# Vulnerabilities published in 2021


- [CVE-2021-38311](https://insights.sbomify.com/CVE-2021-38311/): Denial of service in contiki-os:contiki (high 7.5)
- [CVE-2021-3831](https://insights.sbomify.com/CVE-2021-3831/): Cross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5 (high 7.1)
- [CVE-2021-38306](https://insights.sbomify.com/CVE-2021-38306/): Command injection in lg:n1t1 firmware (critical 9.8)
- [CVE-2021-38305](https://insights.sbomify.com/CVE-2021-38305/): Command injection in Yamale (high 7.8)
- [CVE-2021-38304](https://insights.sbomify.com/CVE-2021-38304/): Privilege escalation in ni:ni-pal (high 7.8)
- [CVE-2021-38303](https://insights.sbomify.com/CVE-2021-38303/): SQL injection in surelinesystems:sureedge migrator (critical 9.8)
- [CVE-2021-38302](https://insights.sbomify.com/CVE-2021-38302/): SQL injection in TYPO3 extension (critical 9.8)
- [CVE-2021-38300](https://insights.sbomify.com/CVE-2021-38300/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-3830](https://insights.sbomify.com/CVE-2021-3830/): Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver (low 3.8)
- [CVE-2021-38299](https://insights.sbomify.com/CVE-2021-38299/): Improper Access Control in Webauthn Framework (critical 9.8)
- [CVE-2021-38298](https://insights.sbomify.com/CVE-2021-38298/): XML external entity in zohocorp:manageengine admanager plus (critical 9.8)
- [CVE-2021-38297](https://insights.sbomify.com/CVE-2021-38297/): Memory corruption in fedoraproject:fedora (critical 9.8)
- [CVE-2021-38296](https://insights.sbomify.com/CVE-2021-38296/): Apache Spark Key Negotiation Vulnerability (high 7.5)
- [CVE-2021-38295](https://insights.sbomify.com/CVE-2021-38295/): Privilege escalation vulnerability when using HTML attachments (high 7.3)
- [CVE-2021-38294](https://insights.sbomify.com/CVE-2021-38294/): Shell Command Injection Vulnerability in Nimbus Thrift Server (critical 9.8)
- [CVE-2021-38291](https://insights.sbomify.com/CVE-2021-38291/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-38290](https://insights.sbomify.com/CVE-2021-38290/): Other in thedaylightstudio:fuel cms (high 8.1)
- [CVE-2021-3829](https://insights.sbomify.com/CVE-2021-3829/): Open Redirect in openwhyd/openwhyd (high 7.3)
- [CVE-2021-38289](https://insights.sbomify.com/CVE-2021-38289/): Privilege escalation in novastar:novaicare (high 8.8)
- [CVE-2021-38283](https://insights.sbomify.com/CVE-2021-38283/): Information disclosure in wipro:holmes (high 7.5)
- [CVE-2021-3828](https://insights.sbomify.com/CVE-2021-3828/): Inefficient Regular Expression Complexity in nltk/nltk (high 7.5)
- [CVE-2021-38278](https://insights.sbomify.com/CVE-2021-38278/): Memory corruption in tendacn:ac10 firmware (critical 9.8)
- [CVE-2021-3827](https://insights.sbomify.com/CVE-2021-3827/): ECP SAML binding bypasses authentication flows (medium 6.8)
- [CVE-2021-38269](https://insights.sbomify.com/CVE-2021-38269/): Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module (medium 5.4)
- [CVE-2021-38268](https://insights.sbomify.com/CVE-2021-38268/): Liferay Portal and Liferay DXP has incorrect default permissions for site members (medium 6.5)
- [CVE-2021-38267](https://insights.sbomify.com/CVE-2021-38267/): Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page (medium 5.4)
- [CVE-2021-38266](https://insights.sbomify.com/CVE-2021-38266/): Liferay Portal and Liferay DXP fails to properly import users from LDAP (high 7.5)
- [CVE-2021-38265](https://insights.sbomify.com/CVE-2021-38265/): Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) (medium 5.4)
- [CVE-2021-38264](https://insights.sbomify.com/CVE-2021-38264/): Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter (medium 6.1)
- [CVE-2021-38263](https://insights.sbomify.com/CVE-2021-38263/): Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console (medium 6.1)
- [CVE-2021-38260](https://insights.sbomify.com/CVE-2021-38260/): Memory corruption in nxp:mcuxpresso software development kit (high 7.8)
- [CVE-2021-3826](https://insights.sbomify.com/CVE-2021-3826/): Memory corruption in gcc (medium 6.5)
