# Vulnerabilities published in 2021 - [CVE-2021-38606](https://insights.sbomify.com/CVE-2021-38606/): Weak cryptography in yogeshojha:rengine (critical 9.8) - [CVE-2021-38604](https://insights.sbomify.com/CVE-2021-38604/): Null dereference in fedoraproject:fedora (high 7.5) - [CVE-2021-38603](https://insights.sbomify.com/CVE-2021-38603/): Cross-site scripting in pluxml:pluxml (medium 4.8) - [CVE-2021-38602](https://insights.sbomify.com/CVE-2021-38602/): Cross-site scripting in pluxml:pluxml (medium 4.8) - [CVE-2021-3860](https://insights.sbomify.com/CVE-2021-3860/): SQL injection in JFrog Artifactory (high 8.8) - [CVE-2021-38599](https://insights.sbomify.com/CVE-2021-38599/): Improper use of cryptographic key in wal-g (high 7.5) - [CVE-2021-38598](https://insights.sbomify.com/CVE-2021-38598/): OpenStack Neutron vulnerable to hardware address impersonation (critical 9.1) - [CVE-2021-38597](https://insights.sbomify.com/CVE-2021-38597/): Security feature bypass in wolfssl:wolfssl (medium 5.9) - [CVE-2021-38593](https://insights.sbomify.com/CVE-2021-38593/): Memory corruption in fedoraproject:fedora (high 7.5) - [CVE-2021-38592](https://insights.sbomify.com/CVE-2021-38592/): Memory corruption in wasm3 project:wasm3 (high 7.5) - [CVE-2021-38591](https://insights.sbomify.com/CVE-2021-38591/): Misconfiguration in google:android (low 3.3) - [CVE-2021-38590](https://insights.sbomify.com/CVE-2021-38590/): Misconfiguration in cpanel:cpanel (medium 5.5) - [CVE-2021-3859](https://insights.sbomify.com/CVE-2021-3859/): Undertow vulnerable to Denial of Service (DoS) attacks (high 7.5) - [CVE-2021-38589](https://insights.sbomify.com/CVE-2021-38589/): Other in cpanel:cpanel (high 8.1) - [CVE-2021-38588](https://insights.sbomify.com/CVE-2021-38588/): Supply chain in cpanel:cpanel (high 8.1) - [CVE-2021-38587](https://insights.sbomify.com/CVE-2021-38587/): Race condition in cpanel:cpanel (high 7.5) - [CVE-2021-38586](https://insights.sbomify.com/CVE-2021-38586/): Other in cpanel:cpanel (medium 4.4) - [CVE-2021-38585](https://insights.sbomify.com/CVE-2021-38585/): Deserialization in cpanel:cpanel (high 7.2) - [CVE-2021-38584](https://insights.sbomify.com/CVE-2021-38584/): XML external entity in cpanel:cpanel (high 7.2) - [CVE-2021-38583](https://insights.sbomify.com/CVE-2021-38583/): Cross-site scripting in openbaraza:openbaraza human capital management (medium 6.1) - [CVE-2021-3858](https://insights.sbomify.com/CVE-2021-3858/): Cross-Site Request Forgery (CSRF) in snipe/snipe-it (medium 4.3) - [CVE-2021-38578](https://insights.sbomify.com/CVE-2021-38578/): Integer overflow in EDK II (high 7.4) - [CVE-2021-38576](https://insights.sbomify.com/CVE-2021-38576/): Misconfiguration in EDK II (high 7.5) - [CVE-2021-38575](https://insights.sbomify.com/CVE-2021-38575/): Memory corruption in EDK II (high 8.1) - [CVE-2021-38574](https://insights.sbomify.com/CVE-2021-38574/): SQL injection in foxitsoftware:foxit reader (critical 9.8) - [CVE-2021-38573](https://insights.sbomify.com/CVE-2021-38573/): Path traversal in foxitsoftware:foxit reader (critical 9.8) - [CVE-2021-38572](https://insights.sbomify.com/CVE-2021-38572/): Path traversal in foxitsoftware:foxit reader (critical 9.8) - [CVE-2021-38571](https://insights.sbomify.com/CVE-2021-38571/): Other in foxitsoftware:foxit reader (high 7.8) - [CVE-2021-38570](https://insights.sbomify.com/CVE-2021-38570/): Other in foxitsoftware:foxit reader (critical 9.1) - [CVE-2021-3857](https://insights.sbomify.com/CVE-2021-3857/): Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq (high 7.3) - [CVE-2021-38569](https://insights.sbomify.com/CVE-2021-38569/): Denial of service in foxitsoftware:foxit reader (high 7.5) - [CVE-2021-38568](https://insights.sbomify.com/CVE-2021-38568/): Memory corruption in foxitsoftware:foxit reader (critical 9.8) - [CVE-2021-38567](https://insights.sbomify.com/CVE-2021-38567/): Null dereference in foxit:pdf reader (high 7.5) - [CVE-2021-38566](https://insights.sbomify.com/CVE-2021-38566/): Denial of service in foxitsoftware:pdf editor (high 7.5) - [CVE-2021-38565](https://insights.sbomify.com/CVE-2021-38565/): Path