# Vulnerabilities published in 2021


- [CVE-2021-37471](https://insights.sbomify.com/CVE-2021-37471/): Other in cradlepoint:ibr600 firmware (high 7.5)
- [CVE-2021-37470](https://insights.sbomify.com/CVE-2021-37470/): Cross-site scripting in nchsoftware:webdictate (medium 5.4)
- [CVE-2021-3747](https://insights.sbomify.com/CVE-2021-3747/): MacOS version of Multipass incorrect owner for application directory (high 8.8)
- [CVE-2021-37469](https://insights.sbomify.com/CVE-2021-37469/): Path traversal in nch:webdictate (medium 6.5)
- [CVE-2021-37468](https://insights.sbomify.com/CVE-2021-37468/): Information disclosure in nch:reflect customer relationship management (low 3.3)
- [CVE-2021-37467](https://insights.sbomify.com/CVE-2021-37467/): Cross-site scripting in nchsoftware:quorum (medium 5.4)
- [CVE-2021-37466](https://insights.sbomify.com/CVE-2021-37466/): Cross-site scripting in nchsoftware:quorum (medium 5.4)
- [CVE-2021-37465](https://insights.sbomify.com/CVE-2021-37465/): Cross-site scripting in nchsoftware:quorum (medium 5.4)
- [CVE-2021-37464](https://insights.sbomify.com/CVE-2021-37464/): Cross-site scripting in nchsoftware:quorum (medium 5.4)
- [CVE-2021-37463](https://insights.sbomify.com/CVE-2021-37463/): Cross-site scripting in nchsoftware:quorum (medium 5.4)
- [CVE-2021-37462](https://insights.sbomify.com/CVE-2021-37462/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37461](https://insights.sbomify.com/CVE-2021-37461/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37460](https://insights.sbomify.com/CVE-2021-37460/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-3746](https://insights.sbomify.com/CVE-2021-3746/): Memory corruption in libtpms (medium 6.5)
- [CVE-2021-37459](https://insights.sbomify.com/CVE-2021-37459/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37458](https://insights.sbomify.com/CVE-2021-37458/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37457](https://insights.sbomify.com/CVE-2021-37457/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37456](https://insights.sbomify.com/CVE-2021-37456/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37455](https://insights.sbomify.com/CVE-2021-37455/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37454](https://insights.sbomify.com/CVE-2021-37454/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37453](https://insights.sbomify.com/CVE-2021-37453/): Cross-site scripting in nchsoftware:axon pbx (medium 5.4)
- [CVE-2021-37452](https://insights.sbomify.com/CVE-2021-37452/): Information disclosure in nch:quorum (medium 5.5)
- [CVE-2021-37451](https://insights.sbomify.com/CVE-2021-37451/): Cross-site scripting in nchsoftware:ivm attendant (medium 5.4)
- [CVE-2021-37450](https://insights.sbomify.com/CVE-2021-37450/): Cross-site scripting in nchsoftware:ivm attendant (medium 5.4)
- [CVE-2021-3745](https://insights.sbomify.com/CVE-2021-3745/): Unrestricted Upload of File with Dangerous Type in flatcore/flatcore-cms (high 8.0)
- [CVE-2021-37449](https://insights.sbomify.com/CVE-2021-37449/): Cross-site scripting in nchsoftware:ivm attendant (medium 5.4)
- [CVE-2021-37448](https://insights.sbomify.com/CVE-2021-37448/): Cross-site scripting in nchsoftware:ivm attendant (medium 5.4)
- [CVE-2021-37447](https://insights.sbomify.com/CVE-2021-37447/): Path traversal in nchsoftware:quorum (high 8.1)
- [CVE-2021-37446](https://insights.sbomify.com/CVE-2021-37446/): Path traversal in nchsoftware:quorum (medium 4.3)
- [CVE-2021-37445](https://insights.sbomify.com/CVE-2021-37445/): Path traversal in nchsoftware:quorum (medium 6.5)
- [CVE-2021-37444](https://insights.sbomify.com/CVE-2021-37444/): Path traversal in nchsoftware:ivm attendant (high 8.8)
- [CVE-2021-37443](https://insights.sbomify.com/CVE-2021-37443/): Path traversal in nchsoftware:ivm attendant (high 8.1)
- [CVE-2021-37442](https://insights.sbomify.com/CVE-2021-37442/): Path traversal in nchsoftware:ivm attendant (medium 6.5)
- [CVE-2021-37441](https://insights.sbomify.com/CVE-2021-37441/): Path traversal in nch:axon pbx (high 8.8)
- [CVE-2021-37440](https://insights.sbomify.com/CVE-2021-37440/): Path traversal in nch:axon pbx (medium 6.5)
