# Vulnerabilities published in 2021


- [CVE-2021-36741](https://insights.sbomify.com/CVE-2021-36741/): Trend Micro Multiple Products Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2021-36740](https://insights.sbomify.com/CVE-2021-36740/): Other in debian:debian linux (medium 6.5)
- [CVE-2021-3674](https://insights.sbomify.com/CVE-2021-3674/): Memory corruption in rizin (high 7.8)
- [CVE-2021-36739](https://insights.sbomify.com/CVE-2021-36739/): XSS vulnerability in the MVCBean JSP portlet maven archetype (medium 6.1)
- [CVE-2021-36738](https://insights.sbomify.com/CVE-2021-36738/): XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet (medium 6.1)
- [CVE-2021-36737](https://insights.sbomify.com/CVE-2021-36737/): XSS in V3 Demo Portlet (medium 6.1)
- [CVE-2021-3673](https://insights.sbomify.com/CVE-2021-3673/): Denial of service in radare2 (high 7.5)
- [CVE-2021-36724](https://insights.sbomify.com/CVE-2021-36724/): ForeScout - SecureConnector Local Service DoS (medium 6.1)
- [CVE-2021-36723](https://insights.sbomify.com/CVE-2021-36723/): Emuse - eServices / eNvoice Exposure Of Private Personal Information (medium 6.1)
- [CVE-2021-36722](https://insights.sbomify.com/CVE-2021-36722/): Emuse - eServices / eNvoice SQL injection (high 7.1)
- [CVE-2021-36721](https://insights.sbomify.com/CVE-2021-36721/): Sysaid - Sysaid API User Enumeration (medium 4.4)
- [CVE-2021-36720](https://insights.sbomify.com/CVE-2021-36720/): Cybonet - PineApp (medium 6.1)
- [CVE-2021-3672](https://insights.sbomify.com/CVE-2021-3672/): Other in c-ares (medium 5.6)
- [CVE-2021-36719](https://insights.sbomify.com/CVE-2021-36719/): Cybonet - PineApp (high 8.8)
- [CVE-2021-36718](https://insights.sbomify.com/CVE-2021-36718/): Hardcoded credentials in Synel eharmonynew, Synel Reports (medium 6.1)
- [CVE-2021-36717](https://insights.sbomify.com/CVE-2021-36717/): Synerion TimeNet version 9.21 - Directory Traversal (medium 5.4)
- [CVE-2021-36716](https://insights.sbomify.com/CVE-2021-36716/): Improper Input Validation in is-email (high 7.5)
- [CVE-2021-36713](https://insights.sbomify.com/CVE-2021-36713/): Cross-site scripting in sprymedia:datatables (medium 6.1)
- [CVE-2021-36712](https://insights.sbomify.com/CVE-2021-36712/): Cross-site scripting in yzmcms:yzmcms (medium 5.4)
- [CVE-2021-36711](https://insights.sbomify.com/CVE-2021-36711/): Octobot mishandles Tentacles upload (critical 9.8)
- [CVE-2021-36710](https://insights.sbomify.com/CVE-2021-36710/): Privilege escalation in toaruos:toaruos (high 8.8)
- [CVE-2021-3671](https://insights.sbomify.com/CVE-2021-3671/): Null dereference in Samba (medium 6.5)
- [CVE-2021-36708](https://insights.sbomify.com/CVE-2021-36708/): Auth bypass in prolink:prc2402m firmware (high 7.5)
- [CVE-2021-36707](https://insights.sbomify.com/CVE-2021-36707/): Command injection in prolink:prc2402m firmware (critical 9.8)
- [CVE-2021-36706](https://insights.sbomify.com/CVE-2021-36706/): Command injection in prolink:prc2402m firmware (critical 9.8)
- [CVE-2021-36705](https://insights.sbomify.com/CVE-2021-36705/): Command injection in prolink:prc2402m firmware (critical 9.8)
- [CVE-2021-36703](https://insights.sbomify.com/CVE-2021-36703/): Cross-site scripting in htmly:htmly (medium 6.1)
- [CVE-2021-36702](https://insights.sbomify.com/CVE-2021-36702/): Cross-site scripting in htmly:htmly (medium 6.1)
- [CVE-2021-36701](https://insights.sbomify.com/CVE-2021-36701/): Path traversal in htmly:htmly (critical 9.1)
- [CVE-2021-3670](https://insights.sbomify.com/CVE-2021-3670/): Denial of service in samba (medium 6.5)
- [CVE-2021-36698](https://insights.sbomify.com/CVE-2021-36698/): Cross-site scripting in artica:pandora fms (medium 5.4)
- [CVE-2021-36697](https://insights.sbomify.com/CVE-2021-36697/): File upload in artica:pandora fms (medium 6.7)
- [CVE-2021-36696](https://insights.sbomify.com/CVE-2021-36696/): Cross-site scripting in deskpro:deskpro (medium 5.4)
- [CVE-2021-36695](https://insights.sbomify.com/CVE-2021-36695/): Cross-site scripting in deskpro:deskpro (medium 5.4)
- [CVE-2021-36692](https://insights.sbomify.com/CVE-2021-36692/): Denial of service in libjxl project:libjxl (medium 6.5)