traversal in foxitsoftware:pdf editor (high 7.5) - [CVE-2021-38564](https://insights.sbomify.com/CVE-2021-38564/): Memory corruption in foxitsoftware:pdf editor (critical 9.1) - [CVE-2021-38563](https://insights.sbomify.com/CVE-2021-38563/): Memory corruption in foxit:pdf reader (critical 9.8) - [CVE-2021-38562](https://insights.sbomify.com/CVE-2021-38562/): Information disclosure in bestpractical:request tracker (high 7.5) - [CVE-2021-38561](https://insights.sbomify.com/CVE-2021-38561/): golang.org/x/text/language Out-of-bounds Read vulnerability (high 7.5) - [CVE-2021-38560](https://insights.sbomify.com/CVE-2021-38560/): Cross-site scripting in ivanti:service manager (medium 6.1) - [CVE-2021-3856](https://insights.sbomify.com/CVE-2021-3856/): Keycloak has Files or Directories Accessible to External Parties (medium 4.3) - [CVE-2021-38559](https://insights.sbomify.com/CVE-2021-38559/): Cross-site scripting in digitaldruid:hoteldruid (medium 6.1) - [CVE-2021-38557](https://insights.sbomify.com/CVE-2021-38557/): raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. (high 8.8) - [CVE-2021-38556](https://insights.sbomify.com/CVE-2021-38556/): Command Injection in RaspAP 2.6.6 (high 8.8) - [CVE-2021-38555](https://insights.sbomify.com/CVE-2021-38555/): An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java (critical 9.1) - [CVE-2021-38554](https://insights.sbomify.com/CVE-2021-38554/): Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault (medium 5.3) - [CVE-2021-38553](https://insights.sbomify.com/CVE-2021-38553/): HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 (medium 4.4) - [CVE-2021-3855](https://insights.sbomify.com/CVE-2021-3855/): Command Injection in Liman Central Management System (high 8.8) - [CVE-2021-38549](https://insights.sbomify.com/CVE-2021-38549/): Information disclosure in benda:miracase hmub500 firmware (medium 5.9) - [CVE-2021-38548](https://insights.sbomify.com/CVE-2021-38548/): Information disclosure in jbl:go 2 firmware (medium 5.9) - [CVE-2021-38547](https://insights.sbomify.com/CVE-2021-38547/): Information disclosure in logitech:s120 firmware (medium 5.9) - [CVE-2021-38546](https://insights.sbomify.com/CVE-2021-38546/): Information disclosure in creative:pebble firmware (medium 5.9) - [CVE-2021-38545](https://insights.sbomify.com/CVE-2021-38545/): Information disclosure in raspberrypi:raspberry pi 3 model b\+ firmware (medium 5.9) - [CVE-2021-38544](https://insights.sbomify.com/CVE-2021-38544/): Information disclosure in sony:srs-xb33 firmware (medium 5.9) - [CVE-2021-38543](https://insights.sbomify.com/CVE-2021-38543/): Information disclosure in tp-link:ue330 firmware (medium 5.9) - [CVE-2021-38542](https://insights.sbomify.com/CVE-2021-38542/): Apache James vulnerable to STARTTLS command injection (IMAP and POP3) (medium 5.9) - [CVE-2021-38540](https://insights.sbomify.com/CVE-2021-38540/): Apache Airflow: Variable Import endpoint missed authentication check (critical 9.8) - [CVE-2021-3854](https://insights.sbomify.com/CVE-2021-3854/): SQLi in Glox Technology's Useroam Hotspot (critical 9.8) - [CVE-2021-38539](https://insights.sbomify.com/CVE-2021-38539/): Privilege escalation in netgear:d8500 firmware (medium 6.3) - [CVE-2021-38538](https://insights.sbomify.com/CVE-2021-38538/): Cross-site scripting in netgear:d7800 firmware (medium 6.3) - [CVE-2021-38537](https://insights.sbomify.com/CVE-2021-38537/): Cross-site scripting in netgear:ac2100 firmware (medium 4.2) - [CVE-2021-38536](https://insights.sbomify.com/CVE-2021-38536/): Cross-site scripting in netgear:ac2100 firmware (medium 4.3) - [CVE-2021-38535](https://insights.sbomify.com/CVE-2021-38535/): Cross-site scripting in netgear:ac2100 firmware (medium 4.3) - [CVE-2021-38534](https://insights.sbomify.com/CVE-2021-38534/): Cross-site scripting in netgear:d3600 firmware (medium 4.1) - [CVE-2021-38533](https://insights.sbomify.com/CVE-2021-38533/): Cross-site scripting in netgear:rax40 firmware (medium 5.4) - [CVE-2021-38532](https://insights.sbomify.com/CVE-2021-38532/): Misconfiguration in netgear:wac104 firmware (medium 