- [CVE-2021-3744](https://insights.sbomify.com/CVE-2021-3744/): Denial of service in kernel (medium 5.5)
- [CVE-2021-37439](https://insights.sbomify.com/CVE-2021-37439/): Path traversal in nch:flexiserver (medium 6.5)
- [CVE-2021-37436](https://insights.sbomify.com/CVE-2021-37436/): Security feature bypass in amazon:echo dot firmware (medium 4.2)
- [CVE-2021-3743](https://insights.sbomify.com/CVE-2021-3743/): Memory corruption in Kernel (high 7.1)
- [CVE-2021-37425](https://insights.sbomify.com/CVE-2021-37425/): XML external entity in altova:mobiletogether server (critical 9.1)
- [CVE-2021-37424](https://insights.sbomify.com/CVE-2021-37424/): Auth bypass in zohocorp:manageengine admanager plus (critical 9.8)
- [CVE-2021-37423](https://insights.sbomify.com/CVE-2021-37423/): Other in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2021-37422](https://insights.sbomify.com/CVE-2021-37422/): SQL injection in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2021-37421](https://insights.sbomify.com/CVE-2021-37421/): Security feature bypass in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2021-37420](https://insights.sbomify.com/CVE-2021-37420/): Auth bypass in zohocorp:manageengine admanager plus (medium 6.5)
- [CVE-2021-3742](https://insights.sbomify.com/CVE-2021-3742/): Server-Side Request Forgery (SSRF) in chatwoot/chatwoot (high 7.9)
- [CVE-2021-37419](https://insights.sbomify.com/CVE-2021-37419/): Server-side request forgery in zohocorp:manageengine admanager plus (high 7.5)
- [CVE-2021-37417](https://insights.sbomify.com/CVE-2021-37417/): Security feature bypass in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2021-37416](https://insights.sbomify.com/CVE-2021-37416/): Cross-site scripting in zohocorp:manageengine adselfservice plus (medium 6.1)
- [CVE-2021-37415](https://insights.sbomify.com/CVE-2021-37415/): Zoho ManageEngine ServiceDesk Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2021-37414](https://insights.sbomify.com/CVE-2021-37414/): Auth bypass in zohocorp:manageengine desktop central (high 7.5)
- [CVE-2021-37413](https://insights.sbomify.com/CVE-2021-37413/): SQL injection in grandcom:dynweb (critical 9.8)
- [CVE-2021-37412](https://insights.sbomify.com/CVE-2021-37412/): Cross-site scripting in it-economics:techradar (medium 6.1)
- [CVE-2021-3741](https://insights.sbomify.com/CVE-2021-3741/): Stored Cross-site Scripting (XSS) in chatwoot/chatwoot (high 7.8)
- [CVE-2021-37409](https://insights.sbomify.com/CVE-2021-37409/): Privilege escalation in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products (high 7.8)
- [CVE-2021-37404](https://insights.sbomify.com/CVE-2021-37404/): Heap buffer overflow in libhdfs native library (critical 9.8)
- [CVE-2021-37403](https://insights.sbomify.com/CVE-2021-37403/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2021-37402](https://insights.sbomify.com/CVE-2021-37402/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2021-37401](https://insights.sbomify.com/CVE-2021-37401/): Information disclosure in idec:data file manager (critical 9.8)
- [CVE-2021-37400](https://insights.sbomify.com/CVE-2021-37400/): Information disclosure in idec:data file manager (critical 9.8)
- [CVE-2021-3740](https://insights.sbomify.com/CVE-2021-3740/): Session Fixation in chatwoot/chatwoot (medium 6.8)
- [CVE-2021-37394](https://insights.sbomify.com/CVE-2021-37394/): Privilege escalation in rpcms:rpcms (high 8.8)
- [CVE-2021-37393](https://insights.sbomify.com/CVE-2021-37393/): Cross-site scripting in rpcms:rpcms (medium 5.4)
- [CVE-2021-37392](https://insights.sbomify.com/CVE-2021-37392/): Cross-site scripting in rpcms:rpcms (medium 5.4)
- [CVE-2021-37391](https://insights.sbomify.com/CVE-2021-37391/): Cross-site scripting in chamilo:chamilo lms (medium 5.4)
- [CVE-2021-37390](https://insights.sbomify.com/CVE-2021-37390/): Cross-site scripting in chamilo:chamilo lms (medium 6.1)
- [CVE-2021-3739](https://insights.sbomify.com/CVE-2021-3739/): Null dereference in kernel (high 7.1)
- [CVE-2021-37389](https://insights.sbomify.com/CVE-2021-37389/): Cross-site scripting in chamilo:chamilo (medium 6.1)
