# Vulnerabilities published in 2021


- [CVE-2021-37345](https://insights.sbomify.com/CVE-2021-37345/): Privilege escalation in nagios:nagios xi (high 7.8)
- [CVE-2021-37344](https://insights.sbomify.com/CVE-2021-37344/): Command injection in nagios:nagios xi switch wizard (critical 9.8)
- [CVE-2021-37343](https://insights.sbomify.com/CVE-2021-37343/): Path traversal in nagios:nagios xi (high 8.8)
- [CVE-2021-3734](https://insights.sbomify.com/CVE-2021-3734/): Improper Restriction of Rendered UI Layers or Frames in yourls/yourls (medium 6.5)
- [CVE-2021-37334](https://insights.sbomify.com/CVE-2021-37334/): File upload in umbraco:forms (critical 9.8)
- [CVE-2021-37333](https://insights.sbomify.com/CVE-2021-37333/): Auth bypass in bookingcore:booking core (critical 9.8)
- [CVE-2021-37331](https://insights.sbomify.com/CVE-2021-37331/): Missing authorization in bookingcore:booking core (medium 5.3)
- [CVE-2021-37330](https://insights.sbomify.com/CVE-2021-37330/): Cross-site scripting in bookingcore:booking core (medium 5.4)
- [CVE-2021-3733](https://insights.sbomify.com/CVE-2021-3733/): Denial of service in python (medium 6.5)
- [CVE-2021-37326](https://insights.sbomify.com/CVE-2021-37326/): Information disclosure in netsarang:xshell (medium 5.3)
- [CVE-2021-37322](https://insights.sbomify.com/CVE-2021-37322/): Use after free in gnu:binutils (high 7.8)
- [CVE-2021-3732](https://insights.sbomify.com/CVE-2021-3732/): Information disclosure in kernel (medium 5.5)
- [CVE-2021-37317](https://insights.sbomify.com/CVE-2021-37317/): Path traversal in asus:rt-ac68u firmware (critical 9.1)
- [CVE-2021-37316](https://insights.sbomify.com/CVE-2021-37316/): SQL injection in asus:rt-ac68u firmware (high 7.5)
- [CVE-2021-37315](https://insights.sbomify.com/CVE-2021-37315/): Path traversal in asus:rt-ac68u firmware (critical 9.1)
- [CVE-2021-37311](https://insights.sbomify.com/CVE-2021-37311/): Memory corruption in fcitx 5 project:fcitx 5 (high 7.5)
- [CVE-2021-3731](https://insights.sbomify.com/CVE-2021-3731/): Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb (medium 5.9)
- [CVE-2021-37306](https://insights.sbomify.com/CVE-2021-37306/): Insecure Permissions issue in jeecg-boot (high 7.5)
- [CVE-2021-37305](https://insights.sbomify.com/CVE-2021-37305/): Insecure Permissions issue in jeecg-boot (high 7.5)
- [CVE-2021-37304](https://insights.sbomify.com/CVE-2021-37304/): Insecure Permissions issue in jeecg-boot (high 7.5)
- [CVE-2021-3730](https://insights.sbomify.com/CVE-2021-3730/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (medium 6.5)
- [CVE-2021-37293](https://insights.sbomify.com/CVE-2021-37293/): Path traversal in kevinlab:4st l-bems (medium 6.5)
- [CVE-2021-37292](https://insights.sbomify.com/CVE-2021-37292/): Hardcoded credentials in kevinlab:4st l-bems (high 7.2)
- [CVE-2021-37291](https://insights.sbomify.com/CVE-2021-37291/): SQL injection in kevinlab:4st l-bems (critical 9.8)
- [CVE-2021-3729](https://insights.sbomify.com/CVE-2021-3729/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (medium 4.3)
- [CVE-2021-37289](https://insights.sbomify.com/CVE-2021-37289/): Command injection in planex:mzk-dp150n firmware (high 7.2)
- [CVE-2021-3728](https://insights.sbomify.com/CVE-2021-3728/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (medium 6.5)
- [CVE-2021-37274](https://insights.sbomify.com/CVE-2021-37274/): Privilege escalation in kingdee:kis cloud (high 8.8)
- [CVE-2021-37273](https://insights.sbomify.com/CVE-2021-37273/): Denial of service in chinatelecom:epon tianyi gateway zxhn f450 firmware (high 7.5)
- [CVE-2021-37271](https://insights.sbomify.com/CVE-2021-37271/): Cross-site scripting in baidu:ueditor (medium 5.4)
- [CVE-2021-37270](https://insights.sbomify.com/CVE-2021-37270/): Missing authorization in s-cms:cms enterprise website construction system (critical 9.8)
- [CVE-2021-3727](https://insights.sbomify.com/CVE-2021-3727/): OS Command Injection in ohmyzsh/ohmyzsh (high 7.5)
- [CVE-2021-37267](https://insights.sbomify.com/CVE-2021-37267/): Cross-site scripting in kindsoft:kindeditor (medium 6.1)
- [CVE-2021-37262](https://insights.sbomify.com/CVE-2021-37262/): Denial of service in jflyfox:jfinal cms (high 7.5)