- [CVE-2021-38258](https://insights.sbomify.com/CVE-2021-38258/): Memory corruption in nxp:mcuxpresso software development kit (high 7.8)
- [CVE-2021-3825](https://insights.sbomify.com/CVE-2021-3825/): Missing Authorization Checks in LiderAhenk (critical 9.6)
- [CVE-2021-38244](https://insights.sbomify.com/CVE-2021-38244/): Denial of service in cbioportal project:cbioportal (high 7.5)
- [CVE-2021-38243](https://insights.sbomify.com/CVE-2021-38243/): Code injection in xunruicms:xunruicms (critical 9.8)
- [CVE-2021-38241](https://insights.sbomify.com/CVE-2021-38241/): Deserialization in ruoyi:ruoyi (critical 9.8)
- [CVE-2021-3824](https://insights.sbomify.com/CVE-2021-3824/): Cross-site scripting in OpenVPN Access Server (medium 6.1)
- [CVE-2021-38239](https://insights.sbomify.com/CVE-2021-38239/): SQL injection in dataease:dataease (high 7.5)
- [CVE-2021-3823](https://insights.sbomify.com/CVE-2021-3823/): Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode (high 7.1)
- [CVE-2021-38221](https://insights.sbomify.com/CVE-2021-38221/): Cross-site scripting in bbs-go project:bbs-go (medium 5.4)
- [CVE-2021-3822](https://insights.sbomify.com/CVE-2021-3822/): Inefficient Regular Expression Complexity in josdejong/jsoneditor (medium 5.3)
- [CVE-2021-38217](https://insights.sbomify.com/CVE-2021-38217/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2021-3821](https://insights.sbomify.com/CVE-2021-3821/): Denial of service in HP FutureSmart (critical 9.8)
- [CVE-2021-38209](https://insights.sbomify.com/CVE-2021-38209/): Information disclosure in linux:linux kernel (low 3.3)
- [CVE-2021-38208](https://insights.sbomify.com/CVE-2021-38208/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2021-38207](https://insights.sbomify.com/CVE-2021-38207/): Memory corruption in linux:linux kernel (high 7.5)
- [CVE-2021-38206](https://insights.sbomify.com/CVE-2021-38206/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2021-38205](https://insights.sbomify.com/CVE-2021-38205/): Information disclosure in debian:debian linux (low 3.3)
- [CVE-2021-38204](https://insights.sbomify.com/CVE-2021-38204/): Use after free in debian:debian linux (medium 6.8)
- [CVE-2021-38203](https://insights.sbomify.com/CVE-2021-38203/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2021-38202](https://insights.sbomify.com/CVE-2021-38202/): Memory corruption in linux:linux kernel (high 7.5)
- [CVE-2021-38201](https://insights.sbomify.com/CVE-2021-38201/): Memory corruption in linux:linux kernel (high 7.5)
- [CVE-2021-38200](https://insights.sbomify.com/CVE-2021-38200/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2021-3820](https://insights.sbomify.com/CVE-2021-3820/): Inefficient Regular Expression Complexity in pksunkara/inflect (medium 5.3)
- [CVE-2021-38199](https://insights.sbomify.com/CVE-2021-38199/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2021-38198](https://insights.sbomify.com/CVE-2021-38198/): Security feature bypass in debian:debian linux (medium 5.5)
- [CVE-2021-38197](https://insights.sbomify.com/CVE-2021-38197/): Tarslip in go-unarr (critical 9.8)
- [CVE-2021-38196](https://insights.sbomify.com/CVE-2021-38196/): Remote code execution in better-macro (critical 9.8)
- [CVE-2021-38195](https://insights.sbomify.com/CVE-2021-38195/): Overflow in libsecp256k1 (critical 9.8)
- [CVE-2021-38194](https://insights.sbomify.com/CVE-2021-38194/): Calculation error in ark-r1cs-std (critical 9.8)
- [CVE-2021-38193](https://insights.sbomify.com/CVE-2021-38193/): Cross-site Scripting in ammonia (medium 6.1)
- [CVE-2021-38192](https://insights.sbomify.com/CVE-2021-38192/): Overflow in prost-types (high 7.5)
- [CVE-2021-38191](https://insights.sbomify.com/CVE-2021-38191/): Race condition in tokio (medium 5.9)
- [CVE-2021-38190](https://insights.sbomify.com/CVE-2021-38190/): Out of bounds write in nalgebra (critical 9.8)
- [CVE-2021-3819](https://insights.sbomify.com/CVE-2021-3819/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (medium 4.3)
- [CVE-2021-38189](https://insights.sbomify.com/CVE-2021-38189/): SMTP command injection in lettre (critical 9.8)
