# Vulnerabilities published in 2021


- [CVE-2021-37863](https://insights.sbomify.com/CVE-2021-37863/): Denial of service in Mattermost (low 3.5)
- [CVE-2021-37862](https://insights.sbomify.com/CVE-2021-37862/): Business logic in Mattermost (low 3.7)
- [CVE-2021-37861](https://insights.sbomify.com/CVE-2021-37861/): Information disclosure in Mattermost (medium 5.8)
- [CVE-2021-37860](https://insights.sbomify.com/CVE-2021-37860/): Cross-site Scripting in Mattermost (low 3.7)
- [CVE-2021-3786](https://insights.sbomify.com/CVE-2021-3786/): Information disclosure in Notebook and ThinkPad BIOS (medium 4.4)
- [CVE-2021-37859](https://insights.sbomify.com/CVE-2021-37859/): Reflected XSS in OAuth Flow (high 7.1)
- [CVE-2021-37852](https://insights.sbomify.com/CVE-2021-37852/): LPE in ESET products for Windows (high 7.8)
- [CVE-2021-37851](https://insights.sbomify.com/CVE-2021-37851/): Local Privilege Escalation in ESET product for Windows (high 7.3)
- [CVE-2021-37850](https://insights.sbomify.com/CVE-2021-37850/): Denial of service in ESET for Mac products (medium 5.5)
- [CVE-2021-3785](https://insights.sbomify.com/CVE-2021-3785/): Cross-site Scripting (XSS) - Stored in yourls/yourls (high 8.8)
- [CVE-2021-37848](https://insights.sbomify.com/CVE-2021-37848/): Information disclosure in pengutronix:barebox (high 7.5)
- [CVE-2021-37847](https://insights.sbomify.com/CVE-2021-37847/): Weak cryptography in pengutronix:barebox (high 7.5)
- [CVE-2021-37845](https://insights.sbomify.com/CVE-2021-37845/): Security feature bypass in citadel:webcit (low 3.7)
- [CVE-2021-37843](https://insights.sbomify.com/CVE-2021-37843/): Auth bypass in atlassian:saml single sign on (critical 9.8)
- [CVE-2021-37842](https://insights.sbomify.com/CVE-2021-37842/): Information disclosure in couchbase:couchbase server (high 7.5)
- [CVE-2021-37841](https://insights.sbomify.com/CVE-2021-37841/): Misconfiguration in docker:desktop (high 7.8)
- [CVE-2021-37840](https://insights.sbomify.com/CVE-2021-37840/): Cross-site request forgery in aapanel:aapanel (high 8.8)
- [CVE-2021-3784](https://insights.sbomify.com/CVE-2021-3784/): Garuda Linux Improper Authorization (medium 5.3)
- [CVE-2021-37839](https://insights.sbomify.com/CVE-2021-37839/): Improper access to dataset metadata information (medium 4.3)
- [CVE-2021-37833](https://insights.sbomify.com/CVE-2021-37833/): Cross-site scripting in digitaldruid:hoteldruid (medium 6.1)
- [CVE-2021-37832](https://insights.sbomify.com/CVE-2021-37832/): SQL injection in digitaldruid:hoteldruid (critical 9.8)
- [CVE-2021-3783](https://insights.sbomify.com/CVE-2021-3783/): Cross-site Scripting (XSS) - Reflected in yourls/yourls (medium 6.6)
- [CVE-2021-37823](https://insights.sbomify.com/CVE-2021-37823/): OpenCart SQL injection vulnerability (medium 4.9)
- [CVE-2021-3782](https://insights.sbomify.com/CVE-2021-3782/): Integer overflow in wayland (medium 6.6)
- [CVE-2021-37819](https://insights.sbomify.com/CVE-2021-37819/): Denial of service in pdftk-java project:pdftk-java (high 7.5)
- [CVE-2021-3781](https://insights.sbomify.com/CVE-2021-3781/): Command injection in ghostscript (critical 9.9)
- [CVE-2021-37808](https://insights.sbomify.com/CVE-2021-37808/): SQL injection in phpgurukul:news portal (medium 5.9)
- [CVE-2021-37807](https://insights.sbomify.com/CVE-2021-37807/): SQL injection in phpgurukul:online shopping portal (high 7.5)
- [CVE-2021-37806](https://insights.sbomify.com/CVE-2021-37806/): SQL injection in phpgurukul:vehicle parking management system (medium 5.9)
- [CVE-2021-37805](https://insights.sbomify.com/CVE-2021-37805/): Cross-site scripting in phpgurukul:vehicle parking management system (medium 5.4)
- [CVE-2021-37803](https://insights.sbomify.com/CVE-2021-37803/): SQL injection in online covid vaccination scheduler system project:online covid vaccination scheduler system (high 8.1)
- [CVE-2021-3780](https://insights.sbomify.com/CVE-2021-3780/): Cross-site Scripting (XSS) - Stored in chocobozzz/peertube (high 7.6)
- [CVE-2021-37794](https://insights.sbomify.com/CVE-2021-37794/): Cross-site scripting in filebrowser project:filebrowser (medium 5.4)
- [CVE-2021-37791](https://insights.sbomify.com/CVE-2021-37791/): Missing authorization in myadmin project:myadmin (medium 4.9)