- [CVE-2021-37388](https://insights.sbomify.com/CVE-2021-37388/): Memory corruption in dlink:dir-615 firmware (critical 9.8)
- [CVE-2021-37386](https://insights.sbomify.com/CVE-2021-37386/): Cross-site scripting in furukawa:423-41w\/ac firmware (high 7.5)
- [CVE-2021-37384](https://insights.sbomify.com/CVE-2021-37384/): Code injection in furukawa:423-41w\/ac firmware (critical 9.8)
- [CVE-2021-37381](https://insights.sbomify.com/CVE-2021-37381/): Cross-site request forgery in southsoft:graduate management information system (high 8.8)
- [CVE-2021-3738](https://insights.sbomify.com/CVE-2021-3738/): Use after free in samba (high 8.8)
- [CVE-2021-37379](https://insights.sbomify.com/CVE-2021-37379/): Cross-site scripting in teradek:sphere firmware (medium 5.4)
- [CVE-2021-37378](https://insights.sbomify.com/CVE-2021-37378/): Cross-site scripting in teradke:cube firmware (medium 5.4)
- [CVE-2021-37377](https://insights.sbomify.com/CVE-2021-37377/): Cross-site scripting in teradek:brik firmware (medium 5.4)
- [CVE-2021-37376](https://insights.sbomify.com/CVE-2021-37376/): Cross-site scripting in teradek:bond 2 firmware (medium 5.4)
- [CVE-2021-37375](https://insights.sbomify.com/CVE-2021-37375/): Cross-site scripting in teradek:vidiu firmware (medium 5.4)
- [CVE-2021-37374](https://insights.sbomify.com/CVE-2021-37374/): Cross-site scripting in teradek:clip firmware (medium 5.4)
- [CVE-2021-37373](https://insights.sbomify.com/CVE-2021-37373/): Cross-site scripting in teradek:slice firmware (medium 5.4)
- [CVE-2021-37372](https://insights.sbomify.com/CVE-2021-37372/): File upload in online student admission system project:online student admission system (high 8.8)
- [CVE-2021-37371](https://insights.sbomify.com/CVE-2021-37371/): SQL injection in online student admission system project:online student admission system (critical 9.8)
- [CVE-2021-3737](https://insights.sbomify.com/CVE-2021-3737/): Denial of service in python (high 7.5)
- [CVE-2021-37367](https://insights.sbomify.com/CVE-2021-37367/): Path traversal in ctparental project:ctparental (high 7.8)
- [CVE-2021-37366](https://insights.sbomify.com/CVE-2021-37366/): Cross-site request forgery in ctparental project:ctparental (high 8.8)
- [CVE-2021-37365](https://insights.sbomify.com/CVE-2021-37365/): Cross-site scripting in ctparental project:ctparental (medium 6.1)
- [CVE-2021-37364](https://insights.sbomify.com/CVE-2021-37364/): Privilege escalation in openclinic ga project:openclinic ga (high 7.8)
- [CVE-2021-37363](https://insights.sbomify.com/CVE-2021-37363/): Privilege escalation in gestionaleopen:gestionale open (high 7.8)
- [CVE-2021-3736](https://insights.sbomify.com/CVE-2021-3736/): Information disclosure in kernel (medium 5.5)
- [CVE-2021-37358](https://insights.sbomify.com/CVE-2021-37358/): SQL injection in seacms:seacms (critical 9.8)
- [CVE-2021-37354](https://insights.sbomify.com/CVE-2021-37354/): Memory corruption in xerox:phaser 4622 firmware (critical 9.8)
- [CVE-2021-37353](https://insights.sbomify.com/CVE-2021-37353/): Server-side request forgery in nagios:nagios xi docker wizard (critical 9.8)
- [CVE-2021-37352](https://insights.sbomify.com/CVE-2021-37352/): Open redirect in nagios:nagios xi (medium 6.1)
- [CVE-2021-37351](https://insights.sbomify.com/CVE-2021-37351/): Missing authorization in nagios:nagios xi (medium 5.3)
- [CVE-2021-37350](https://insights.sbomify.com/CVE-2021-37350/): SQL injection in nagios:nagios xi (critical 9.8)
- [CVE-2021-3735](https://insights.sbomify.com/CVE-2021-3735/): Denial of service in QEMU (medium 4.4)
- [CVE-2021-37349](https://insights.sbomify.com/CVE-2021-37349/): Privilege escalation in nagios:nagios xi (high 7.8)
- [CVE-2021-37348](https://insights.sbomify.com/CVE-2021-37348/): Path traversal in nagios:nagios xi (high 7.5)
- [CVE-2021-37347](https://insights.sbomify.com/CVE-2021-37347/): Path traversal in nagios:nagios xi (high 7.8)
- [CVE-2021-37346](https://insights.sbomify.com/CVE-2021-37346/): Command injection in nagios:nagios xi watchguard wizard (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/121/