# Vulnerabilities published in 2021


- [CVE-2021-3464](https://insights.sbomify.com/CVE-2021-3464/): Privilege escalation in PCManager (high 7.8)
- [CVE-2021-34639](https://insights.sbomify.com/CVE-2021-34639/): WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload (high 7.5)
- [CVE-2021-34638](https://insights.sbomify.com/CVE-2021-34638/): WordPress Download Manager <= 3.1.24 Authenticated Directory Traversal (medium 6.5)
- [CVE-2021-34637](https://insights.sbomify.com/CVE-2021-34637/): Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-34636](https://insights.sbomify.com/CVE-2021-34636/): Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-34635](https://insights.sbomify.com/CVE-2021-34635/): Poll Maker <= 3.2.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-34634](https://insights.sbomify.com/CVE-2021-34634/): Nifty Newsletters <= 4.0.23 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-34633](https://insights.sbomify.com/CVE-2021-34633/): Youtube Feeder <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-34632](https://insights.sbomify.com/CVE-2021-34632/): SEO Backlinks <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-34631](https://insights.sbomify.com/CVE-2021-34631/): NewsPlugin <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-34630](https://insights.sbomify.com/CVE-2021-34630/): Reflected XSS in GTranslate Pro and GTranslate Enterprise < 2.8.65 (medium 5.0)
- [CVE-2021-3463](https://insights.sbomify.com/CVE-2021-3463/): Null dereference in Power Management Driver for Windows 10 (medium 4.2)
- [CVE-2021-34629](https://insights.sbomify.com/CVE-2021-34629/): SendGrid <= 1.11.8 – Authorization Bypass (medium 4.3)
- [CVE-2021-34628](https://insights.sbomify.com/CVE-2021-34628/): Admin Custom Login <= 3.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-34627](https://insights.sbomify.com/CVE-2021-34627/): WP Upload Restriction <= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole function (medium 4.3)
- [CVE-2021-34626](https://insights.sbomify.com/CVE-2021-34626/): WP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType function (medium 4.3)
- [CVE-2021-34625](https://insights.sbomify.com/CVE-2021-34625/): WP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site Scripting (medium 6.4)
- [CVE-2021-34624](https://insights.sbomify.com/CVE-2021-34624/): ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component (critical 9.8)
- [CVE-2021-34623](https://insights.sbomify.com/CVE-2021-34623/): ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component (critical 9.8)
- [CVE-2021-34622](https://insights.sbomify.com/CVE-2021-34622/): ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation (critical 9.8)
- [CVE-2021-34621](https://insights.sbomify.com/CVE-2021-34621/): ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2021-34620](https://insights.sbomify.com/CVE-2021-34620/): CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation (high 8.8)
- [CVE-2021-3462](https://insights.sbomify.com/CVE-2021-3462/): Privilege escalation in Power Management Driver for Windows 10 (medium 5.5)
- [CVE-2021-34619](https://insights.sbomify.com/CVE-2021-34619/): Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin (high 8.8)
- [CVE-2021-34618](https://insights.sbomify.com/CVE-2021-34618/): Denial of service in Aruba Instant Access Points (medium 6.5)
- [CVE-2021-34617](https://insights.sbomify.com/CVE-2021-34617/): Cross-site scripting in Aruba Instant Access Points (medium 6.1)
- [CVE-2021-34616](https://insights.sbomify.com/CVE-2021-34616/): Command injection in Aruba ClearPass Policy Manager (medium 6.3)
- [CVE-2021-34615](https://insights.sbomify.com/CVE-2021-34615/): Command injection in Aruba ClearPass Policy Manager (medium 6.3)
- [CVE-2021-34614](https://insights.sbomify.com/CVE-2021-34614/): Command injection in Aruba ClearPass Policy Manager (medium 6.3)
- [CVE-2021-34613](https://insights.sbomify.com/CVE-2021-34613/): Command injection in Aruba ClearPass Policy Manager (medium 6.3)
- [CVE-2021-34612](https://insights.sbomify.com/CVE-2021-34612/): Command injection in Aruba ClearPass Policy Manager (medium 6.3)
- [CVE-2021-34611](https://insights.sbomify.com/CVE-2021-34611/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-34610](https://insights.sbomify.com/CVE-2021-34610/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-3461](https://insights.sbomify.com/CVE-2021-3461/): Keycloak insufficient session expiration (high 7.1)
