# Vulnerabilities published in 2021


- [CVE-2021-36974](https://insights.sbomify.com/CVE-2021-36974/): Windows SMB Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36973](https://insights.sbomify.com/CVE-2021-36973/): Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36972](https://insights.sbomify.com/CVE-2021-36972/): Windows SMB Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-36970](https://insights.sbomify.com/CVE-2021-36970/): Windows Print Spooler Spoofing Vulnerability (high 8.8)
- [CVE-2021-3697](https://insights.sbomify.com/CVE-2021-3697/): Memory corruption in grub2 (high 7.0)
- [CVE-2021-36969](https://insights.sbomify.com/CVE-2021-36969/): Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-36968](https://insights.sbomify.com/CVE-2021-36968/): Windows DNS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36967](https://insights.sbomify.com/CVE-2021-36967/): Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2021-36966](https://insights.sbomify.com/CVE-2021-36966/): Windows Subsystem for Linux Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36965](https://insights.sbomify.com/CVE-2021-36965/): Windows WLAN AutoConfig Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-36964](https://insights.sbomify.com/CVE-2021-36964/): Windows Event Tracing Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36963](https://insights.sbomify.com/CVE-2021-36963/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36962](https://insights.sbomify.com/CVE-2021-36962/): Windows Installer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-36961](https://insights.sbomify.com/CVE-2021-36961/): Windows Installer Denial of Service Vulnerability (medium 5.5)
- [CVE-2021-36960](https://insights.sbomify.com/CVE-2021-36960/): Windows SMB Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-3696](https://insights.sbomify.com/CVE-2021-3696/): Memory corruption in grub2 (medium 4.5)
- [CVE-2021-36959](https://insights.sbomify.com/CVE-2021-36959/): Windows Authenticode Spoofing Vulnerability (medium 5.5)
- [CVE-2021-36958](https://insights.sbomify.com/CVE-2021-36958/): Windows Print Spooler Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-36957](https://insights.sbomify.com/CVE-2021-36957/): Windows Desktop Bridge Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36956](https://insights.sbomify.com/CVE-2021-36956/): Azure Sphere Information Disclosure Vulnerability (medium 4.4)
- [CVE-2021-36955](https://insights.sbomify.com/CVE-2021-36955/): Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2021-36954](https://insights.sbomify.com/CVE-2021-36954/): Windows Bind Filter Driver Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2021-36953](https://insights.sbomify.com/CVE-2021-36953/): Windows TCP/IP Denial of Service Vulnerability (high 7.5)
- [CVE-2021-36952](https://insights.sbomify.com/CVE-2021-36952/): Visual Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-36950](https://insights.sbomify.com/CVE-2021-36950/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2021-3695](https://insights.sbomify.com/CVE-2021-3695/): Memory corruption in grub2 (medium 4.5)
- [CVE-2021-36949](https://insights.sbomify.com/CVE-2021-36949/): Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability (high 7.1)
- [CVE-2021-36948](https://insights.sbomify.com/CVE-2021-36948/): Microsoft Windows Update Medic Service Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2021-36947](https://insights.sbomify.com/CVE-2021-36947/): Windows Print Spooler Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-36946](https://insights.sbomify.com/CVE-2021-36946/): Microsoft Dynamics Business Central Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2021-36945](https://insights.sbomify.com/CVE-2021-36945/): Windows 10 Update Assistant Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2021-36943](https://insights.sbomify.com/CVE-2021-36943/): Azure CycleCloud Elevation of Privilege Vulnerability (medium 4.0)
- [CVE-2021-36942](https://insights.sbomify.com/CVE-2021-36942/): Microsoft Windows Local Security Authority (LSA) Spoofing (high 7.5, exploited in the wild)
- [CVE-2021-36941](https://insights.sbomify.com/CVE-2021-36941/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-36940](https://insights.sbomify.com/CVE-2021-36940/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.6)
