# Vulnerabilities published in 2021


- [CVE-2021-36531](https://insights.sbomify.com/CVE-2021-36531/): Memory corruption in miniupnp project:ngiflib (high 8.8)
- [CVE-2021-36530](https://insights.sbomify.com/CVE-2021-36530/): Memory corruption in miniupnp project:ngiflib (high 8.8)
- [CVE-2021-3653](https://insights.sbomify.com/CVE-2021-3653/): Missing authorization in kernel (high 8.8)
- [CVE-2021-36520](https://insights.sbomify.com/CVE-2021-36520/): SQL injection in washington:i-tech trainsmart (high 7.5)
- [CVE-2021-3652](https://insights.sbomify.com/CVE-2021-3652/): Auth bypass in 389-ds-base (medium 6.5)
- [CVE-2021-36513](https://insights.sbomify.com/CVE-2021-36513/): Information disclosure in signalwire:freeswitch (high 7.5)
- [CVE-2021-36512](https://insights.sbomify.com/CVE-2021-36512/): Information disclosure in synchro:bulletin board system (high 7.5)
- [CVE-2021-36503](https://insights.sbomify.com/CVE-2021-36503/): SQL injection in native-php-cms project:native-php-cms (critical 9.8)
- [CVE-2021-36493](https://insights.sbomify.com/CVE-2021-36493/): Memory corruption in xpdfreader:xpdf (high 7.5)
- [CVE-2021-3649](https://insights.sbomify.com/CVE-2021-3649/): Inefficient Regular Expression Complexity in chatwoot/chatwoot (high 7.5)
- [CVE-2021-36489](https://insights.sbomify.com/CVE-2021-36489/): Memory corruption in liballeg:allegro (medium 6.5)
- [CVE-2021-36484](https://insights.sbomify.com/CVE-2021-36484/): SQL injection in jizhicms:jizhicms (critical 9.8)
- [CVE-2021-36483](https://insights.sbomify.com/CVE-2021-36483/): Deserialization in devexpress:devexpress (high 8.8)
- [CVE-2021-36471](https://insights.sbomify.com/CVE-2021-36471/): Path traversal in adminlte.io:adminlte (critical 9.8)
- [CVE-2021-3647](https://insights.sbomify.com/CVE-2021-3647/): Open Redirect in medialize/URI.js (medium 5.3)
- [CVE-2021-36461](https://insights.sbomify.com/CVE-2021-36461/): File upload in microweber:microweber (high 8.8)
- [CVE-2021-36460](https://insights.sbomify.com/CVE-2021-36460/): Auth bypass in veryfitpro project:veryfitpro (high 7.8)
- [CVE-2021-3646](https://insights.sbomify.com/CVE-2021-3646/): Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver (medium 4.9)
- [CVE-2021-36455](https://insights.sbomify.com/CVE-2021-36455/): SQL injection in naviwebs:navigate cms (high 8.8)
- [CVE-2021-36454](https://insights.sbomify.com/CVE-2021-36454/): Cross-site scripting in naviwebs:navigate cms (medium 5.4)
- [CVE-2021-36450](https://insights.sbomify.com/CVE-2021-36450/): Cross-site scripting in verint:workforce optimization (medium 6.1)
- [CVE-2021-3645](https://insights.sbomify.com/CVE-2021-3645/): Prototype Pollution in viking04/merge (medium 6.8)
- [CVE-2021-36444](https://insights.sbomify.com/CVE-2021-36444/): Cross-site request forgery in txjia:imcat (high 8.8)
- [CVE-2021-36443](https://insights.sbomify.com/CVE-2021-36443/): Cross-site request forgery in txjia:imcat (high 8.8)
- [CVE-2021-36440](https://insights.sbomify.com/CVE-2021-36440/): Unrestricted File Upload in ShowDoc v2.9.5 (critical 9.8)
- [CVE-2021-3644](https://insights.sbomify.com/CVE-2021-3644/): wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault (low 3.3)
- [CVE-2021-36438](https://insights.sbomify.com/CVE-2021-36438/): SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php. (medium 6.5)
- [CVE-2021-36436](https://insights.sbomify.com/CVE-2021-36436/): Information disclosure in mobicint:mobicint (medium 5.3)
- [CVE-2021-36434](https://insights.sbomify.com/CVE-2021-36434/): SQL injection in jocms project:jocms (critical 9.1)
- [CVE-2021-36433](https://insights.sbomify.com/CVE-2021-36433/): SQL injection in jocms project:jocms (critical 9.1)
- [CVE-2021-36432](https://insights.sbomify.com/CVE-2021-36432/): SQL injection in jocms project:jocms (high 7.5)
- [CVE-2021-36431](https://insights.sbomify.com/CVE-2021-36431/): SQL injection in jocms project:jocms (critical 9.1)
- [CVE-2021-3643](https://insights.sbomify.com/CVE-2021-3643/): Memory corruption in sox (critical 9.1)
- [CVE-2021-36426](https://insights.sbomify.com/CVE-2021-36426/): File upload in phpwcms:phpwcms (high 8.8)
