# Vulnerabilities published in 2021


- [CVE-2021-3539](https://insights.sbomify.com/CVE-2021-3539/): EspoCRM Avatar Persistent XSS (medium 6.3)
- [CVE-2021-35388](https://insights.sbomify.com/CVE-2021-35388/): Cross-site scripting in phpgurukul:hospital management system (medium 5.4)
- [CVE-2021-35387](https://insights.sbomify.com/CVE-2021-35387/): SQL injection in phpgurukul:hospital management system (high 8.8)
- [CVE-2021-35380](https://insights.sbomify.com/CVE-2021-35380/): Path traversal in solari:termtalk server (high 7.5)
- [CVE-2021-3538](https://insights.sbomify.com/CVE-2021-3538/): go.uuid has Predictable UUID Identifiers (critical 9.8)
- [CVE-2021-35377](https://insights.sbomify.com/CVE-2021-35377/): Cross-site scripting in vicidial:vicidial (medium 6.1)
- [CVE-2021-35370](https://insights.sbomify.com/CVE-2021-35370/): Code injection in txjia:imcat (critical 9.8)
- [CVE-2021-3537](https://insights.sbomify.com/CVE-2021-3537/): Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing (medium 5.9)
- [CVE-2021-35369](https://insights.sbomify.com/CVE-2021-35369/): Path traversal in txjia:imcat (medium 6.5)
- [CVE-2021-35368](https://insights.sbomify.com/CVE-2021-35368/): Security feature bypass in debian:debian linux (critical 9.8)
- [CVE-2021-35361](https://insights.sbomify.com/CVE-2021-35361/): Cross-site scripting in dotcms:dotcms (medium 4.8)
- [CVE-2021-35360](https://insights.sbomify.com/CVE-2021-35360/): Cross-site scripting in dotcms:dotcms (medium 4.8)
- [CVE-2021-3536](https://insights.sbomify.com/CVE-2021-3536/): Cross-site Scripting in Wildfly (medium 4.8)
- [CVE-2021-35358](https://insights.sbomify.com/CVE-2021-35358/): Cross-site scripting in dotcms:dotcms (medium 4.8)
- [CVE-2021-3535](https://insights.sbomify.com/CVE-2021-3535/): Cross-site scripting in Rapid7 Nexpose (medium 4.3)
- [CVE-2021-35346](https://insights.sbomify.com/CVE-2021-35346/): Memory corruption in tsmuxer project:tsmuxer (critical 9.8)
- [CVE-2021-35344](https://insights.sbomify.com/CVE-2021-35344/): Memory corruption in tsmuxer project:tsmuxer (critical 9.8)
- [CVE-2021-35343](https://insights.sbomify.com/CVE-2021-35343/): Cross-site request forgery in seeddms:seeddms (medium 4.3)
- [CVE-2021-35342](https://insights.sbomify.com/CVE-2021-35342/): Auth bypass in northern.tech:useradm (high 7.5)
- [CVE-2021-35337](https://insights.sbomify.com/CVE-2021-35337/): Missing authorization in phone shop sales management system project:phone shop sales management system (medium 4.3)
- [CVE-2021-35336](https://insights.sbomify.com/CVE-2021-35336/): Auth bypass in tieline:ip audtio gateway firmware (critical 9.8)
- [CVE-2021-35331](https://insights.sbomify.com/CVE-2021-35331/): Memory corruption in tcl:tcl (high 7.8)
- [CVE-2021-35327](https://insights.sbomify.com/CVE-2021-35327/): Missing authorization in totolink:a720r firmware (critical 9.8)
- [CVE-2021-35326](https://insights.sbomify.com/CVE-2021-35326/): Information disclosure in totolink:a720r firmware (high 7.5)
- [CVE-2021-35325](https://insights.sbomify.com/CVE-2021-35325/): Memory corruption in totolink:a720r firmware (high 7.5)
- [CVE-2021-35324](https://insights.sbomify.com/CVE-2021-35324/): Auth bypass in totolink:a720r firmware (critical 9.8)
- [CVE-2021-35323](https://insights.sbomify.com/CVE-2021-35323/): Cross-site scripting in bludit:bludit (medium 6.1)
- [CVE-2021-35312](https://insights.sbomify.com/CVE-2021-35312/): Misconfiguration in gestionaleamica:amica prodigy (high 7.8)
- [CVE-2021-3531](https://insights.sbomify.com/CVE-2021-3531/): Denial of service in ceph (medium 5.3)
- [CVE-2021-35309](https://insights.sbomify.com/CVE-2021-35309/): Privilege escalation in samsung:syncthru web service (high 7.5)
- [CVE-2021-35307](https://insights.sbomify.com/CVE-2021-35307/): Null dereference in axiosys:bento4 (medium 6.5)
- [CVE-2021-35306](https://insights.sbomify.com/CVE-2021-35306/): Null dereference in axiosys:bento4 (medium 6.5)
- [CVE-2021-35303](https://insights.sbomify.com/CVE-2021-35303/): Cross-site scripting in zammad:zammad (medium 6.1)
- [CVE-2021-35302](https://insights.sbomify.com/CVE-2021-35302/): Missing authorization in zammad:zammad (medium 5.3)
