# Vulnerabilities published in 2021


- [CVE-2021-38406](https://insights.sbomify.com/CVE-2021-38406/): Delta Electronics DOPSoft 2 Improper Input Validation (high 7.8, exploited in the wild)
- [CVE-2021-38405](https://insights.sbomify.com/CVE-2021-38405/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-38404](https://insights.sbomify.com/CVE-2021-38404/): Delta Electronics DOPSoft 2 Heap-based Buffer Overflow (high 7.8)
- [CVE-2021-38403](https://insights.sbomify.com/CVE-2021-38403/): Delta Electronics DIALink (medium 5.5)
- [CVE-2021-38402](https://insights.sbomify.com/CVE-2021-38402/): Delta Electronics DOPSoft 2 Stack-Based Buffer Overflow (high 7.8)
- [CVE-2021-38401](https://insights.sbomify.com/CVE-2021-38401/): Fuji Electric Tellus Lite V-Simulator untrusted pointer dereference (high 7.8)
- [CVE-2021-38400](https://insights.sbomify.com/CVE-2021-38400/): Use of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom Latitude (medium 6.9)
- [CVE-2021-3840](https://insights.sbomify.com/CVE-2021-3840/): Antilles Dependency Confusion Vulnerability (high 8.8)
- [CVE-2021-38399](https://insights.sbomify.com/CVE-2021-38399/): Honeywell Experion PKS and ACE Controllers Relative Path Traversal (high 7.5)
- [CVE-2021-38398](https://insights.sbomify.com/CVE-2021-38398/): Reliance on Component that is not Updateable for Boston Scientific Zoom Latitude (medium 6.5)
- [CVE-2021-38397](https://insights.sbomify.com/CVE-2021-38397/): Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type (critical 10.0)
- [CVE-2021-38396](https://insights.sbomify.com/CVE-2021-38396/): Missing Support Integrity Check for Boston Scientific Zoom Latitude (medium 6.5)
- [CVE-2021-38395](https://insights.sbomify.com/CVE-2021-38395/): Honeywell Experion PKS and ACE Controllers Injection (critical 9.1)
- [CVE-2021-38394](https://insights.sbomify.com/CVE-2021-38394/): Security feature bypass in ZOOM LATITUDE (medium 6.2)
- [CVE-2021-38393](https://insights.sbomify.com/CVE-2021-38393/): SQL injection in Delta Electronics DIAEnergie (critical 9.8)
- [CVE-2021-38392](https://insights.sbomify.com/CVE-2021-38392/): Improper Access Control for Boston Scientific Zoom Latitude (medium 6.5)
- [CVE-2021-38391](https://insights.sbomify.com/CVE-2021-38391/): SQL injection in Delta Electronics DIAEnergie (critical 9.8)
- [CVE-2021-38390](https://insights.sbomify.com/CVE-2021-38390/): SQL injection in Delta Electronics DIAEnergie (critical 9.8)
- [CVE-2021-3839](https://insights.sbomify.com/CVE-2021-3839/): Memory corruption in dpdk (high 7.5)
- [CVE-2021-38389](https://insights.sbomify.com/CVE-2021-38389/): Advantech WebAccess (critical 9.8)
- [CVE-2021-38388](https://insights.sbomify.com/CVE-2021-38388/): Privilege escalation in Central Dogma (high 8.8)
- [CVE-2021-38387](https://insights.sbomify.com/CVE-2021-38387/): Denial of service in contiki-os:contiki (high 7.5)
- [CVE-2021-38386](https://insights.sbomify.com/CVE-2021-38386/): Memory corruption in contiki-os:contiki (high 7.5)
- [CVE-2021-38385](https://insights.sbomify.com/CVE-2021-38385/): Denial of service in torproject:tor (high 7.5)
- [CVE-2021-38384](https://insights.sbomify.com/CVE-2021-38384/): Incorrect Authorization in serverless-offline (critical 9.8)
- [CVE-2021-38383](https://insights.sbomify.com/CVE-2021-38383/): Use after free in owntone:owntone server (critical 9.8)
- [CVE-2021-38382](https://insights.sbomify.com/CVE-2021-38382/): Use after free in live555:live555 (medium 6.5)
- [CVE-2021-38381](https://insights.sbomify.com/CVE-2021-38381/): Use after free in live555:live555 (medium 6.5)
- [CVE-2021-38380](https://insights.sbomify.com/CVE-2021-38380/): Memory corruption in live555:live555 (high 7.5)
- [CVE-2021-3838](https://insights.sbomify.com/CVE-2021-3838/): PHAR Deserialization in dompdf/dompdf (critical 9.8)
- [CVE-2021-38379](https://insights.sbomify.com/CVE-2021-38379/): Misconfiguration in northern.tech:cfengine (medium 5.5)
- [CVE-2021-38378](https://insights.sbomify.com/CVE-2021-38378/): Information disclosure in open-xchange:ox app suite (medium 4.3)
- [CVE-2021-38377](https://insights.sbomify.com/CVE-2021-38377/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2021-38376](https://insights.sbomify.com/CVE-2021-38376/): Auth bypass in open-xchange:ox app suite (medium 5.3)