- [CVE-2021-36691](https://insights.sbomify.com/CVE-2021-36691/): Denial of service in libjxl project:libjxl (high 7.5)
- [CVE-2021-36690](https://insights.sbomify.com/CVE-2021-36690/): Denial of service in apple:iphone os (high 7.5)
- [CVE-2021-3669](https://insights.sbomify.com/CVE-2021-3669/): Denial of service in kernel (medium 5.5)
- [CVE-2021-36689](https://insights.sbomify.com/CVE-2021-36689/): Weak cryptography in samourai-wallet-android project:samourai-wallet-android (medium 5.5)
- [CVE-2021-36686](https://insights.sbomify.com/CVE-2021-36686/): Cross-site Scripting in yapi-vendor (medium 5.4)
- [CVE-2021-3667](https://insights.sbomify.com/CVE-2021-3667/): Race condition in libvirt (medium 6.5)
- [CVE-2021-36668](https://insights.sbomify.com/CVE-2021-36668/): Other in druva:insync client (high 7.8)
- [CVE-2021-36667](https://insights.sbomify.com/CVE-2021-36667/): Command injection in druva:insync client (high 7.8)
- [CVE-2021-36666](https://insights.sbomify.com/CVE-2021-36666/): Privilege escalation in druva:insync client (high 7.8)
- [CVE-2021-36665](https://insights.sbomify.com/CVE-2021-36665/): Privilege escalation in druva:insync client (high 7.8)
- [CVE-2021-3666](https://insights.sbomify.com/CVE-2021-3666/): Prototype Pollution in fiznool/body-parser-xml (high 7.6)
- [CVE-2021-36654](https://insights.sbomify.com/CVE-2021-36654/): Cross-site scripting in cmsuno project:cmsuno (medium 5.4)
- [CVE-2021-36647](https://insights.sbomify.com/CVE-2021-36647/): Weak cryptography in arm:mbed tls (medium 4.7)
- [CVE-2021-36646](https://insights.sbomify.com/CVE-2021-36646/): Cross-site scripting in kodcloud:kodexplorer (medium 6.1)
- [CVE-2021-3664](https://insights.sbomify.com/CVE-2021-3664/): Open Redirect in unshiftio/url-parse (medium 5.3)
- [CVE-2021-36631](https://insights.sbomify.com/CVE-2021-36631/): Privilege escalation in baidu:baidunetdisk (medium 6.7)
- [CVE-2021-36630](https://insights.sbomify.com/CVE-2021-36630/): Denial of service in ruckuswireless:sz-100 firmware (high 7.5)
- [CVE-2021-3663](https://insights.sbomify.com/CVE-2021-3663/): Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii (medium 5.3)
- [CVE-2021-36625](https://insights.sbomify.com/CVE-2021-36625/): SQL Injection in Dolibarr (high 8.8)
- [CVE-2021-36624](https://insights.sbomify.com/CVE-2021-36624/): SQL injection in phone shop sales management system project:phone shop sales management system (critical 9.8)
- [CVE-2021-36623](https://insights.sbomify.com/CVE-2021-36623/): File upload in phone shop sales management system project:phone shop sales management system (critical 9.8)
- [CVE-2021-36622](https://insights.sbomify.com/CVE-2021-36622/): File upload in online covid vaccination scheduler system project:online covid vaccination scheduler system (critical 9.8)
- [CVE-2021-36621](https://insights.sbomify.com/CVE-2021-36621/): SQL injection in online covid vaccination scheduler system project:online covid vaccination scheduler system (high 8.1)
- [CVE-2021-3662](https://insights.sbomify.com/CVE-2021-3662/): Cross-site scripting in HP Enterprise LaserJet MFP; HP Enterprise PageWide MFPs; HP Digital Sender (medium 5.4)
- [CVE-2021-36614](https://insights.sbomify.com/CVE-2021-36614/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2021-36613](https://insights.sbomify.com/CVE-2021-36613/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2021-3661](https://insights.sbomify.com/CVE-2021-3661/): Code injection in HP Workstation BIOS (high 8.4)
- [CVE-2021-36609](https://insights.sbomify.com/CVE-2021-36609/): Cross-site scripting in webtareas project:webtareas (medium 5.4)
- [CVE-2021-36608](https://insights.sbomify.com/CVE-2021-36608/): Cross-site scripting in webtareas project:webtareas (medium 5.4)
- [CVE-2021-36605](https://insights.sbomify.com/CVE-2021-36605/): Cross-site scripting in engineercms project:engineercms (medium 5.4)
- [CVE-2021-36603](https://insights.sbomify.com/CVE-2021-36603/): Cross-site scripting in tasmota project:tasmota (medium 6.1)
- [CVE-2021-36601](https://insights.sbomify.com/CVE-2021-36601/): Cross-site scripting in get-simple:getsimplecms (medium 6.1)
