgenie c0101b1-20141120-ng11vo firmware (medium 6.1)
- [CVE-2021-38701](https://insights.sbomify.com/CVE-2021-38701/): Cross-site scripting in motorola:t008 firmware (medium 4.8)
- [CVE-2021-38699](https://insights.sbomify.com/CVE-2021-38699/): Cross-site scripting in tastyigniter:tastyigniter (medium 5.4)
- [CVE-2021-38698](https://insights.sbomify.com/CVE-2021-38698/): HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. (medium 6.5)
- [CVE-2021-38697](https://insights.sbomify.com/CVE-2021-38697/): File upload in softvibe:saraban (critical 9.8)
- [CVE-2021-38696](https://insights.sbomify.com/CVE-2021-38696/): Missing authorization in softvibe:saraban (high 7.5)
- [CVE-2021-38695](https://insights.sbomify.com/CVE-2021-38695/): Cross-site scripting in softvibe:saraban (medium 5.4)
- [CVE-2021-38694](https://insights.sbomify.com/CVE-2021-38694/): SQL injection in softvibe:saraban (high 7.5)
- [CVE-2021-38693](https://insights.sbomify.com/CVE-2021-38693/): Path Traversal in thttpd (medium 5.3)
- [CVE-2021-38692](https://insights.sbomify.com/CVE-2021-38692/): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (high 8.1)
- [CVE-2021-38691](https://insights.sbomify.com/CVE-2021-38691/): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (high 8.1)
- [CVE-2021-38690](https://insights.sbomify.com/CVE-2021-38690/): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (high 8.1)
- [CVE-2021-3869](https://insights.sbomify.com/CVE-2021-3869/): Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp (high 8.6)
- [CVE-2021-38689](https://insights.sbomify.com/CVE-2021-38689/): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (high 8.1)
- [CVE-2021-38688](https://insights.sbomify.com/CVE-2021-38688/): Improper Authentication in Qfile (high 7.1)
- [CVE-2021-38687](https://insights.sbomify.com/CVE-2021-38687/): Stack Overflow Vulnerability in Surveillance Station (high 8.1)
- [CVE-2021-38686](https://insights.sbomify.com/CVE-2021-38686/): Improper Authentication Vulnerability in VioStor (high 8.8)
- [CVE-2021-38685](https://insights.sbomify.com/CVE-2021-38685/): Command Injection Vulnerability in VioStor (critical 9.8)
- [CVE-2021-38684](https://insights.sbomify.com/CVE-2021-38684/): Buffer Overflow Vulnerability in Multimedia Console (high 8.1)
- [CVE-2021-38682](https://insights.sbomify.com/CVE-2021-38682/): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (high 8.1)
- [CVE-2021-38681](https://insights.sbomify.com/CVE-2021-38681/): Reflected XSS Vulnerability in Ragic Cloud DB (medium 5.3)
- [CVE-2021-38680](https://insights.sbomify.com/CVE-2021-38680/): Reflected XSS in Kazoo Server (medium 5.3)
- [CVE-2021-38679](https://insights.sbomify.com/CVE-2021-38679/): Improper Authentication in Kazoo Server (medium 6.5)
- [CVE-2021-38678](https://insights.sbomify.com/CVE-2021-38678/): Open Redirect Vulnerability in QcalAgent (medium 6.1)
- [CVE-2021-38677](https://insights.sbomify.com/CVE-2021-38677/): Reflected XSS Vulnerability in QcalAgent (medium 5.3)
- [CVE-2021-38675](https://insights.sbomify.com/CVE-2021-38675/): Stored XSS Vulnerability in Image2PDF (medium 5.4)
- [CVE-2021-38674](https://insights.sbomify.com/CVE-2021-38674/): Reflected XSS Vulnerability in TFTP (medium 4.2)
- [CVE-2021-38672](https://insights.sbomify.com/CVE-2021-38672/): Windows Hyper-V Remote Code Execution Vulnerability (high 8.0)
- [CVE-2021-38671](https://insights.sbomify.com/CVE-2021-38671/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38669](https://insights.sbomify.com/CVE-2021-38669/): Microsoft Edge (Chromium-based) Tampering Vulnerability (medium 6.4)
- [CVE-2021-38667](https://insights.sbomify.com/CVE-2021-38667/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38666](https://insights.sbomify.com/CVE-2021-38666/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-38665](https://insights.sbomify.com/CVE-2021-38665/): Remote Desktop Protocol Client Information Disclosure Vulnerability (high 7.4)
- [CVE-2021-38663](https://insights.sbomify.com/CVE-2021-38663/): Windows exFAT File System Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-38662](https://insights.sbomify.com/CVE-2021-38662/): Windows Fast FAT File System Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-38661](https://insights.sbomify.com/CVE-2021-38661/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38660](https://insights.sbomify.com/CVE-2021-38660/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-3866](https://insights.sbomify.com/CVE-2021-3866/): Cross-site Scripting (XSS) - Stored in zulip/zulip (medium 6.8)
- [CVE-2021-38659](https://insights.sbomify.com/CVE-2021-38659/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38658](https://insights.sbomify.com/CVE-2021-38658/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38657](https://insights.sbomify.com/CVE-2021-38657/): Microsoft Office Graphics Component Information Disclosure Vulnerability (medium 6.1)
- [CVE-2021-38656](https://insights.sbomify.com/CVE-2021-38656/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38655](https://insights.sbomify.com/CVE-2021-38655/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38654](https://insights.sbomify.com/CVE-2021-38654/): Microsoft Office Visio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38653](https://insights.sbomify.com/CVE-2021-38653/): Microsoft Office Visio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38652](https://insights.sbomify.com/CVE-2021-38652/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.6)
