# Vulnerabilities published in 2021


- [CVE-2021-35543](https://insights.sbomify.com/CVE-2021-35543/): Other in PeopleSoft Enterprise CC Common Application Objects (high 8.1)
- [CVE-2021-35542](https://insights.sbomify.com/CVE-2021-35542/): Denial of service in VM VirtualBox (medium 4.4)
- [CVE-2021-35541](https://insights.sbomify.com/CVE-2021-35541/): Other in PeopleSoft Enterprise SCM Purchasing (medium 5.4)
- [CVE-2021-35540](https://insights.sbomify.com/CVE-2021-35540/): Denial of service in VM VirtualBox (medium 5.5)
- [CVE-2021-3554](https://insights.sbomify.com/CVE-2021-3554/): Improper Access Control vulnerability in the patchesUpdate API (critical 9.0)
- [CVE-2021-35539](https://insights.sbomify.com/CVE-2021-35539/): Denial of service in Solaris Operating System (medium 6.5)
- [CVE-2021-35538](https://insights.sbomify.com/CVE-2021-35538/): Other in VM VirtualBox (high 7.8)
- [CVE-2021-35537](https://insights.sbomify.com/CVE-2021-35537/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-35536](https://insights.sbomify.com/CVE-2021-35536/): Other in Deal Management (high 8.1)
- [CVE-2021-35535](https://insights.sbomify.com/CVE-2021-35535/): Insufficient Security Control Vulnerability (high 8.1)
- [CVE-2021-35534](https://insights.sbomify.com/CVE-2021-35534/): Insufficient Security Control Vulnerability (high 7.2)
- [CVE-2021-35533](https://insights.sbomify.com/CVE-2021-35533/): Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series (high 7.5)
- [CVE-2021-35532](https://insights.sbomify.com/CVE-2021-35532/): Firmware upload verification bypass in TXpert Hub CoreTec 4 (medium 6.7)
- [CVE-2021-35531](https://insights.sbomify.com/CVE-2021-35531/): Remote Code Execution in TXpert Hub CoreTec 4 (medium 6.7)
- [CVE-2021-35530](https://insights.sbomify.com/CVE-2021-35530/): User authentication bypass in TXpert Hub CoreTec 4 (medium 6.0)
- [CVE-2021-3553](https://insights.sbomify.com/CVE-2021-3553/): Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825) (medium 5.3)
- [CVE-2021-35529](https://insights.sbomify.com/CVE-2021-35529/): Password in Memory Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB) (high 7.7)
- [CVE-2021-35528](https://insights.sbomify.com/CVE-2021-35528/): Auth bypass in Counterparty Settlement and Billing (CSB) (high 7.2)
- [CVE-2021-35527](https://insights.sbomify.com/CVE-2021-35527/): Password Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application (high 7.5)
- [CVE-2021-35526](https://insights.sbomify.com/CVE-2021-35526/): Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product (medium 6.3)
- [CVE-2021-35525](https://insights.sbomify.com/CVE-2021-35525/): Denial of service in postsrsd project:postsrsd (medium 5.3)
- [CVE-2021-35523](https://insights.sbomify.com/CVE-2021-35523/): Privilege escalation in securepoint:openvpn-client (high 7.8)
- [CVE-2021-35522](https://insights.sbomify.com/CVE-2021-35522/): Memory corruption in idemia:ma vp md firmware (critical 9.8)
- [CVE-2021-35521](https://insights.sbomify.com/CVE-2021-35521/): Path traversal in idemia:morphowave compact md firmware (medium 5.9)
- [CVE-2021-35520](https://insights.sbomify.com/CVE-2021-35520/): Memory corruption in idemia:morphowave compact mdpi-m firmware (medium 6.2)
- [CVE-2021-3552](https://insights.sbomify.com/CVE-2021-3552/): Insufficient validation on regular expression in EPPUpdateService config file (VA-9825) (medium 5.3)
- [CVE-2021-35517](https://insights.sbomify.com/CVE-2021-35517/): Apache Commons Compress 1.1 to 1.20 denial of service vulnerability (high 7.5)
- [CVE-2021-35516](https://insights.sbomify.com/CVE-2021-35516/): Apache Commons Compress 1.6 to 1.20 denial of service vulnerability (high 7.5)
- [CVE-2021-35515](https://insights.sbomify.com/CVE-2021-35515/): Apache Commons Compress 1.6 to 1.20 denial of service vulnerability (high 7.5)
- [CVE-2021-35514](https://insights.sbomify.com/CVE-2021-35514/): Code injection in Narou (critical 9.8)
- [CVE-2021-35513](https://insights.sbomify.com/CVE-2021-35513/): Cross-site Scripting in Mermaid (medium 6.1)
- [CVE-2021-35512](https://insights.sbomify.com/CVE-2021-35512/): Server-side request forgery in zohocorp:manageengine applications manager (medium 6.5)
