# Vulnerabilities published in 2021


- [CVE-2021-36865](https://insights.sbomify.com/CVE-2021-36865/): WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability (low 3.8)
- [CVE-2021-36864](https://insights.sbomify.com/CVE-2021-36864/): WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2021-36863](https://insights.sbomify.com/CVE-2021-36863/): WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2021-36861](https://insights.sbomify.com/CVE-2021-36861/): WordPress Rich Reviews by Starfish plugin <= 1.9.14 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2021-36858](https://insights.sbomify.com/CVE-2021-36858/): WordPress Testimonials plugin <= 2.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36857](https://insights.sbomify.com/CVE-2021-36857/): WordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36855](https://insights.sbomify.com/CVE-2021-36855/): Cross-site request forgery in Booking Ultra Pro (WordPress plugin) (medium 6.1)
- [CVE-2021-36854](https://insights.sbomify.com/CVE-2021-36854/): WordPress Booking Ultra Pro plugin <= 1.1.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2021-36852](https://insights.sbomify.com/CVE-2021-36852/): WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2021-36851](https://insights.sbomify.com/CVE-2021-36851/): WordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability (medium 4.1)
- [CVE-2021-36850](https://insights.sbomify.com/CVE-2021-36850/): WordPress Media File Renamer – Auto & Manual Rename plugin <= 5.1.9 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2021-36849](https://insights.sbomify.com/CVE-2021-36849/): WordPress Social Media Share Buttons plugin <= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2021-36848](https://insights.sbomify.com/CVE-2021-36848/): WordPress Social Media Feather plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2021-36847](https://insights.sbomify.com/CVE-2021-36847/): WordPress Webba Booking plugin <= 4.2.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36846](https://insights.sbomify.com/CVE-2021-36846/): WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36845](https://insights.sbomify.com/CVE-2021-36845/): Cross-site scripting in YITH Maintenance Mode (WordPress plugin) (medium 6.9)
- [CVE-2021-36844](https://insights.sbomify.com/CVE-2021-36844/): WordPress WP Subscribe plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2021-36843](https://insights.sbomify.com/CVE-2021-36843/): WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36841](https://insights.sbomify.com/CVE-2021-36841/): YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability. (medium 6.9)
- [CVE-2021-3684](https://insights.sbomify.com/CVE-2021-3684/): OpenShift Assisted Installer leaks image pull secrets as plaintext in installation logs (medium 5.5)
- [CVE-2021-36839](https://insights.sbomify.com/CVE-2021-36839/): Cross-site scripting in Social Media Follow Buttons Bar (WordPress plugin) (medium 4.8)
- [CVE-2021-36833](https://insights.sbomify.com/CVE-2021-36833/): WordPress MC4WP plugin <= 4.8.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36832](https://insights.sbomify.com/CVE-2021-36832/): WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36830](https://insights.sbomify.com/CVE-2021-36830/): WordPress Comment Guestbook plugin <= 0.8.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-3683](https://insights.sbomify.com/CVE-2021-3683/): Cross-Site Request Forgery (CSRF) in star7th/showdoc (medium 5.4)
- [CVE-2021-36829](https://insights.sbomify.com/CVE-2021-36829/): Cross-site scripting in Launcher: Coming Soon & Maintenance Mode (WordPress plugin) (medium 4.8)
- [CVE-2021-36828](https://insights.sbomify.com/CVE-2021-36828/): WordPress WP Maintenance plugin <= 6.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36827](https://insights.sbomify.com/CVE-2021-36827/): WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-36826](https://insights.sbomify.com/CVE-2021-36826/): WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2021-36823](https://insights.sbomify.com/CVE-2021-36823/): WordPress Absolutely Glamorous Custom Admin plugin <= 6.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 6.6)
- [CVE-2021-36821](https://insights.sbomify.com/CVE-2021-36821/): WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2021-3682](https://insights.sbomify.com/CVE-2021-3682/): Memory corruption in QEMU (high 8.5)