- [CVE-2021-38188](https://insights.sbomify.com/CVE-2021-38188/): Incorrect buffer size calculation in iced-x86 (critical 9.8)
- [CVE-2021-38187](https://insights.sbomify.com/CVE-2021-38187/): Incorrect cast in anymap (critical 9.8)
- [CVE-2021-38186](https://insights.sbomify.com/CVE-2021-38186/): Cross-site Scripting in comrak (medium 6.1)
- [CVE-2021-38185](https://insights.sbomify.com/CVE-2021-38185/): Integer overflow in gnu:cpio (high 7.8)
- [CVE-2021-38183](https://insights.sbomify.com/CVE-2021-38183/): Cross-site scripting in SAP NetWeaver (medium 6.1)
- [CVE-2021-38182](https://insights.sbomify.com/CVE-2021-38182/): Privilege escalation in Kyma (high 8.8)
- [CVE-2021-38181](https://insights.sbomify.com/CVE-2021-38181/): Denial of service in SAP NetWeaver AS ABAP and ABAP Platform (high 7.5)
- [CVE-2021-38180](https://insights.sbomify.com/CVE-2021-38180/): Code injection in SAP Business One (critical 9.8)
- [CVE-2021-3818](https://insights.sbomify.com/CVE-2021-3818/): Reliance on Cookies without Validation and Integrity Checking in getgrav/grav (medium 6.3)
- [CVE-2021-38179](https://insights.sbomify.com/CVE-2021-38179/): Information disclosure in SAP Business One (medium 4.9)
- [CVE-2021-38178](https://insights.sbomify.com/CVE-2021-38178/): Security feature bypass in SAP NetWeaver AS ABAP and ABAP Platform (high 8.8)
- [CVE-2021-38177](https://insights.sbomify.com/CVE-2021-38177/): Null dereference in SAP CommonCryptoLib (high 7.5)
- [CVE-2021-38176](https://insights.sbomify.com/CVE-2021-38176/): SQL injection in SAP LT Replication Server (critical 9.9)
- [CVE-2021-38175](https://insights.sbomify.com/CVE-2021-38175/): Information disclosure in SAP Analysis for Microsoft Office (medium 6.5)
- [CVE-2021-38174](https://insights.sbomify.com/CVE-2021-38174/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-38173](https://insights.sbomify.com/CVE-2021-38173/): Command injection in debian:debian linux (critical 9.8)
- [CVE-2021-38172](https://insights.sbomify.com/CVE-2021-38172/): Memory corruption in debian:perm (critical 9.8)
- [CVE-2021-38171](https://insights.sbomify.com/CVE-2021-38171/): Other in debian:debian linux (critical 9.8)
- [CVE-2021-3817](https://insights.sbomify.com/CVE-2021-3817/): SQL Injection in wbce/wbce_cms (critical 9.8)
- [CVE-2021-38169](https://insights.sbomify.com/CVE-2021-38169/): Command injection in roxy-wi:roxy-wi (high 8.8)
- [CVE-2021-38168](https://insights.sbomify.com/CVE-2021-38168/): SQL injection in roxy-wi:roxy-wi (high 8.8)
- [CVE-2021-38167](https://insights.sbomify.com/CVE-2021-38167/): SQL injection in roxy-wi:roxy-wi (critical 9.8)
- [CVE-2021-38166](https://insights.sbomify.com/CVE-2021-38166/): Integer overflow in debian:debian linux (high 7.8)
- [CVE-2021-38165](https://insights.sbomify.com/CVE-2021-38165/): Information disclosure in debian:debian linux (medium 5.3)
- [CVE-2021-38164](https://insights.sbomify.com/CVE-2021-38164/): Missing authorization in SAP ERP Financial Accounting (RFOPENPOSTING FR) (medium 5.4)
- [CVE-2021-38163](https://insights.sbomify.com/CVE-2021-38163/): SAP NetWeaver Unrestricted File Upload (critical 9.9, exploited in the wild)
- [CVE-2021-38162](https://insights.sbomify.com/CVE-2021-38162/): Other in SAP Web Dispatcher (high 8.9)
- [CVE-2021-38161](https://insights.sbomify.com/CVE-2021-38161/): Not validating origin TLS certificate (high 8.1)
- [CVE-2021-38160](https://insights.sbomify.com/CVE-2021-38160/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-3816](https://insights.sbomify.com/CVE-2021-3816/): Cross-site scripting in Cacti (medium 5.4)
- [CVE-2021-38159](https://insights.sbomify.com/CVE-2021-38159/): SQL injection in progress:moveit transfer (critical 9.8)
- [CVE-2021-38157](https://insights.sbomify.com/CVE-2021-38157/): Cross-site scripting in leostream:connection broker (medium 6.1)
- [CVE-2021-38156](https://insights.sbomify.com/CVE-2021-38156/): Cross-site scripting in nagios:nagios xi (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/115/