- [CVE-2021-38375](https://insights.sbomify.com/CVE-2021-38375/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2021-38374](https://insights.sbomify.com/CVE-2021-38374/): Cross-site scripting in open-xchange:ox app suite (medium 5.4)
- [CVE-2021-38373](https://insights.sbomify.com/CVE-2021-38373/): Security feature bypass in kde:kmail (medium 5.3)
- [CVE-2021-38372](https://insights.sbomify.com/CVE-2021-38372/): Security feature bypass in kde:trojita (low 3.7)
- [CVE-2021-38371](https://insights.sbomify.com/CVE-2021-38371/): Other in exim:exim (high 7.5)
- [CVE-2021-38370](https://insights.sbomify.com/CVE-2021-38370/): Security feature bypass in alpine project:alpine (medium 5.9)
- [CVE-2021-3837](https://insights.sbomify.com/CVE-2021-3837/): Improper Authorization in openwhyd/openwhyd (high 8.6)
- [CVE-2021-38366](https://insights.sbomify.com/CVE-2021-38366/): File upload in sitecore:sitecore (high 8.8)
- [CVE-2021-38365](https://insights.sbomify.com/CVE-2021-38365/): Information disclosure in tonewinner:winner desktop speakers firmware (low 3.7)
- [CVE-2021-38364](https://insights.sbomify.com/CVE-2021-38364/): Business logic in opennetworking:onos (medium 6.5)
- [CVE-2021-38363](https://insights.sbomify.com/CVE-2021-38363/): Denial of service in opennetworking:onos (high 7.5)
- [CVE-2021-38362](https://insights.sbomify.com/CVE-2021-38362/): Missing authorization in rsa:archer (medium 6.5)
- [CVE-2021-38361](https://insights.sbomify.com/CVE-2021-38361/): .htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38360](https://insights.sbomify.com/CVE-2021-38360/): wp-publications <= 0.0 Local File Include (high 8.3)
- [CVE-2021-3836](https://insights.sbomify.com/CVE-2021-3836/): Improper Restriction of XML External Entity Reference in dbeaver/dbeaver (critical 9.8)
- [CVE-2021-38359](https://insights.sbomify.com/CVE-2021-38359/): WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38358](https://insights.sbomify.com/CVE-2021-38358/): MoolaMojo <= 0.7.4.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38357](https://insights.sbomify.com/CVE-2021-38357/): SMS OVH <= 0.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38356](https://insights.sbomify.com/CVE-2021-38356/): NextScripts: Social Networks Auto-Poster <= 4.3.20 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38355](https://insights.sbomify.com/CVE-2021-38355/): Bug Library <= 2.0.3 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38354](https://insights.sbomify.com/CVE-2021-38354/): GNU-Mailman Integration <= 1.0.6 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38353](https://insights.sbomify.com/CVE-2021-38353/): Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38352](https://insights.sbomify.com/CVE-2021-38352/): Feedify – Web Push Notifications <= 2.1.8 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38351](https://insights.sbomify.com/CVE-2021-38351/): OSD Subscribe <= 1.2.3 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38350](https://insights.sbomify.com/CVE-2021-38350/): spideranalyse <= 0.0.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-3835](https://insights.sbomify.com/CVE-2021-3835/): Buffer overflow in usb device class (high 8.2)
- [CVE-2021-38349](https://insights.sbomify.com/CVE-2021-38349/): Integration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38348](https://insights.sbomify.com/CVE-2021-38348/): Advance Search <= 1.1.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38347](https://insights.sbomify.com/CVE-2021-38347/): Custom Website Data <= 2.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38346](https://insights.sbomify.com/CVE-2021-38346/): Brizy <= 2.3.11 Authenticated Unrestricted File Upload and Path Traversal (high 8.8)
- [CVE-2021-38345](https://insights.sbomify.com/CVE-2021-38345/): Brizy <= 1.0.125 and 1.0.127 – 2.3.11 Incorrect authorization checks allowing Post modification (high 7.1)
- [CVE-2021-38344](https://insights.sbomify.com/CVE-2021-38344/): Brizy <= 2.3.11 Authenticated Stored Cross-Site Scripting (medium 6.4)
- [CVE-2021-38343](https://insights.sbomify.com/CVE-2021-38343/): Nested Pages <= 3.1.15 Open Redirect (medium 4.7)