- [CVE-2021-3779](https://insights.sbomify.com/CVE-2021-3779/): Ruby-MySQL Gem Client File Read (medium 6.5)
- [CVE-2021-37789](https://insights.sbomify.com/CVE-2021-37789/): Memory corruption in debian:debian linux (high 8.1)
- [CVE-2021-37788](https://insights.sbomify.com/CVE-2021-37788/): Other in gurock:testrail (medium 5.4)
- [CVE-2021-37787](https://insights.sbomify.com/CVE-2021-37787/): SQL injection in abocms:abo.cms (medium 6.5)
- [CVE-2021-37786](https://insights.sbomify.com/CVE-2021-37786/): Denial of service in bag:covid certificate (medium 4.6)
- [CVE-2021-37782](https://insights.sbomify.com/CVE-2021-37782/): SQL injection in phpgurukul:employee record management system (critical 9.8)
- [CVE-2021-37781](https://insights.sbomify.com/CVE-2021-37781/): Cross-site scripting in phpgurukul:employee record management system (medium 5.4)
- [CVE-2021-3778](https://insights.sbomify.com/CVE-2021-3778/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2021-37778](https://insights.sbomify.com/CVE-2021-37778/): Memory corruption in gps-sdr-sim project:gps-sdr-sim (critical 9.8)
- [CVE-2021-37777](https://insights.sbomify.com/CVE-2021-37777/): Missing authorization in gilacms:gila cms (high 7.5)
- [CVE-2021-37774](https://insights.sbomify.com/CVE-2021-37774/): Code injection in tp-link:tl-wdr7660 firmware (high 8.0)
- [CVE-2021-37770](https://insights.sbomify.com/CVE-2021-37770/): File upload in nucleuscms:nucleus cms (high 7.2)
- [CVE-2021-3777](https://insights.sbomify.com/CVE-2021-3777/): Inefficient Regular Expression Complexity in daaku/nodejs-tmpl (high 7.5)
- [CVE-2021-37764](https://insights.sbomify.com/CVE-2021-37764/): Missing authorization in xos-shop:xos shop system (high 8.1)
- [CVE-2021-37762](https://insights.sbomify.com/CVE-2021-37762/): File upload in zohocorp:manageengine admanager plus (critical 9.8)
- [CVE-2021-37761](https://insights.sbomify.com/CVE-2021-37761/): File upload in zohocorp:manageengine admanager plus (critical 9.8)
- [CVE-2021-37760](https://insights.sbomify.com/CVE-2021-37760/): Information disclosure in graylog:graylog (critical 9.8)
- [CVE-2021-3776](https://insights.sbomify.com/CVE-2021-3776/): Cross-Site Request Forgery (CSRF) in star7th/showdoc (medium 4.3)
- [CVE-2021-37759](https://insights.sbomify.com/CVE-2021-37759/): Information disclosure in graylog:graylog (critical 9.8)
- [CVE-2021-37750](https://insights.sbomify.com/CVE-2021-37750/): Null dereference in debian:debian linux (medium 6.5)
- [CVE-2021-3775](https://insights.sbomify.com/CVE-2021-3775/): Cross-Site Request Forgery (CSRF) in star7th/showdoc (medium 4.3)
- [CVE-2021-37749](https://insights.sbomify.com/CVE-2021-37749/): SQL injection in hexagongeospatial:geomedia webmap (critical 9.8)
- [CVE-2021-37748](https://insights.sbomify.com/CVE-2021-37748/): Memory corruption in grandstream:ht801 firmware (high 8.8)
- [CVE-2021-37746](https://insights.sbomify.com/CVE-2021-37746/): Open redirect in claws-mail:claws-mail (medium 6.1)
- [CVE-2021-37743](https://insights.sbomify.com/CVE-2021-37743/): Cross-site scripting in misp-project:misp (medium 5.4)
- [CVE-2021-37742](https://insights.sbomify.com/CVE-2021-37742/): Cross-site scripting in misp-project:misp (medium 5.4)
- [CVE-2021-37741](https://insights.sbomify.com/CVE-2021-37741/): File upload in zohocorp:manageengine admanager plus (high 8.8)
- [CVE-2021-37740](https://insights.sbomify.com/CVE-2021-37740/): Denial of service in mdt:scn-ip000.03 firmware (high 7.5)
- [CVE-2021-3774](https://insights.sbomify.com/CVE-2021-3774/): Meross MSS550X Missing Encryption of Sensitive Data (high 7.4)
- [CVE-2021-37739](https://insights.sbomify.com/CVE-2021-37739/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-37738](https://insights.sbomify.com/CVE-2021-37738/): Missing authorization in Aruba ClearPass Policy Manager (high 7.5)
- [CVE-2021-37737](https://insights.sbomify.com/CVE-2021-37737/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2021-37736](https://insights.sbomify.com/CVE-2021-37736/): Auth bypass in Aruba ClearPass Policy Manager (critical 9.8)
- [CVE-2021-37735](https://insights.sbomify.com/CVE-2021-37735/): Denial of service in HPE Aruba Instant (IAP) (medium 5.3)
- [CVE-2021-37734](https://insights.sbomify.com/CVE-2021-37734/): Path traversal in HPE Aruba Instant (IAP) (medium 6.5)