- [CVE-2021-38651](https://insights.sbomify.com/CVE-2021-38651/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.6)
- [CVE-2021-38650](https://insights.sbomify.com/CVE-2021-38650/): Microsoft Office Spoofing Vulnerability (high 7.6)
- [CVE-2021-38649](https://insights.sbomify.com/CVE-2021-38649/): Microsoft Open Management Infrastructure (OMI) Privilege Escalation (high 7.0, exploited in the wild)
- [CVE-2021-38648](https://insights.sbomify.com/CVE-2021-38648/): Microsoft Open Management Infrastructure (OMI) Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2021-38647](https://insights.sbomify.com/CVE-2021-38647/): Microsoft Open Management Infrastructure (OMI) Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-38646](https://insights.sbomify.com/CVE-2021-38646/): Microsoft Office Access Connectivity Engine Remote Code Execution (high 7.8, exploited in the wild)
- [CVE-2021-38645](https://insights.sbomify.com/CVE-2021-38645/): Microsoft Open Management Infrastructure (OMI) Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2021-38644](https://insights.sbomify.com/CVE-2021-38644/): Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-38642](https://insights.sbomify.com/CVE-2021-38642/): Microsoft Edge for iOS Spoofing Vulnerability (medium 6.1)
- [CVE-2021-38641](https://insights.sbomify.com/CVE-2021-38641/): Microsoft Edge for Android Spoofing Vulnerability (medium 6.1)
- [CVE-2021-3864](https://insights.sbomify.com/CVE-2021-3864/): Privilege escalation in kernel (high 7.0)
- [CVE-2021-38639](https://insights.sbomify.com/CVE-2021-38639/): Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38638](https://insights.sbomify.com/CVE-2021-38638/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38637](https://insights.sbomify.com/CVE-2021-38637/): Windows Storage Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-38636](https://insights.sbomify.com/CVE-2021-38636/): Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-38635](https://insights.sbomify.com/CVE-2021-38635/): Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-38634](https://insights.sbomify.com/CVE-2021-38634/): Microsoft Windows Update Client Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2021-38633](https://insights.sbomify.com/CVE-2021-38633/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38632](https://insights.sbomify.com/CVE-2021-38632/): Windows BitLocker Security Feature Bypass Vulnerability (medium 5.7)
- [CVE-2021-38631](https://insights.sbomify.com/CVE-2021-38631/): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (medium 4.4)
- [CVE-2021-38630](https://insights.sbomify.com/CVE-2021-38630/): Windows Event Tracing Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-3863](https://insights.sbomify.com/CVE-2021-3863/): Cross-site Scripting (XSS) - Generic in snipe/snipe-it (medium 5.5)
- [CVE-2021-38629](https://insights.sbomify.com/CVE-2021-38629/): Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability (medium 6.5)
- [CVE-2021-38628](https://insights.sbomify.com/CVE-2021-38628/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38626](https://insights.sbomify.com/CVE-2021-38626/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38625](https://insights.sbomify.com/CVE-2021-38625/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-38624](https://insights.sbomify.com/CVE-2021-38624/): Windows Key Storage Provider Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2021-38623](https://insights.sbomify.com/CVE-2021-38623/): Improper Resource Shutdown or Release in TYPO3 extension (high 7.5)
- [CVE-2021-38621](https://insights.sbomify.com/CVE-2021-38621/): Missing authorization in netless:flat server (critical 9.1)
- [CVE-2021-3862](https://insights.sbomify.com/CVE-2021-3862/): Cross-site Scripting (XSS) - Reflected in icecoder/icecoder (medium 5.4)
- [CVE-2021-38619](https://insights.sbomify.com/CVE-2021-38619/): Cross-site scripting in openbaraza:openbaraza human capital management (medium 6.1)
- [CVE-2021-38618](https://insights.sbomify.com/CVE-2021-38618/): Auth bypass in gfos:workforce management (high 7.4)
- [CVE-2021-38617](https://insights.sbomify.com/CVE-2021-38617/): Missing authorization in eigentech:natural language processing (high 8.8)
- [CVE-2021-38616](https://insights.sbomify.com/CVE-2021-38616/): Missing authorization in eigentech:natural language processing (high 7.6)
- [CVE-2021-38615](https://insights.sbomify.com/CVE-2021-38615/): Missing authorization in eigentech:natural language processing (medium 6.3)
- [CVE-2021-38614](https://insights.sbomify.com/CVE-2021-38614/): Memory corruption in polipo project:polipo (high 7.5)
- [CVE-2021-38613](https://insights.sbomify.com/CVE-2021-38613/): File upload in nascent:remkon device manager (critical 9.8)
- [CVE-2021-38612](https://insights.sbomify.com/CVE-2021-38612/): Path traversal in nascent:remkon device manager (high 7.5)
- [CVE-2021-38611](https://insights.sbomify.com/CVE-2021-38611/): Command injection in nascent:remkon device manager (critical 9.8)
- [CVE-2021-3861](https://insights.sbomify.com/CVE-2021-3861/): The RNDIS USB device class includes a buffer overflow vulnerability (high 8.2)
- [CVE-2021-38608](https://insights.sbomify.com/CVE-2021-38608/): Privilege escalation in tranquil:wapt (high 7.8)
- [CVE-2021-38607](https://insights.sbomify.com/CVE-2021-38607/): Cross-site scripting in crocoblock:jetengine (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/111/