- [CVE-2021-3551](https://insights.sbomify.com/CVE-2021-3551/): Information disclosure in pki-server (high 7.8)
- [CVE-2021-35508](https://insights.sbomify.com/CVE-2021-35508/): Privilege escalation in terarecon:aquariusnet (high 8.8)
- [CVE-2021-35506](https://insights.sbomify.com/CVE-2021-35506/): Cross-site scripting in afian:filerun (medium 6.1)
- [CVE-2021-35505](https://insights.sbomify.com/CVE-2021-35505/): Code injection in afian:filerun (high 7.2)
- [CVE-2021-35504](https://insights.sbomify.com/CVE-2021-35504/): Command injection in afian:filerun (high 7.2)
- [CVE-2021-35503](https://insights.sbomify.com/CVE-2021-35503/): Cross-site scripting in afian:filerun (medium 6.1)
- [CVE-2021-35502](https://insights.sbomify.com/CVE-2021-35502/): Cross-site scripting in misp-project:misp (critical 9.8)
- [CVE-2021-35501](https://insights.sbomify.com/CVE-2021-35501/): Cross-site scripting in pandorafms:pandora fms (medium 5.4)
- [CVE-2021-35500](https://insights.sbomify.com/CVE-2021-35500/): TIBCO Data Virtualization Arbitrary File Download vulnerability (medium 6.3)
- [CVE-2021-3550](https://insights.sbomify.com/CVE-2021-3550/): Privilege escalation in PCManager (high 7.8)
- [CVE-2021-35499](https://insights.sbomify.com/CVE-2021-35499/): TIBCO Nimbus Stored Cross-site Scripting (XSS) vulnerabilities (high 8.0)
- [CVE-2021-35498](https://insights.sbomify.com/CVE-2021-35498/): TIBCO EBX Insecure Login Mechanism (critical 9.8)
- [CVE-2021-35497](https://insights.sbomify.com/CVE-2021-35497/): TIBCO FTL unvalidated SAN in client certificates (high 7.5)
- [CVE-2021-35496](https://insights.sbomify.com/CVE-2021-35496/): TIBCO JasperReports XML Eternal Entity (XXE) vulnerability (high 7.5)
- [CVE-2021-35495](https://insights.sbomify.com/CVE-2021-35495/): TIBCO JasperReports FTP Password exposed (critical 9.0)
- [CVE-2021-35494](https://insights.sbomify.com/CVE-2021-35494/): TIBCO JasperReports unauthorized access to temporary object (medium 5.7)
- [CVE-2021-35493](https://insights.sbomify.com/CVE-2021-35493/): TIBCO WebFOCUS Cross Site Scripting vulnerabilities (critical 9.0)
- [CVE-2021-35492](https://insights.sbomify.com/CVE-2021-35492/): Denial of service in wowza:streaming engine (medium 6.5)
- [CVE-2021-35491](https://insights.sbomify.com/CVE-2021-35491/): Cross-site request forgery in wowza:streaming engine (high 8.1)
- [CVE-2021-35490](https://insights.sbomify.com/CVE-2021-35490/): Cross-site scripting in thruk:thruk (medium 5.4)
- [CVE-2021-3549](https://insights.sbomify.com/CVE-2021-3549/): Memory corruption in binutils (high 7.1)
- [CVE-2021-35489](https://insights.sbomify.com/CVE-2021-35489/): Cross-site scripting in thruk:thruk (medium 6.1)
- [CVE-2021-35488](https://insights.sbomify.com/CVE-2021-35488/): Cross-site scripting in thruk:thruk (medium 6.1)
- [CVE-2021-35487](https://insights.sbomify.com/CVE-2021-35487/): SQL injection in nokia:broadcast message center (medium 6.5)
- [CVE-2021-35486](https://insights.sbomify.com/CVE-2021-35486/): Cross-site request forgery in nokia:impact mobile (high 8.1)
- [CVE-2021-35485](https://insights.sbomify.com/CVE-2021-35485/): File upload in nokia:impact (high 8.0)
- [CVE-2021-35484](https://insights.sbomify.com/CVE-2021-35484/): SQL injection in nokia:impact (high 8.2)
- [CVE-2021-35483](https://insights.sbomify.com/CVE-2021-35483/): Cross-site scripting in nokia:impact (medium 4.1)
- [CVE-2021-35482](https://insights.sbomify.com/CVE-2021-35482/): Other in barco:mirrorop windows sender (high 7.8)
- [CVE-2021-3548](https://insights.sbomify.com/CVE-2021-3548/): Memory corruption in dmg2img (high 7.1)
- [CVE-2021-35479](https://insights.sbomify.com/CVE-2021-35479/): Cross-site scripting in nagios:log server (medium 5.4)
- [CVE-2021-35478](https://insights.sbomify.com/CVE-2021-35478/): Cross-site scripting in nagios:log server (medium 5.4)
- [CVE-2021-35477](https://insights.sbomify.com/CVE-2021-35477/): Information disclosure in debian:debian linux (medium 5.5)
- [CVE-2021-35475](https://insights.sbomify.com/CVE-2021-35475/): Cross-site scripting in sas:environment manager (medium 5.4)
- [CVE-2021-35474](https://insights.sbomify.com/CVE-2021-35474/): Dynamic stack buffer overflow in cachekey plugin (critical 9.8)