- [CVE-2021-3694](https://insights.sbomify.com/CVE-2021-3694/): Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb (high 8.2)
- [CVE-2021-36938](https://insights.sbomify.com/CVE-2021-36938/): Windows Cryptographic Primitives Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-36937](https://insights.sbomify.com/CVE-2021-36937/): Windows Media MPEG-4 Video Decoder Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-36936](https://insights.sbomify.com/CVE-2021-36936/): Windows Print Spooler Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-36934](https://insights.sbomify.com/CVE-2021-36934/): Microsoft Windows SAM Local Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2021-36933](https://insights.sbomify.com/CVE-2021-36933/): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-36932](https://insights.sbomify.com/CVE-2021-36932/): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-36931](https://insights.sbomify.com/CVE-2021-36931/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 4.4)
- [CVE-2021-36930](https://insights.sbomify.com/CVE-2021-36930/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 5.3)
- [CVE-2021-3693](https://insights.sbomify.com/CVE-2021-3693/): Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb (high 8.8)
- [CVE-2021-36929](https://insights.sbomify.com/CVE-2021-36929/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 6.3)
- [CVE-2021-36928](https://insights.sbomify.com/CVE-2021-36928/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 6.0)
- [CVE-2021-36927](https://insights.sbomify.com/CVE-2021-36927/): Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-36926](https://insights.sbomify.com/CVE-2021-36926/): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-36925](https://insights.sbomify.com/CVE-2021-36925/): Privilege escalation in realtek:rtsupx usb utility driver (high 7.8)
- [CVE-2021-36924](https://insights.sbomify.com/CVE-2021-36924/): Race condition in realtek:rtsupx usb utility driver (high 7.8)
- [CVE-2021-36923](https://insights.sbomify.com/CVE-2021-36923/): Privilege escalation in realtek:rtsupx usb utility driver (high 7.8)
- [CVE-2021-36922](https://insights.sbomify.com/CVE-2021-36922/): Privilege escalation in realtek:rtsupx usb utility driver (high 7.8)
- [CVE-2021-36921](https://insights.sbomify.com/CVE-2021-36921/): Auth bypass in monitorapp:application insight manager (high 8.8)
- [CVE-2021-36920](https://insights.sbomify.com/CVE-2021-36920/): WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-3692](https://insights.sbomify.com/CVE-2021-3692/): Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 (high 8.1)
- [CVE-2021-36919](https://insights.sbomify.com/CVE-2021-36919/): WordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities (medium 6.1)
- [CVE-2021-36917](https://insights.sbomify.com/CVE-2021-36917/): WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability (medium 6.5)
- [CVE-2021-36916](https://insights.sbomify.com/CVE-2021-36916/): WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability (high 8.6)
- [CVE-2021-36915](https://insights.sbomify.com/CVE-2021-36915/): WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.2)
- [CVE-2021-36914](https://insights.sbomify.com/CVE-2021-36914/): Cross-site request forgery in CalderaWP License Manager (WordPress plugin) (medium 6.1)
- [CVE-2021-36913](https://insights.sbomify.com/CVE-2021-36913/): Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability (high 7.5)
- [CVE-2021-36912](https://insights.sbomify.com/CVE-2021-36912/): Andrea Pernici News Sitemap for Google plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2021-36911](https://insights.sbomify.com/CVE-2021-36911/): WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36910](https://insights.sbomify.com/CVE-2021-36910/): WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2021-36909](https://insights.sbomify.com/CVE-2021-36909/): WordPress WP Reset PRO Premium plugin <= 5.98 - Authenticated Database Reset vulnerability (high 8.8)
- [CVE-2021-36908](https://insights.sbomify.com/CVE-2021-36908/): WordPress WP Reset PRO Premium Plugin <= 5.98 - Cross-Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2021-36906](https://insights.sbomify.com/CVE-2021-36906/): WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities (low 2.7)