- [CVE-2021-35301](https://insights.sbomify.com/CVE-2021-35301/): Missing authorization in zammad:zammad (medium 5.3)
- [CVE-2021-35300](https://insights.sbomify.com/CVE-2021-35300/): Other in zammad:zammad (medium 4.3)
- [CVE-2021-3530](https://insights.sbomify.com/CVE-2021-3530/): Denial of service in binutils (high 7.5)
- [CVE-2021-35299](https://insights.sbomify.com/CVE-2021-35299/): Information disclosure in zammad:zammad (high 7.5)
- [CVE-2021-35298](https://insights.sbomify.com/CVE-2021-35298/): Cross-site scripting in zammad:zammad (medium 6.1)
- [CVE-2021-35297](https://insights.sbomify.com/CVE-2021-35297/): Memory corruption in scalabium:dbase viewer (high 7.8)
- [CVE-2021-35296](https://insights.sbomify.com/CVE-2021-35296/): Auth bypass in ptcl:hg150-ub firmware (critical 9.8)
- [CVE-2021-35290](https://insights.sbomify.com/CVE-2021-35290/): File upload in balero cms project:balero cms (high 7.2)
- [CVE-2021-3529](https://insights.sbomify.com/CVE-2021-3529/): Cross-site scripting in noobaa-core (high 7.1)
- [CVE-2021-35284](https://insights.sbomify.com/CVE-2021-35284/): SQL injection in cms-php project:cms-php (critical 9.8)
- [CVE-2021-35283](https://insights.sbomify.com/CVE-2021-35283/): SQL injection in atoms183 cms project:atoms183 cms (critical 9.8)
- [CVE-2021-3528](https://insights.sbomify.com/CVE-2021-3528/): Information disclosure in NooBaa (high 8.8)
- [CVE-2021-3527](https://insights.sbomify.com/CVE-2021-3527/): Denial of service in QEMU (medium 5.5)
- [CVE-2021-35269](https://insights.sbomify.com/CVE-2021-35269/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-35268](https://insights.sbomify.com/CVE-2021-35268/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-35267](https://insights.sbomify.com/CVE-2021-35267/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-35266](https://insights.sbomify.com/CVE-2021-35266/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-35265](https://insights.sbomify.com/CVE-2021-35265/): Cross-site scripting in maxsite:maxsite cms (medium 6.1)
- [CVE-2021-35261](https://insights.sbomify.com/CVE-2021-35261/): File upload in bearadmin project:bearadmin (critical 9.8)
- [CVE-2021-35254](https://insights.sbomify.com/CVE-2021-35254/): Authenticated Remote Code Execution in WebHelpDesk 12.7.8 (high 8.2)
- [CVE-2021-35252](https://insights.sbomify.com/CVE-2021-35252/): Common Key Vulnerability in Serv-U FTP Server (high 7.5)
- [CVE-2021-35251](https://insights.sbomify.com/CVE-2021-35251/): Sensitive Data Disclosure Vulnerability (medium 5.3)
- [CVE-2021-35250](https://insights.sbomify.com/CVE-2021-35250/): Directory Transversal Vulnerability in Serv-U 15.3 (high 7.5)
- [CVE-2021-35249](https://insights.sbomify.com/CVE-2021-35249/): Domain Admin Broken Access Control (medium 4.3)
- [CVE-2021-35248](https://insights.sbomify.com/CVE-2021-35248/): Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users (medium 6.8)
- [CVE-2021-35247](https://insights.sbomify.com/CVE-2021-35247/): SolarWinds Serv-U Improper Input Validation (medium 4.3, exploited in the wild)
- [CVE-2021-35246](https://insights.sbomify.com/CVE-2021-35246/): Unprotected Transport of Credentials (HSTS) Vulnerability (medium 5.3)
- [CVE-2021-35245](https://insights.sbomify.com/CVE-2021-35245/): Broken Access Control Vulnerability for SolarWinds Serv-U (high 8.4)
- [CVE-2021-35244](https://insights.sbomify.com/CVE-2021-35244/): Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6 (medium 6.8)
- [CVE-2021-35243](https://insights.sbomify.com/CVE-2021-35243/): HTTP PUT & DELETE Methods Enabled (medium 5.3)
- [CVE-2021-35242](https://insights.sbomify.com/CVE-2021-35242/): A valid CSRF token is present in response to an invalid request (high 8.3)
- [CVE-2021-35240](https://insights.sbomify.com/CVE-2021-35240/): Stored XSS via Help Server settings (medium 6.5)
- [CVE-2021-3524](https://insights.sbomify.com/CVE-2021-3524/): Other in ceph (medium 6.5)
- [CVE-2021-35239](https://insights.sbomify.com/CVE-2021-35239/): Stored XSS in Maps text box hyperlink Vulnerability (high 7.5)