- [CVE-2021-3681](https://insights.sbomify.com/CVE-2021-3681/): Information disclosure in ansible (medium 5.5)
- [CVE-2021-36809](https://insights.sbomify.com/CVE-2021-36809/): Other in SSL VPN client (medium 6.1)
- [CVE-2021-36808](https://insights.sbomify.com/CVE-2021-36808/): Race condition in Sophos Secure Workspace for Android (medium 5.9)
- [CVE-2021-36807](https://insights.sbomify.com/CVE-2021-36807/): SQL injection in SG UTM (high 8.8)
- [CVE-2021-36806](https://insights.sbomify.com/CVE-2021-36806/): Cross-site scripting in Sophos Email Appliance (medium 4.7)
- [CVE-2021-36805](https://insights.sbomify.com/CVE-2021-36805/): Akaunting Invoice Footer Persistent XSS (medium 5.2)
- [CVE-2021-36804](https://insights.sbomify.com/CVE-2021-36804/): Akaunting Password Reset Relay (medium 5.4)
- [CVE-2021-36803](https://insights.sbomify.com/CVE-2021-36803/): Akaunting Avatar Persistent XSS (medium 6.3)
- [CVE-2021-36802](https://insights.sbomify.com/CVE-2021-36802/): Akaunting DoS via User-Controlled 'locale' Variable (medium 6.5)
- [CVE-2021-36801](https://insights.sbomify.com/CVE-2021-36801/): Akaunting Authentication Bypass in Company Selection (high 8.1)
- [CVE-2021-36800](https://insights.sbomify.com/CVE-2021-36800/): Akaunting OS Command Injection in 'Money.php' (high 8.7)
- [CVE-2021-3680](https://insights.sbomify.com/CVE-2021-3680/): Missing Cryptographic Step in star7th/showdoc (medium 5.3)
- [CVE-2021-36799](https://insights.sbomify.com/CVE-2021-36799/): Hardcoded credentials in knx:engineering tool software 5 (high 8.8)
- [CVE-2021-36798](https://insights.sbomify.com/CVE-2021-36798/): Denial of service in helpsystems:cobalt strike (high 7.5)
- [CVE-2021-36797](https://insights.sbomify.com/CVE-2021-36797/): Misconfiguration in victronenergy:venus os (medium 6.8)
- [CVE-2021-36795](https://insights.sbomify.com/CVE-2021-36795/): Privilege escalation in cohesity:linux agent (high 7.8)
- [CVE-2021-36794](https://insights.sbomify.com/CVE-2021-36794/): Security feature bypass in siren:investigate (critical 9.8)
- [CVE-2021-36793](https://insights.sbomify.com/CVE-2021-36793/): CSRF token exposure in TYPO3 extension (high 7.5)
- [CVE-2021-36792](https://insights.sbomify.com/CVE-2021-36792/): Missing authorization in dated news project:dated news (high 7.2)
- [CVE-2021-36791](https://insights.sbomify.com/CVE-2021-36791/): Information disclosure in dated news project:dated news (medium 5.3)
- [CVE-2021-36790](https://insights.sbomify.com/CVE-2021-36790/): Cross-site scripting in dated news project:dated news (medium 6.1)
- [CVE-2021-3679](https://insights.sbomify.com/CVE-2021-3679/): Denial of service in kernel (medium 5.5)
- [CVE-2021-36789](https://insights.sbomify.com/CVE-2021-36789/): SQL injection in dated news project:dated news (critical 9.8)
- [CVE-2021-36788](https://insights.sbomify.com/CVE-2021-36788/): Cross-site Scripting in the yoast_seo TYPO3 extension (medium 5.4)
- [CVE-2021-36787](https://insights.sbomify.com/CVE-2021-36787/): Cross-site Scripting in the femanager TYPO3 extension (medium 5.4)
- [CVE-2021-36786](https://insights.sbomify.com/CVE-2021-36786/): Sensitive Data Exposure in miniorange_saml (high 7.5)
- [CVE-2021-36785](https://insights.sbomify.com/CVE-2021-36785/): Cross-site Scripting in TYPO3 extension (medium 5.4)
- [CVE-2021-36784](https://insights.sbomify.com/CVE-2021-36784/): Privilege escalation for users with create/update permissions in Global Roles (high 7.2)
- [CVE-2021-36783](https://insights.sbomify.com/CVE-2021-36783/): Rancher: Failure to properly sanitize credentials in cluster template answers (critical 9.9)
- [CVE-2021-36782](https://insights.sbomify.com/CVE-2021-36782/): Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object (critical 9.9)
- [CVE-2021-36781](https://insights.sbomify.com/CVE-2021-36781/): parsec: dangerous 777 permissions for /run/parsec (medium 5.9)
- [CVE-2021-36780](https://insights.sbomify.com/CVE-2021-36780/): Unauthorized data access from replicas through vulnerable instance manager pods (high 8.1)
- [CVE-2021-3678](https://insights.sbomify.com/CVE-2021-3678/): Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc (high 7.5)
- [CVE-2021-36779](https://insights.sbomify.com/CVE-2021-36779/): Host operations allowed in privileged Longhorn managed pods (critical 9.6)