- [CVE-2021-36425](https://insights.sbomify.com/CVE-2021-36425/): Path traversal in phpwcms:phpwcms (medium 5.4)
- [CVE-2021-36424](https://insights.sbomify.com/CVE-2021-36424/): Code injection in phpwcms:phpwcms (critical 9.8)
- [CVE-2021-3642](https://insights.sbomify.com/CVE-2021-3642/): Observable Discrepancy in Wildfly Elytron (medium 5.3)
- [CVE-2021-36417](https://insights.sbomify.com/CVE-2021-36417/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-36414](https://insights.sbomify.com/CVE-2021-36414/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-36412](https://insights.sbomify.com/CVE-2021-36412/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-36411](https://insights.sbomify.com/CVE-2021-36411/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2021-36410](https://insights.sbomify.com/CVE-2021-36410/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2021-3641](https://insights.sbomify.com/CVE-2021-3641/): Improper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921) (medium 6.1)
- [CVE-2021-36409](https://insights.sbomify.com/CVE-2021-36409/): Denial of service in debian:debian linux (high 7.8)
- [CVE-2021-36408](https://insights.sbomify.com/CVE-2021-36408/): Use after free in debian:debian linux (medium 5.5)
- [CVE-2021-36403](https://insights.sbomify.com/CVE-2021-36403/): Moodle has a Hidden Functionality vulnerability (medium 5.3)
- [CVE-2021-36402](https://insights.sbomify.com/CVE-2021-36402/): Moodle Improper Input Validation vulnerability (medium 5.3)
- [CVE-2021-36401](https://insights.sbomify.com/CVE-2021-36401/): Moodle vulnerable to Stored Cross-site Scripting (medium 4.8)
- [CVE-2021-36400](https://insights.sbomify.com/CVE-2021-36400/): Moodle has Incorrect Default Permissions (medium 5.3)
- [CVE-2021-3640](https://insights.sbomify.com/CVE-2021-3640/): Use after free in kernel (high 7.0)
- [CVE-2021-36399](https://insights.sbomify.com/CVE-2021-36399/): Moodle Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2021-36398](https://insights.sbomify.com/CVE-2021-36398/): Moodle Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2021-36397](https://insights.sbomify.com/CVE-2021-36397/): Moodle has Incorrect Default Permissions (medium 5.3)
- [CVE-2021-36396](https://insights.sbomify.com/CVE-2021-36396/): Moodle vulnerable to Server-Side Request Forgery (high 7.5)
- [CVE-2021-36395](https://insights.sbomify.com/CVE-2021-36395/): Moodle vulnerable to Uncontrolled Resource Consumption (high 7.5)
- [CVE-2021-36394](https://insights.sbomify.com/CVE-2021-36394/): Moodle Session Fixation vulnerability (critical 9.8)
- [CVE-2021-36393](https://insights.sbomify.com/CVE-2021-36393/): Moodle SQL Injection vulnerability (critical 9.8)
- [CVE-2021-36392](https://insights.sbomify.com/CVE-2021-36392/): Moodle SQL Injection vulnerability (critical 9.8)
- [CVE-2021-3639](https://insights.sbomify.com/CVE-2021-3639/): Open redirect in mod auth mellon (medium 6.1)
- [CVE-2021-36389](https://insights.sbomify.com/CVE-2021-36389/): Missing authorization in yellowfinbi:yellowfin (high 7.5)
- [CVE-2021-36388](https://insights.sbomify.com/CVE-2021-36388/): Missing authorization in yellowfinbi:yellowfin (high 7.5)
- [CVE-2021-36387](https://insights.sbomify.com/CVE-2021-36387/): Cross-site scripting in yellowfinbi:yellowfin (medium 5.4)
- [CVE-2021-36386](https://insights.sbomify.com/CVE-2021-36386/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2021-36385](https://insights.sbomify.com/CVE-2021-36385/): SQL injection in cerner:mobile care (critical 9.8)
- [CVE-2021-36383](https://insights.sbomify.com/CVE-2021-36383/): Xen Orchestra Mishandles Authorization (medium 4.3)
- [CVE-2021-36382](https://insights.sbomify.com/CVE-2021-36382/): Information disclosure in devolutions:devolutions server (low 2.6)
- [CVE-2021-36381](https://insights.sbomify.com/CVE-2021-36381/): Cross-site scripting in edifecs:transaction management (medium 5.3)
- [CVE-2021-36380](https://insights.sbomify.com/CVE-2021-36380/): Sunhillo SureLine OS Command Injection Vulnerablity (critical 9.8, exploited in the wild)