- [CVE-2021-36905](https://insights.sbomify.com/CVE-2021-36905/): WordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (medium 5.4)
- [CVE-2021-36901](https://insights.sbomify.com/CVE-2021-36901/): WordPress Age Gate plugin <= 2.17.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2021-3690](https://insights.sbomify.com/CVE-2021-3690/): Undertow vulnerable to memory exhaustion due to buffer leak (high 7.5)
- [CVE-2021-36899](https://insights.sbomify.com/CVE-2021-36899/): Cross-site scripting in Asset CleanUp: Page Speed Booster (WordPress plugin) (medium 4.8)
- [CVE-2021-36898](https://insights.sbomify.com/CVE-2021-36898/): WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability (high 7.5)
- [CVE-2021-36896](https://insights.sbomify.com/CVE-2021-36896/): WordPress Pricing Table plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36895](https://insights.sbomify.com/CVE-2021-36895/): WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload (medium 4.7)
- [CVE-2021-36893](https://insights.sbomify.com/CVE-2021-36893/): WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36891](https://insights.sbomify.com/CVE-2021-36891/): Cross-site request forgery in Photo Gallery by Supsystic (WordPress plugin) (medium 5.4)
- [CVE-2021-36890](https://insights.sbomify.com/CVE-2021-36890/): WordPress Social Share Buttons by Supsystic plugin <= 2.2.2 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2021-3689](https://insights.sbomify.com/CVE-2021-3689/): Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 (high 8.1)
- [CVE-2021-36889](https://insights.sbomify.com/CVE-2021-36889/): Cross-site scripting in tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) (low 3.4)
- [CVE-2021-36888](https://insights.sbomify.com/CVE-2021-36888/): Missing authorization in Image Hover Effects Ultimate (WordPress plugin) (critical 9.8)
- [CVE-2021-36887](https://insights.sbomify.com/CVE-2021-36887/): Cross-site request forgery in tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) (medium 6.1)
- [CVE-2021-36886](https://insights.sbomify.com/CVE-2021-36886/): WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2021-36885](https://insights.sbomify.com/CVE-2021-36885/): Cross-site scripting in Contact Form 7 Database Addon – CFDB7 (WordPress plugin) (medium 6.1)
- [CVE-2021-36884](https://insights.sbomify.com/CVE-2021-36884/): WordPress Backup Migration plugin <= 1.1.5 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36880](https://insights.sbomify.com/CVE-2021-36880/): WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability (high 8.6)
- [CVE-2021-3688](https://insights.sbomify.com/CVE-2021-3688/): Path traversal in Red Hat JBCS HTTP Server (medium 4.8)
- [CVE-2021-36879](https://insights.sbomify.com/CVE-2021-36879/): WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2021-36878](https://insights.sbomify.com/CVE-2021-36878/): WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2021-36877](https://insights.sbomify.com/CVE-2021-36877/): WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2021-36876](https://insights.sbomify.com/CVE-2021-36876/): WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2021-36875](https://insights.sbomify.com/CVE-2021-36875/): WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2021-36874](https://insights.sbomify.com/CVE-2021-36874/): WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability (high 7.1)
- [CVE-2021-36873](https://insights.sbomify.com/CVE-2021-36873/): WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (medium 5.5)
- [CVE-2021-36872](https://insights.sbomify.com/CVE-2021-36872/): WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (medium 5.5)
- [CVE-2021-36871](https://insights.sbomify.com/CVE-2021-36871/): WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities (medium 5.5)
- [CVE-2021-36870](https://insights.sbomify.com/CVE-2021-36870/): WordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilities (medium 5.5)
- [CVE-2021-36869](https://insights.sbomify.com/CVE-2021-36869/): WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36867](https://insights.sbomify.com/CVE-2021-36867/): Cross-site scripting in Psychological tests & quizzes (WordPress plugin) (medium 5.4)
- [CVE-2021-36866](https://insights.sbomify.com/CVE-2021-36866/): WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/125/