6.8) - [CVE-2021-38531](https://insights.sbomify.com/CVE-2021-38531/): Misconfiguration in netgear:ac2100 firmware (medium 4.7) - [CVE-2021-38530](https://insights.sbomify.com/CVE-2021-38530/): Command injection in netgear:rbk20 firmware (critical 9.6) - [CVE-2021-3853](https://insights.sbomify.com/CVE-2021-3853/): Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq (medium 6.5) - [CVE-2021-38529](https://insights.sbomify.com/CVE-2021-38529/): Command injection in netgear:d7800 firmware (high 8.3) - [CVE-2021-38528](https://insights.sbomify.com/CVE-2021-38528/): Command injection in netgear:d8500 firmware (critical 9.6) - [CVE-2021-38527](https://insights.sbomify.com/CVE-2021-38527/): Command injection in netgear:cbr40 firmware (high 8.1) - [CVE-2021-38526](https://insights.sbomify.com/CVE-2021-38526/): Memory corruption in netgear:rax35 firmware (medium 4.3) - [CVE-2021-38525](https://insights.sbomify.com/CVE-2021-38525/): Memory corruption in netgear:d3600 firmware (medium 6.8) - [CVE-2021-38524](https://insights.sbomify.com/CVE-2021-38524/): Memory corruption in netgear:mk62 firmware (medium 4.5) - [CVE-2021-38523](https://insights.sbomify.com/CVE-2021-38523/): Memory corruption in netgear:r6400 firmware (medium 6.9) - [CVE-2021-38522](https://insights.sbomify.com/CVE-2021-38522/): Memory corruption in netgear:r6400 firmware (medium 6.8) - [CVE-2021-38521](https://insights.sbomify.com/CVE-2021-38521/): Command injection in netgear:r6400 firmware (medium 6.1) - [CVE-2021-38520](https://insights.sbomify.com/CVE-2021-38520/): Command injection in netgear:r6400 firmware (medium 6.6) - [CVE-2021-3852](https://insights.sbomify.com/CVE-2021-3852/): Authorization Bypass Through User-Controlled Key in weseek/growi (medium 6.3) - [CVE-2021-38519](https://insights.sbomify.com/CVE-2021-38519/): Command injection in netgear:r6250 firmware (medium 6.3) - [CVE-2021-38518](https://insights.sbomify.com/CVE-2021-38518/): Command injection in netgear:rax200 firmware (high 8.4) - [CVE-2021-38517](https://insights.sbomify.com/CVE-2021-38517/): Memory corruption in netgear:r6400 firmware (medium 6.9) - [CVE-2021-38516](https://insights.sbomify.com/CVE-2021-38516/): Missing authorization in netgear:ac2100 firmware (critical 10.0) - [CVE-2021-38515](https://insights.sbomify.com/CVE-2021-38515/): Denial of service in netgear:r6400 firmware (high 7.4) - [CVE-2021-38514](https://insights.sbomify.com/CVE-2021-38514/): Auth bypass in netgear:d3600 firmware (low 2.4) - [CVE-2021-38513](https://insights.sbomify.com/CVE-2021-38513/): Auth bypass in netgear:cbr40 firmware (critical 9.6) - [CVE-2021-38512](https://insights.sbomify.com/CVE-2021-38512/): HTTP Request Smuggling in actix-http (high 7.5) - [CVE-2021-38511](https://insights.sbomify.com/CVE-2021-38511/): Links in archive can create arbitrary directories (high 7.5) - [CVE-2021-38510](https://insights.sbomify.com/CVE-2021-38510/): Security feature bypass in Firefox (high 8.8) - [CVE-2021-3851](https://insights.sbomify.com/CVE-2021-3851/): Open Redirect in firefly-iii/firefly-iii (medium 5.0) - [CVE-2021-38509](https://insights.sbomify.com/CVE-2021-38509/): Other in Firefox (medium 4.3) - [CVE-2021-38508](https://insights.sbomify.com/CVE-2021-38508/): Security feature bypass in Firefox (medium 4.3) - [CVE-2021-38507](https://insights.sbomify.com/CVE-2021-38507/): Security feature bypass in Firefox (medium 6.5) - [CVE-2021-38506](https://insights.sbomify.com/CVE-2021-38506/): Security feature bypass in Firefox (medium 4.3) - [CVE-2021-38505](https://insights.sbomify.com/CVE-2021-38505/): Information disclosure in Firefox (medium 6.5) - [CVE-2021-38504](https://insights.sbomify.com/CVE-2021-38504/): Use after free in Firefox (high 8.8) - [CVE-2021-38503](https://insights.sbomify.com/CVE-2021-38503/): Security feature bypass in Firefox (critical 10.0) - [CVE-2021-38502](https://insights.sbomify.com/CVE-2021-38502/): Security feature bypass in Thunderbird (medium 5.9) - [CVE-2021-38501](https://insights.sbomify.com/CVE-2021-38501/): Memory corruption in Firefox (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2021/page/112/