- [CVE-2021-3726](https://insights.sbomify.com/CVE-2021-3726/): OS Command Injection in ohmyzsh/ohmyzsh (high 7.5)
- [CVE-2021-37254](https://insights.sbomify.com/CVE-2021-37254/): Information disclosure in m-files:m-files web (high 7.5)
- [CVE-2021-37253](https://insights.sbomify.com/CVE-2021-37253/): Denial of service in m-files:m-files web (high 7.5)
- [CVE-2021-3725](https://insights.sbomify.com/CVE-2021-3725/): OS Command Injection in ohmyzsh/ohmyzsh (high 7.5)
- [CVE-2021-37234](https://insights.sbomify.com/CVE-2021-37234/): Missing authorization in modern honey network project:modern honey network (medium 6.5)
- [CVE-2021-37232](https://insights.sbomify.com/CVE-2021-37232/): Memory corruption in atomicparsley project:atomicparsley (critical 9.8)
- [CVE-2021-37231](https://insights.sbomify.com/CVE-2021-37231/): Memory corruption in atomicparsley project:atomicparsley (medium 5.5)
- [CVE-2021-3723](https://insights.sbomify.com/CVE-2021-3723/): Command injection in IBM System x 3550 M3 (high 7.2)
- [CVE-2021-37223](https://insights.sbomify.com/CVE-2021-37223/): Server-side request forgery in nagios:nagios xi (medium 6.5)
- [CVE-2021-37222](https://insights.sbomify.com/CVE-2021-37222/): Memory corruption in rcdcap project:rcdcap (critical 9.8)
- [CVE-2021-37221](https://insights.sbomify.com/CVE-2021-37221/): File upload in customer relationship management system project:customer relationship management system (high 8.8)
- [CVE-2021-37220](https://insights.sbomify.com/CVE-2021-37220/): Memory corruption in artifex:mupdf (medium 5.5)
- [CVE-2021-3722](https://insights.sbomify.com/CVE-2021-3722/): Misconfiguration in PCManager (medium 5.0)
- [CVE-2021-37219](https://insights.sbomify.com/CVE-2021-37219/): HashiCorp Consul Privilege Escalation Vulnerability (high 8.8)
- [CVE-2021-37218](https://insights.sbomify.com/CVE-2021-37218/): Privilege escalation in Hashicorp Nomad (high 8.8)
- [CVE-2021-37216](https://insights.sbomify.com/CVE-2021-37216/): QSAN Storage Manager - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-37215](https://insights.sbomify.com/CVE-2021-37215/): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4 (medium 4.3)
- [CVE-2021-37214](https://insights.sbomify.com/CVE-2021-37214/): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3 (high 8.8)
- [CVE-2021-37213](https://insights.sbomify.com/CVE-2021-37213/): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-2 (medium 4.3)
- [CVE-2021-37212](https://insights.sbomify.com/CVE-2021-37212/): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1 (medium 5.4)
- [CVE-2021-37211](https://insights.sbomify.com/CVE-2021-37211/): Larvata Digital Technology Co. Ltd. FLYGO - Stored XSS (medium 5.4)
- [CVE-2021-3721](https://insights.sbomify.com/CVE-2021-3721/): Memory corruption in PCManager (medium 5.5)
- [CVE-2021-37209](https://insights.sbomify.com/CVE-2021-37209/): Weak cryptography in RUGGEDCOM M2100 (medium 6.7)
- [CVE-2021-37208](https://insights.sbomify.com/CVE-2021-37208/): Cross-site scripting in RUGGEDCOM M2100 (critical 9.6)
- [CVE-2021-37207](https://insights.sbomify.com/CVE-2021-37207/): Misconfiguration in SENTRON powermanager V3 (high 7.8)
- [CVE-2021-37206](https://insights.sbomify.com/CVE-2021-37206/): Denial of service in SIPROTEC 5 relays with CPU variants CP050 (high 7.5)
- [CVE-2021-37205](https://insights.sbomify.com/CVE-2021-37205/): Denial of service in SIMATIC Drive Controller family (high 7.5)
- [CVE-2021-37204](https://insights.sbomify.com/CVE-2021-37204/): Denial of service in SIMATIC Drive Controller family (high 7.5)
- [CVE-2021-37203](https://insights.sbomify.com/CVE-2021-37203/): Memory corruption in NX 1980 Series (high 7.1)
- [CVE-2021-37202](https://insights.sbomify.com/CVE-2021-37202/): Use after free in NX 1980 Series (high 7.8)
- [CVE-2021-37201](https://insights.sbomify.com/CVE-2021-37201/): Cross-site request forgery in SINEC NMS (high 8.8)
- [CVE-2021-37200](https://insights.sbomify.com/CVE-2021-37200/): Path traversal in SINEC NMS (high 7.7)
- [CVE-2021-3720](https://insights.sbomify.com/CVE-2021-3720/): Information disclosure in Legion Phone Pro (L79031) (medium 5.5)