- [CVE-2021-38342](https://insights.sbomify.com/CVE-2021-38342/): Nested Pages <= 3.1.15 Cross-Site Request Forgery to Arbitrary Post Deletion and Modification (high 8.1)
- [CVE-2021-38341](https://insights.sbomify.com/CVE-2021-38341/): WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38340](https://insights.sbomify.com/CVE-2021-38340/): Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-3834](https://insights.sbomify.com/CVE-2021-3834/): Integria IMS vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2021-38339](https://insights.sbomify.com/CVE-2021-38339/): Simple Matted Thumbnails <= 1.01 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38338](https://insights.sbomify.com/CVE-2021-38338/): Border Loading Bar <= 1.0.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38337](https://insights.sbomify.com/CVE-2021-38337/): RSVPMaker Excel <= 1.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38336](https://insights.sbomify.com/CVE-2021-38336/): Edit Comments XT <= 1.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38335](https://insights.sbomify.com/CVE-2021-38335/): Wise Agent Capture Forms <= 1.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38334](https://insights.sbomify.com/CVE-2021-38334/): WP Design Maps & Places <= 1.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38333](https://insights.sbomify.com/CVE-2021-38333/): WP Scrippets <= 1.5.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38332](https://insights.sbomify.com/CVE-2021-38332/): On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38331](https://insights.sbomify.com/CVE-2021-38331/): WP-T-Wap <= 1.13.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38330](https://insights.sbomify.com/CVE-2021-38330/): Yet Another bol.com Plugin <= 1.4 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-3833](https://insights.sbomify.com/CVE-2021-3833/): Integria IMS incorrect authorization (critical 9.8)
- [CVE-2021-38329](https://insights.sbomify.com/CVE-2021-38329/): DJ EmailPublish <= 1.7.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38328](https://insights.sbomify.com/CVE-2021-38328/): Notices <= 6.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38327](https://insights.sbomify.com/CVE-2021-38327/): YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38326](https://insights.sbomify.com/CVE-2021-38326/): Post Title Counter <= 1.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38325](https://insights.sbomify.com/CVE-2021-38325/): User Activation Email <= 1.3.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38324](https://insights.sbomify.com/CVE-2021-38324/): SP Rental Manager <= 1.5.3 Unauthenticated SQL Injection (high 8.2)
- [CVE-2021-38323](https://insights.sbomify.com/CVE-2021-38323/): RentPress <= 6.6.4 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38322](https://insights.sbomify.com/CVE-2021-38322/): Twitter Friends Widget <= 3.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38321](https://insights.sbomify.com/CVE-2021-38321/): Custom Menu Plugin <= 1.3.3 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38320](https://insights.sbomify.com/CVE-2021-38320/): simpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-3832](https://insights.sbomify.com/CVE-2021-3832/): Integria IMS Remote Code Execution (critical 9.8)
- [CVE-2021-38319](https://insights.sbomify.com/CVE-2021-38319/): More From Google <= 0.0.2 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38318](https://insights.sbomify.com/CVE-2021-38318/): 3D Cover Carousel <= 1.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38317](https://insights.sbomify.com/CVE-2021-38317/): Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38316](https://insights.sbomify.com/CVE-2021-38316/): WP Academic People List <= 0.4.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38315](https://insights.sbomify.com/CVE-2021-38315/): SP Project & Document Manager <= 4.25 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-38314](https://insights.sbomify.com/CVE-2021-38314/): Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure (medium 5.3)
- [CVE-2021-38312](https://insights.sbomify.com/CVE-2021-38312/): Missing authorization in Gutenberg Template Library & Redux Framework (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/114/