- [CVE-2021-34609](https://insights.sbomify.com/CVE-2021-34609/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2021-34606](https://insights.sbomify.com/CVE-2021-34606/): XINJE XD/E Series PLC Program Tool DLL Hijacking (high 7.3)
- [CVE-2021-34605](https://insights.sbomify.com/CVE-2021-34605/): Xinje XD/E Series PLC Program Tool Zip Slip (high 7.3)
- [CVE-2021-34602](https://insights.sbomify.com/CVE-2021-34602/): Bender Charge Controller: Long URL could lead to webserver crash (high 8.8)
- [CVE-2021-34601](https://insights.sbomify.com/CVE-2021-34601/): Bender Charge Controller: Hardcoded Credentials in Charge Controller (critical 9.8)
- [CVE-2021-34600](https://insights.sbomify.com/CVE-2021-34600/): Telenot complex: Insecure AES Key Generation (medium 5.5)
- [CVE-2021-3460](https://insights.sbomify.com/CVE-2021-3460/): Security feature bypass in MH702x (high 8.1)
- [CVE-2021-34599](https://insights.sbomify.com/CVE-2021-34599/): Improper Certificate Validation in CODESYS Git (high 7.4)
- [CVE-2021-34598](https://insights.sbomify.com/CVE-2021-34598/): Phoenix Contact: FL MGUARD lack of memory release in remote logging functionality (high 7.5)
- [CVE-2021-34597](https://insights.sbomify.com/CVE-2021-34597/): Phoenix Contact: PC Worx/-Express prone to improper input validation vulnerability (high 7.8)
- [CVE-2021-34596](https://insights.sbomify.com/CVE-2021-34596/): CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service (medium 6.5)
- [CVE-2021-34595](https://insights.sbomify.com/CVE-2021-34595/): CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service (high 8.1)
- [CVE-2021-34594](https://insights.sbomify.com/CVE-2021-34594/): Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server (medium 6.5)
- [CVE-2021-34593](https://insights.sbomify.com/CVE-2021-34593/): CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service (high 7.5)
- [CVE-2021-34592](https://insights.sbomify.com/CVE-2021-34592/): Bender Charge Controller: Command injection via Web interface (high 8.8)
- [CVE-2021-34591](https://insights.sbomify.com/CVE-2021-34591/): Bender Charge Controller: Local privilege Escalation (high 7.8)
- [CVE-2021-34590](https://insights.sbomify.com/CVE-2021-34590/): Bender Charge Controller: Cross-site Scripting (medium 5.4)
- [CVE-2021-3459](https://insights.sbomify.com/CVE-2021-3459/): Command injection in MM1000 MoCA Adapter (medium 6.8)
- [CVE-2021-34589](https://insights.sbomify.com/CVE-2021-34589/): Bender Charge Controller: RFID leak (high 7.5)
- [CVE-2021-34588](https://insights.sbomify.com/CVE-2021-34588/): Bender Charge Controller: Unprotected data export (high 8.6)
- [CVE-2021-34587](https://insights.sbomify.com/CVE-2021-34587/): Bender Charge Controller: Long URL could lead to webserver crash (medium 5.3)
- [CVE-2021-34586](https://insights.sbomify.com/CVE-2021-34586/): CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) (high 7.5)
- [CVE-2021-34585](https://insights.sbomify.com/CVE-2021-34585/): CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS) (high 7.5)
- [CVE-2021-34584](https://insights.sbomify.com/CVE-2021-34584/): CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS) (critical 9.1)
- [CVE-2021-34583](https://insights.sbomify.com/CVE-2021-34583/): CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS) (high 7.5)
- [CVE-2021-34582](https://insights.sbomify.com/CVE-2021-34582/): Phoenix Contact: FL MGUARD XSS through web-based management and REST API (medium 4.8)
- [CVE-2021-34581](https://insights.sbomify.com/CVE-2021-34581/): WAGO: Denial of Service vulnerability inside the OpenSSL implementation (high 7.5)
- [CVE-2021-34580](https://insights.sbomify.com/CVE-2021-34580/): Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0 (high 7.5)
- [CVE-2021-3458](https://insights.sbomify.com/CVE-2021-3458/): Auth bypass in MM1000 MoCA Adapter (medium 6.1)
- [CVE-2021-34579](https://insights.sbomify.com/CVE-2021-34579/): PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management (high 7.5)
- [CVE-2021-34578](https://insights.sbomify.com/CVE-2021-34578/): WAGO: Authentication Vulnerability in Web-Based Management (critical 9.8)