- [CVE-2021-37199](https://insights.sbomify.com/CVE-2021-37199/): Memory corruption in SINUMERIK 808D (high 7.5)
- [CVE-2021-37198](https://insights.sbomify.com/CVE-2021-37198/): Cross-site request forgery in COMOS V10.2 (high 8.8)
- [CVE-2021-37197](https://insights.sbomify.com/CVE-2021-37197/): SQL injection in COMOS V10.2 (high 8.8)
- [CVE-2021-37196](https://insights.sbomify.com/CVE-2021-37196/): Path traversal in COMOS V10.2 (medium 6.5)
- [CVE-2021-37195](https://insights.sbomify.com/CVE-2021-37195/): Cross-site scripting in COMOS V10.2 (medium 6.1)
- [CVE-2021-37194](https://insights.sbomify.com/CVE-2021-37194/): File upload in COMOS V10.2 (high 7.5)
- [CVE-2021-37193](https://insights.sbomify.com/CVE-2021-37193/): Business logic in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2021-37192](https://insights.sbomify.com/CVE-2021-37192/): Information disclosure in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2021-37191](https://insights.sbomify.com/CVE-2021-37191/): Information disclosure in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2021-37190](https://insights.sbomify.com/CVE-2021-37190/): Information disclosure in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2021-3719](https://insights.sbomify.com/CVE-2021-3719/): Code injection in ThinkCentre and ThinkStation BIOS (medium 6.7)
- [CVE-2021-37189](https://insights.sbomify.com/CVE-2021-37189/): Information disclosure in digi:transport wr11 firmware (high 7.5)
- [CVE-2021-37188](https://insights.sbomify.com/CVE-2021-37188/): Security feature bypass in digi:transport dr64 firmware (high 8.8)
- [CVE-2021-37187](https://insights.sbomify.com/CVE-2021-37187/): Information disclosure in digi:transport dr64 firmware (medium 6.5)
- [CVE-2021-37186](https://insights.sbomify.com/CVE-2021-37186/): Weak cryptography in LOGO! CMR2020 (medium 5.4)
- [CVE-2021-37185](https://insights.sbomify.com/CVE-2021-37185/): Denial of service in SIMATIC Drive Controller family (high 7.5)
- [CVE-2021-37184](https://insights.sbomify.com/CVE-2021-37184/): Auth bypass in Industrial Edge Management (critical 9.8)
- [CVE-2021-37183](https://insights.sbomify.com/CVE-2021-37183/): Denial of service in SINEMA Remote Connect Server (medium 6.5)
- [CVE-2021-37182](https://insights.sbomify.com/CVE-2021-37182/): Denial of service in SCALANCE XM408-4C (high 7.5)
- [CVE-2021-37181](https://insights.sbomify.com/CVE-2021-37181/): Deserialization in Cerberus DMS V4.0 (critical 10.0)
- [CVE-2021-37180](https://insights.sbomify.com/CVE-2021-37180/): Memory corruption in Solid Edge SE2021 (high 7.8)
- [CVE-2021-3718](https://insights.sbomify.com/CVE-2021-3718/): Denial of service in ThinkPad BIOS (medium 4.3)
- [CVE-2021-37179](https://insights.sbomify.com/CVE-2021-37179/): Use after free in Solid Edge SE2021 (high 7.8)
- [CVE-2021-37178](https://insights.sbomify.com/CVE-2021-37178/): XML external entity in Solid Edge SE2021 (medium 5.5)
- [CVE-2021-37177](https://insights.sbomify.com/CVE-2021-37177/): Other in SINEMA Remote Connect Server (medium 6.5)
- [CVE-2021-37176](https://insights.sbomify.com/CVE-2021-37176/): Memory corruption in Simcenter Femap V2020.2 (low 3.3)
- [CVE-2021-37175](https://insights.sbomify.com/CVE-2021-37175/): Information disclosure in RUGGEDCOM ROX MX5000 (medium 5.3)
- [CVE-2021-37174](https://insights.sbomify.com/CVE-2021-37174/): Privilege escalation in RUGGEDCOM ROX MX5000 (high 8.8)
- [CVE-2021-37173](https://insights.sbomify.com/CVE-2021-37173/): Privilege escalation in RUGGEDCOM ROX MX5000 (high 8.8)
- [CVE-2021-37172](https://insights.sbomify.com/CVE-2021-37172/): Auth bypass in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (high 7.5)
- [CVE-2021-3717](https://insights.sbomify.com/CVE-2021-3717/): Wildfly-Core user account mismanagement (high 7.8)
- [CVE-2021-37167](https://insights.sbomify.com/CVE-2021-37167/): Privilege escalation in swisslog-healthcare:hmi-3 control panel firmware (critical 9.8)
- [CVE-2021-37166](https://insights.sbomify.com/CVE-2021-37166/): Memory corruption in swisslog-healthcare:hmi-3 control panel firmware (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/122/