- [CVE-2021-3638](https://insights.sbomify.com/CVE-2021-3638/): Memory corruption in QEMU (medium 6.5)
- [CVE-2021-36377](https://insights.sbomify.com/CVE-2021-36377/): Security feature bypass in fedoraproject:fedora (high 7.5)
- [CVE-2021-36376](https://insights.sbomify.com/CVE-2021-36376/): Relative Path Traversal in git-delta (high 7.8)
- [CVE-2021-36374](https://insights.sbomify.com/CVE-2021-36374/): Apache Ant ZIP, and ZIP based, archive denial of service vulerability (medium 5.5)
- [CVE-2021-36373](https://insights.sbomify.com/CVE-2021-36373/): Apache Ant TAR archive denial of service vulnerability (medium 5.5)
- [CVE-2021-36372](https://insights.sbomify.com/CVE-2021-36372/): Original block tokens are persisted and can be retrieved (critical 9.8)
- [CVE-2021-36371](https://insights.sbomify.com/CVE-2021-36371/): Security feature bypass in getambassador:emissary-ingress (low 3.7)
- [CVE-2021-36370](https://insights.sbomify.com/CVE-2021-36370/): Auth bypass in midnight-commander:midnight commander (high 7.5)
- [CVE-2021-3637](https://insights.sbomify.com/CVE-2021-3637/): Allocation of resources without limits or throttling in keycloak-model-infinispan (high 7.5)
- [CVE-2021-36369](https://insights.sbomify.com/CVE-2021-36369/): Auth bypass in debian:debian linux (high 7.5)
- [CVE-2021-36368](https://insights.sbomify.com/CVE-2021-36368/): Auth bypass in debian:debian linux (low 3.7)
- [CVE-2021-36367](https://insights.sbomify.com/CVE-2021-36367/): Security feature bypass in putty:putty (high 8.1)
- [CVE-2021-36366](https://insights.sbomify.com/CVE-2021-36366/): Other in nagios:nagios xi (critical 9.8)
- [CVE-2021-36365](https://insights.sbomify.com/CVE-2021-36365/): Misconfiguration in nagios:nagios xi (critical 9.8)
- [CVE-2021-36364](https://insights.sbomify.com/CVE-2021-36364/): Other in nagios:nagios xi (critical 9.8)
- [CVE-2021-36363](https://insights.sbomify.com/CVE-2021-36363/): Misconfiguration in nagios:nagios xi (critical 9.8)
- [CVE-2021-3636](https://insights.sbomify.com/CVE-2021-3636/): Security feature bypass in openshift (medium 4.6)
- [CVE-2021-36359](https://insights.sbomify.com/CVE-2021-36359/): Code injection in bscw:bscw classic (high 8.8)
- [CVE-2021-36357](https://insights.sbomify.com/CVE-2021-36357/): Security feature bypass in openpowerfoundation:skiboot (critical 9.8)
- [CVE-2021-36356](https://insights.sbomify.com/CVE-2021-36356/): File upload in kramerav:viaware (critical 9.8)
- [CVE-2021-36352](https://insights.sbomify.com/CVE-2021-36352/): Cross-site scripting in care2x:hospital information management (medium 5.4)
- [CVE-2021-36351](https://insights.sbomify.com/CVE-2021-36351/): SQL injection in care2x:hospital information management system (critical 9.8)
- [CVE-2021-36350](https://insights.sbomify.com/CVE-2021-36350/): Auth bypass in PowerScale OneFS (medium 5.9)
- [CVE-2021-3635](https://insights.sbomify.com/CVE-2021-3635/): Memory corruption in kernel (medium 4.4)
- [CVE-2021-36349](https://insights.sbomify.com/CVE-2021-36349/): Server-side request forgery in Data Protection Central (medium 4.3)
- [CVE-2021-36348](https://insights.sbomify.com/CVE-2021-36348/): SQL injection in Integrated Dell Remote Access Controller (iDRAC) (medium 5.9)
- [CVE-2021-36347](https://insights.sbomify.com/CVE-2021-36347/): Memory corruption in Integrated Dell Remote Access Controller (iDRAC) (medium 6.2)
- [CVE-2021-36346](https://insights.sbomify.com/CVE-2021-36346/): Auth bypass in Integrated Dell Remote Access Controller (iDRAC) (medium 5.3)
- [CVE-2021-36343](https://insights.sbomify.com/CVE-2021-36343/): Memory corruption in CPG BIOS (high 7.5)
- [CVE-2021-36342](https://insights.sbomify.com/CVE-2021-36342/): Memory corruption in CPG BIOS (high 7.5)
- [CVE-2021-36341](https://insights.sbomify.com/CVE-2021-36341/): Information disclosure in Dell Wyse Device Agent (medium 5.5)
- [CVE-2021-36340](https://insights.sbomify.com/CVE-2021-36340/): Information disclosure in Secure Connect Gateway (SCG) 5.0 Application (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/128/