- [CVE-2021-37733](https://insights.sbomify.com/CVE-2021-37733/): Path traversal in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (medium 4.9)
- [CVE-2021-37732](https://insights.sbomify.com/CVE-2021-37732/): Command injection in HPE Aruba Instant (IAP) (high 7.2)
- [CVE-2021-37731](https://insights.sbomify.com/CVE-2021-37731/): Path traversal in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (medium 6.2)
- [CVE-2021-37730](https://insights.sbomify.com/CVE-2021-37730/): Command injection in HPE Aruba Instant (IAP) (high 7.2)
- [CVE-2021-3773](https://insights.sbomify.com/CVE-2021-3773/): Information disclosure in kernel (critical 9.8)
- [CVE-2021-37729](https://insights.sbomify.com/CVE-2021-37729/): Path traversal in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (medium 6.5)
- [CVE-2021-37728](https://insights.sbomify.com/CVE-2021-37728/): Path traversal in Aruba Operating System Software (medium 6.5)
- [CVE-2021-37727](https://insights.sbomify.com/CVE-2021-37727/): Command injection in HPE Aruba Instant (IAP) (high 7.2)
- [CVE-2021-37726](https://insights.sbomify.com/CVE-2021-37726/): Memory corruption in HPE Aruba Instant (IAP) (critical 9.8)
- [CVE-2021-37725](https://insights.sbomify.com/CVE-2021-37725/): Cross-site request forgery in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (high 8.1)
- [CVE-2021-37724](https://insights.sbomify.com/CVE-2021-37724/): Command injection in Aruba Operating System Software (high 7.2)
- [CVE-2021-37723](https://insights.sbomify.com/CVE-2021-37723/): Command injection in Aruba Operating System Software (high 7.2)
- [CVE-2021-37722](https://insights.sbomify.com/CVE-2021-37722/): Command injection in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (high 7.2)
- [CVE-2021-37721](https://insights.sbomify.com/CVE-2021-37721/): Command injection in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (high 7.2)
- [CVE-2021-37720](https://insights.sbomify.com/CVE-2021-37720/): Command injection in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (high 7.2)
- [CVE-2021-3772](https://insights.sbomify.com/CVE-2021-3772/): Denial of service in kernel (medium 6.5)
- [CVE-2021-37719](https://insights.sbomify.com/CVE-2021-37719/): Command injection in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (high 7.2)
- [CVE-2021-37718](https://insights.sbomify.com/CVE-2021-37718/): Command injection in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (high 7.2)
- [CVE-2021-37717](https://insights.sbomify.com/CVE-2021-37717/): Command injection in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (high 7.2)
- [CVE-2021-37716](https://insights.sbomify.com/CVE-2021-37716/): Memory corruption in Aruba SD-WAN Software and Gateways; Aruba Operating System Software (critical 9.8)
- [CVE-2021-37715](https://insights.sbomify.com/CVE-2021-37715/): Cross-site scripting in Aruba AirWave Management Platform (medium 4.8)
- [CVE-2021-37714](https://insights.sbomify.com/CVE-2021-37714/): Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions (high 7.5)
- [CVE-2021-37713](https://insights.sbomify.com/CVE-2021-37713/): Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization (high 8.2)
- [CVE-2021-37712](https://insights.sbomify.com/CVE-2021-37712/): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links (high 8.2)
- [CVE-2021-37711](https://insights.sbomify.com/CVE-2021-37711/): Authenticated server-side request forgery in file upload via URL. (high 8.8)
- [CVE-2021-37710](https://insights.sbomify.com/CVE-2021-37710/): Cross-Site Scripting via SVG media files (high 8.0)
- [CVE-2021-37709](https://insights.sbomify.com/CVE-2021-37709/): Insecure direct object reference of log files of the Import/Export feature (medium 6.5)
- [CVE-2021-37708](https://insights.sbomify.com/CVE-2021-37708/): Command injection in mail agent settings (high 8.8)
- [CVE-2021-37707](https://insights.sbomify.com/CVE-2021-37707/): Manipulation of product reviews via API (medium 6.5)
- [CVE-2021-37706](https://insights.sbomify.com/CVE-2021-37706/): Potential integer underflow upon receiving STUN message in PJSIP (high 7.3)
- [CVE-2021-37705](https://insights.sbomify.com/CVE-2021-37705/): Improper Authorization and Origin Validation Error in OneFuzz (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/118/