- [CVE-2021-35473](https://insights.sbomify.com/CVE-2021-35473/): An issue was discovered in LemonLDAP::NG before 2.0.12. (critical 9.1)
- [CVE-2021-35472](https://insights.sbomify.com/CVE-2021-35472/): Auth bypass in debian:debian linux (high 8.8)
- [CVE-2021-3547](https://insights.sbomify.com/CVE-2021-3547/): Security feature bypass in OpenVPN 3 Core Library (high 7.4)
- [CVE-2021-35469](https://insights.sbomify.com/CVE-2021-35469/): Privilege escalation in lexmark:printer software g2 (high 7.8)
- [CVE-2021-35465](https://insights.sbomify.com/CVE-2021-35465/): Security feature bypass in arm:china star-mc1 firmware (low 3.4)
- [CVE-2021-35464](https://insights.sbomify.com/CVE-2021-35464/): ForgeRock Access Management (AM) Core Server Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-35463](https://insights.sbomify.com/CVE-2021-35463/): Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module (medium 6.1)
- [CVE-2021-3546](https://insights.sbomify.com/CVE-2021-3546/): Memory corruption in QEMU (high 8.2)
- [CVE-2021-35458](https://insights.sbomify.com/CVE-2021-35458/): SQL injection in online pet shop we app project:online pet shop we app (critical 9.8)
- [CVE-2021-35456](https://insights.sbomify.com/CVE-2021-35456/): SQL injection in online pet shop web application project:online pet shop web application (critical 9.8)
- [CVE-2021-35452](https://insights.sbomify.com/CVE-2021-35452/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2021-35451](https://insights.sbomify.com/CVE-2021-35451/): Cross-site scripting in teradici:pcoip management console (medium 6.1)
- [CVE-2021-35450](https://insights.sbomify.com/CVE-2021-35450/): Code injection in entando:admin console (high 7.2)
- [CVE-2021-3545](https://insights.sbomify.com/CVE-2021-3545/): Information disclosure in QEMU (medium 6.5)
- [CVE-2021-35449](https://insights.sbomify.com/CVE-2021-35449/): Privilege escalation in lexmark:g2 driver (high 7.8)
- [CVE-2021-35448](https://insights.sbomify.com/CVE-2021-35448/): Privilege escalation in remotemouse:emote interactive studio (high 7.8)
- [CVE-2021-35440](https://insights.sbomify.com/CVE-2021-35440/): Smashing Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2021-3544](https://insights.sbomify.com/CVE-2021-3544/): Denial of service in QEMU (medium 6.5)
- [CVE-2021-35438](https://insights.sbomify.com/CVE-2021-35438/): Cross-site scripting in phpipam:phpipam (medium 6.1)
- [CVE-2021-35437](https://insights.sbomify.com/CVE-2021-35437/): SQL injection in lmxcms:lmxcms (critical 9.8)
- [CVE-2021-3543](https://insights.sbomify.com/CVE-2021-3543/): Null dereference in kernel (medium 6.7)
- [CVE-2021-35415](https://insights.sbomify.com/CVE-2021-35415/): Cross-site scripting in chamilo:chamilo lms (medium 4.8)
- [CVE-2021-35414](https://insights.sbomify.com/CVE-2021-35414/): SQL injection in chamilo:chamilo lms (critical 9.8)
- [CVE-2021-35413](https://insights.sbomify.com/CVE-2021-35413/): Missing authorization in chamilo:chamilo lms (high 8.8)
- [CVE-2021-3541](https://insights.sbomify.com/CVE-2021-3541/): Denial of service in libxml2 (medium 6.5)
- [CVE-2021-35402](https://insights.sbomify.com/CVE-2021-35402/): Command injection in PRC2402M (critical 10.0)
- [CVE-2021-3540](https://insights.sbomify.com/CVE-2021-3540/): Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection (medium 6.5)
- [CVE-2021-35397](https://insights.sbomify.com/CVE-2021-35397/): Path traversal in drogon:drogon (high 7.5)
- [CVE-2021-35395](https://insights.sbomify.com/CVE-2021-35395/): Realtek AP-Router SDK Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2021-35394](https://insights.sbomify.com/CVE-2021-35394/): Realtek Jungle SDK Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-35393](https://insights.sbomify.com/CVE-2021-35393/): Memory corruption in realtek:rtl819x jungle software development kit (critical 9.8)
- [CVE-2021-35392](https://insights.sbomify.com/CVE-2021-35392/): Memory corruption in realtek:rtl819x jungle software development kit (high 7.5)
- [CVE-2021-35391](https://insights.sbomify.com/CVE-2021-35391/): Server-side request forgery in deskpro:deskpro (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/134/