- [CVE-2021-36778](https://insights.sbomify.com/CVE-2021-36778/): Exposure of repository credentials to external third-party sources (high 7.3)
- [CVE-2021-36777](https://insights.sbomify.com/CVE-2021-36777/): login-proxy sends password to attacker-provided domain (high 8.1)
- [CVE-2021-36776](https://insights.sbomify.com/CVE-2021-36776/): Steve API proxy impersonation (high 8.8)
- [CVE-2021-36775](https://insights.sbomify.com/CVE-2021-36775/): Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings (high 8.8)
- [CVE-2021-36774](https://insights.sbomify.com/CVE-2021-36774/): Mysql JDBC Connector Deserialize RCE (medium 6.5)
- [CVE-2021-36773](https://insights.sbomify.com/CVE-2021-36773/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-36772](https://insights.sbomify.com/CVE-2021-36772/): Cross-site scripting in zohocorp:manageengine admanager plus (medium 6.1)
- [CVE-2021-36771](https://insights.sbomify.com/CVE-2021-36771/): Cross-site scripting in zohocorp:manageengine admanager plus (medium 6.1)
- [CVE-2021-36770](https://insights.sbomify.com/CVE-2021-36770/): Privilege escalation in fedoraproject:fedora (high 7.8)
- [CVE-2021-3677](https://insights.sbomify.com/CVE-2021-3677/): Information disclosure in postgresql (medium 6.5)
- [CVE-2021-36769](https://insights.sbomify.com/CVE-2021-36769/): Other in telegram:telegram (medium 5.3)
- [CVE-2021-36767](https://insights.sbomify.com/CVE-2021-36767/): Weak cryptography in digi:6350-sr firmware (critical 9.8)
- [CVE-2021-36766](https://insights.sbomify.com/CVE-2021-36766/): Deserialization in concretecms:concrete cms (high 7.2)
- [CVE-2021-36765](https://insights.sbomify.com/CVE-2021-36765/): Null dereference in codesys:ethernetip (high 7.5)
- [CVE-2021-36764](https://insights.sbomify.com/CVE-2021-36764/): Null dereference in codesys:gateway (high 7.5)
- [CVE-2021-36763](https://insights.sbomify.com/CVE-2021-36763/): Information disclosure in codesys:control (high 7.5)
- [CVE-2021-36762](https://insights.sbomify.com/CVE-2021-36762/): Memory corruption in hcc-embedded:nichestack (high 7.5)
- [CVE-2021-36761](https://insights.sbomify.com/CVE-2021-36761/): Server-side request forgery in qlik:qlik sense (medium 5.3)
- [CVE-2021-36760](https://insights.sbomify.com/CVE-2021-36760/): Cross-site scripting in wso2:api manager (medium 6.1)
- [CVE-2021-36758](https://insights.sbomify.com/CVE-2021-36758/): Privilege escalation in 1password:connect (medium 5.4)
- [CVE-2021-36756](https://insights.sbomify.com/CVE-2021-36756/): Security feature bypass in northern.tech:cfengine (medium 6.5)
- [CVE-2021-36755](https://insights.sbomify.com/CVE-2021-36755/): Cross-site scripting in cgm-remote-monitor project:cgm-remote-monitor (medium 6.1)
- [CVE-2021-36754](https://insights.sbomify.com/CVE-2021-36754/): Memory corruption in powerdns:authoritative server (high 7.5)
- [CVE-2021-36753](https://insights.sbomify.com/CVE-2021-36753/): Uncontrolled Search Path Element in sharkdp/bat (high 7.8)
- [CVE-2021-36751](https://insights.sbomify.com/CVE-2021-36751/): Weak cryptography in encsecurity:datavault (medium 4.2)
- [CVE-2021-36750](https://insights.sbomify.com/CVE-2021-36750/): Weak cryptography in sandisk:secureaccess (high 8.1)
- [CVE-2021-3675](https://insights.sbomify.com/CVE-2021-3675/): synaTEE.signed.dll Out-Of-Bounds Heap Write (medium 5.5)
- [CVE-2021-36749](https://insights.sbomify.com/CVE-2021-36749/): Druid ingestion system Authenticated users can read data from other sources than intended (medium 6.5)
- [CVE-2021-36748](https://insights.sbomify.com/CVE-2021-36748/): SQL injection in prestahome:blog (high 7.5)
- [CVE-2021-36747](https://insights.sbomify.com/CVE-2021-36747/): Cross-site scripting in blackboard:blackboard learn (medium 5.4)
- [CVE-2021-36746](https://insights.sbomify.com/CVE-2021-36746/): Cross-site scripting in blackboard:blackboard learn (medium 5.4)
- [CVE-2021-36745](https://insights.sbomify.com/CVE-2021-36745/): Auth bypass in Trend Micro ServerProtect for EMC Celerra (critical 9.8)
- [CVE-2021-36744](https://insights.sbomify.com/CVE-2021-36744/): Privilege escalation in Trend Micro Security (Consumer) (high 7.8)
- [CVE-2021-36742](https://insights.sbomify.com/CVE-2021-36742/): Trend Micro Multiple Products Improper Input Validation (high 7.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/126/