- [CVE-2021-35238](https://insights.sbomify.com/CVE-2021-35238/): Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability (medium 4.8)
- [CVE-2021-35237](https://insights.sbomify.com/CVE-2021-35237/): Clickjacking Vulnerability (medium 5.0)
- [CVE-2021-35236](https://insights.sbomify.com/CVE-2021-35236/): Missing Secure Flag From SSL Cookie (low 3.1)
- [CVE-2021-35235](https://insights.sbomify.com/CVE-2021-35235/): ASP.NET Debug Feature Enabled (medium 5.3)
- [CVE-2021-35234](https://insights.sbomify.com/CVE-2021-35234/): Exposed Dangerous Functions - Privileged Escalation (high 8.0)
- [CVE-2021-35233](https://insights.sbomify.com/CVE-2021-35233/): HTTP TRACK & TRACE Methods Enabled (medium 5.3)
- [CVE-2021-35232](https://insights.sbomify.com/CVE-2021-35232/): Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries (medium 6.8)
- [CVE-2021-35231](https://insights.sbomify.com/CVE-2021-35231/): Unquoted Path (SMB Login) Vulnerability (medium 6.7)
- [CVE-2021-35230](https://insights.sbomify.com/CVE-2021-35230/): Unquoted Path Vulnerability (SMB Login) in Kiwi CatTools (medium 6.7)
- [CVE-2021-3523](https://insights.sbomify.com/CVE-2021-3523/): Security feature bypass in apicast (high 7.5)
- [CVE-2021-35229](https://insights.sbomify.com/CVE-2021-35229/): Cross-Site Scripting Vulnerability using SQL Query (medium 6.8)
- [CVE-2021-35228](https://insights.sbomify.com/CVE-2021-35228/): Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388 (medium 5.5)
- [CVE-2021-35227](https://insights.sbomify.com/CVE-2021-35227/): Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM (medium 4.7)
- [CVE-2021-35226](https://insights.sbomify.com/CVE-2021-35226/): Hashed Credential Exposure Vulnerability (medium 6.5)
- [CVE-2021-35225](https://insights.sbomify.com/CVE-2021-35225/): Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5 (medium 5.0)
- [CVE-2021-35223](https://insights.sbomify.com/CVE-2021-35223/): Execute Command Function Allows Remote Code Execution (RCE)Vulnerability (high 8.5)
- [CVE-2021-35222](https://insights.sbomify.com/CVE-2021-35222/): Resource.aspx Reflected Cross-Site Scripting Vulnerability (high 8.0)
- [CVE-2021-35221](https://insights.sbomify.com/CVE-2021-35221/): ImportAlert Improper Access Control Tampering Vulnerability (medium 6.3)
- [CVE-2021-35220](https://insights.sbomify.com/CVE-2021-35220/): EmailWebPage Command Injection RCE (high 8.1)
- [CVE-2021-3522](https://insights.sbomify.com/CVE-2021-3522/): Memory corruption in GStreamer (medium 5.5)
- [CVE-2021-35219](https://insights.sbomify.com/CVE-2021-35219/): ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability (medium 6.0)
- [CVE-2021-35218](https://insights.sbomify.com/CVE-2021-35218/): Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.9)
- [CVE-2021-35217](https://insights.sbomify.com/CVE-2021-35217/): Insecure Deserialization of untrusted data causing Remote code execution vulnerability. (high 8.9)
- [CVE-2021-35216](https://insights.sbomify.com/CVE-2021-35216/): Deserialization of Untrusted Data in Resource Controls Remote Code Execution (high 8.9)
- [CVE-2021-35215](https://insights.sbomify.com/CVE-2021-35215/): ActionPluginBaseView Deserialization of Untrusted Data RCE (high 8.9)
- [CVE-2021-35214](https://insights.sbomify.com/CVE-2021-35214/): Session Management Vulnerability (medium 4.8)
- [CVE-2021-35213](https://insights.sbomify.com/CVE-2021-35213/): Orion User setting Improper Access Control Privilege Escalation Vulnerability (high 8.9)
- [CVE-2021-35212](https://insights.sbomify.com/CVE-2021-35212/): Blind SQL injection Vulnerability (high 8.9)
- [CVE-2021-35211](https://insights.sbomify.com/CVE-2021-35211/): SolarWinds Serv-U Remote Code Execution (critical 9.0, exploited in the wild)
- [CVE-2021-35210](https://insights.sbomify.com/CVE-2021-35210/): Cross site scripting in the system log (medium 6.1)
- [CVE-2021-3521](https://insights.sbomify.com/CVE-2021-3521/): Security feature bypass in RPM (medium 4.7)
- [CVE-2021-35209](https://insights.sbomify.com/CVE-2021-35209/): Server-side request forgery in zimbra:collaboration (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/135/