- [CVE-2021-3660](https://insights.sbomify.com/CVE-2021-3660/): Other in cockpit (medium 4.3)
- [CVE-2021-3659](https://insights.sbomify.com/CVE-2021-3659/): Null dereference in Kernel (medium 5.5)
- [CVE-2021-36584](https://insights.sbomify.com/CVE-2021-36584/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-36582](https://insights.sbomify.com/CVE-2021-36582/): File upload in kooboo:kooboo cms (critical 9.8)
- [CVE-2021-36581](https://insights.sbomify.com/CVE-2021-36581/): File upload in kooboo:kooboo cms (critical 9.8)
- [CVE-2021-36580](https://insights.sbomify.com/CVE-2021-36580/): Open redirect in icewarp:icewarp server (medium 6.1)
- [CVE-2021-3658](https://insights.sbomify.com/CVE-2021-3658/): Security feature bypass in bluez (medium 6.5)
- [CVE-2021-36573](https://insights.sbomify.com/CVE-2021-36573/): FeehiCMS Unrestricted Upload vulnerability (medium 5.4)
- [CVE-2021-36572](https://insights.sbomify.com/CVE-2021-36572/): FeehiCMS Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2021-36570](https://insights.sbomify.com/CVE-2021-36570/): Cross-site request forgery in thedaylightstudio:fuel cms (high 8.8)
- [CVE-2021-3657](https://insights.sbomify.com/CVE-2021-3657/): Memory corruption in isync (critical 9.8)
- [CVE-2021-36569](https://insights.sbomify.com/CVE-2021-36569/): Cross-site request forgery in thedaylightstudio:fuel cms (high 8.8)
- [CVE-2021-36568](https://insights.sbomify.com/CVE-2021-36568/): Moodle Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2021-36567](https://insights.sbomify.com/CVE-2021-36567/): Deserialization of Untrusted Data in topthink/framework (critical 9.8)
- [CVE-2021-36564](https://insights.sbomify.com/CVE-2021-36564/): Deserialization of Untrusted Data in topthink/framework (critical 9.8)
- [CVE-2021-36563](https://insights.sbomify.com/CVE-2021-36563/): Cross-site scripting in checkmk:checkmk (medium 5.4)
- [CVE-2021-36560](https://insights.sbomify.com/CVE-2021-36560/): Auth bypass in phone shop sales management system project:phone shop sales management system (critical 9.8)
- [CVE-2021-3656](https://insights.sbomify.com/CVE-2021-3656/): Missing authorization in KVM (high 8.8)
- [CVE-2021-36551](https://insights.sbomify.com/CVE-2021-36551/): Cross-site scripting in tiki:tikiwiki cms\/groupware (medium 5.4)
- [CVE-2021-36550](https://insights.sbomify.com/CVE-2021-36550/): Cross-site scripting in tiki:tikiwiki cms\/groupware (medium 5.4)
- [CVE-2021-3655](https://insights.sbomify.com/CVE-2021-3655/): Information disclosure in kernel (low 3.3)
- [CVE-2021-36548](https://insights.sbomify.com/CVE-2021-36548/): File upload in monstra:monstra (critical 9.8)
- [CVE-2021-36547](https://insights.sbomify.com/CVE-2021-36547/): File upload in mara cms project:mara cms (critical 9.8)
- [CVE-2021-36546](https://insights.sbomify.com/CVE-2021-36546/): Information disclosure in kitesky:kitecms (high 7.5)
- [CVE-2021-36545](https://insights.sbomify.com/CVE-2021-36545/): Cross-site scripting in tpcms project:tpcms (medium 5.4)
- [CVE-2021-36544](https://insights.sbomify.com/CVE-2021-36544/): Information disclosure in tpcms project:tpcms (high 7.5)
- [CVE-2021-36543](https://insights.sbomify.com/CVE-2021-36543/): Cross-site request forgery in seeddms:seeddms (medium 4.3)
- [CVE-2021-36542](https://insights.sbomify.com/CVE-2021-36542/): Cross-site request forgery in seeddms:seeddms (medium 4.3)
- [CVE-2021-3654](https://insights.sbomify.com/CVE-2021-3654/): Open Redirect in CPython that affects users of OpenStack Nova (medium 6.1)
- [CVE-2021-36539](https://insights.sbomify.com/CVE-2021-36539/): Missing authorization in instructure:canvas learning management service (medium 6.5)
- [CVE-2021-36538](https://insights.sbomify.com/CVE-2021-36538/): Cross-site scripting in gurock:testrail (medium 5.4)
- [CVE-2021-36535](https://insights.sbomify.com/CVE-2021-36535/): Memory corruption in cesanta:mjs (medium 5.5)
- [CVE-2021-36532](https://insights.sbomify.com/CVE-2021-36532/): Race condition in portfoliocms project:portfoliocms (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/127/