- [CVE-2021-34577](https://insights.sbomify.com/CVE-2021-34577/): Hardcoded credentials in Kaden PICOFLUX AiR (medium 6.5)
- [CVE-2021-34576](https://insights.sbomify.com/CVE-2021-34576/): Observable discrepancy in Kaden PICOFLUX AiR leaks water consumption (medium 4.3)
- [CVE-2021-34575](https://insights.sbomify.com/CVE-2021-34575/): Information Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0 (high 7.5)
- [CVE-2021-34574](https://insights.sbomify.com/CVE-2021-34574/): Password policy evasion in products of MB connect line and Helmholz (medium 4.3)
- [CVE-2021-34573](https://insights.sbomify.com/CVE-2021-34573/): Incorrect calculation in Enbra EWM does not report backflows or no flow events (medium 6.2)
- [CVE-2021-34572](https://insights.sbomify.com/CVE-2021-34572/): Insufficient Verification of Data Authenticity in Enbra EWM (replay attack) (medium 6.5)
- [CVE-2021-34571](https://insights.sbomify.com/CVE-2021-34571/): Hard-coded Credentials in Enbra Wireless M-Bus devices (medium 6.5)
- [CVE-2021-34570](https://insights.sbomify.com/CVE-2021-34570/): Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS (high 7.5)
- [CVE-2021-3457](https://insights.sbomify.com/CVE-2021-3457/): Missing authorization in smart proxy shellhooks (medium 6.1)
- [CVE-2021-34569](https://insights.sbomify.com/CVE-2021-34569/): WAGO I/O-Check Service prone to Out-of-bounds Write (critical 9.8)
- [CVE-2021-34568](https://insights.sbomify.com/CVE-2021-34568/): WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling (high 7.5)
- [CVE-2021-34567](https://insights.sbomify.com/CVE-2021-34567/): WAGO I/O-Check Service prone to Out-of-bounds Read (high 8.2)
- [CVE-2021-34566](https://insights.sbomify.com/CVE-2021-34566/): WAGO I/O-Check Service prone to Memory Overflow (critical 9.1)
- [CVE-2021-34565](https://insights.sbomify.com/CVE-2021-34565/): In WirelessHART-Gateway versions 3.0.7 to 3.0.9 hard-coded credentials have been found (critical 9.8)
- [CVE-2021-34564](https://insights.sbomify.com/CVE-2021-34564/): In WirelessHART-Gateway versions 3.0.9 a vulnerability allows to read and write sensitive data in a cookie (medium 5.5)
- [CVE-2021-34563](https://insights.sbomify.com/CVE-2021-34563/): Misconfiguration in WHA-GW-F2D2-0-AS- Z2-ETH (low 3.3)
- [CVE-2021-34562](https://insights.sbomify.com/CVE-2021-34562/): Cross-site scripting in WHA-GW-F2D2-0-AS- Z2-ETH (medium 5.4)
- [CVE-2021-34561](https://insights.sbomify.com/CVE-2021-34561/): Security feature bypass in WHA-GW-F2D2-0-AS- Z2-ETH (high 7.5)
- [CVE-2021-34560](https://insights.sbomify.com/CVE-2021-34560/): A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information (medium 5.5)
- [CVE-2021-3456](https://insights.sbomify.com/CVE-2021-3456/): Missing authorization in smart proxy salt (high 7.1)
- [CVE-2021-34559](https://insights.sbomify.com/CVE-2021-34559/): Other in WHA-GW-F2D2-0-AS- Z2-ETH (medium 5.4)
- [CVE-2021-34558](https://insights.sbomify.com/CVE-2021-34558/): Denial of service in fedoraproject:fedora (medium 6.5)
- [CVE-2021-34557](https://insights.sbomify.com/CVE-2021-34557/): Memory corruption in fedoraproject:fedora (medium 4.6)
- [CVE-2021-34556](https://insights.sbomify.com/CVE-2021-34556/): Information disclosure in debian:debian linux (medium 5.5)
- [CVE-2021-34555](https://insights.sbomify.com/CVE-2021-34555/): Null dereference in fedoraproject:fedora (high 7.5)
- [CVE-2021-34553](https://insights.sbomify.com/CVE-2021-34553/): Path traversal in sonatype:nexus repository manager (medium 4.3)
- [CVE-2021-34552](https://insights.sbomify.com/CVE-2021-34552/): Buffer Overflow in Pillow (critical 9.8)
- [CVE-2021-34551](https://insights.sbomify.com/CVE-2021-34551/): Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows (high 8.1)
- [CVE-2021-34550](https://insights.sbomify.com/CVE-2021-34550/): Memory corruption in torproject:tor (high 7.5)
- [CVE-2021-3455](https://insights.sbomify.com/CVE-2021-3455/): Disconnecting L2CAP channel right after invalid ATT request leads freeze (medium 4.3)
- [CVE-2021-34549](https://insights.sbomify.com/CVE-2021-34549/): Denial of service in torproject:tor (high 7.5)
- [CVE-2021-34548](https://insights.sbomify.com/CVE-2021-34548/): Auth bypass in torproject:tor (high 7.5)
- [CVE-2021-34547](https://insights.sbomify.com/CVE-2021-34547/): Cross-site request forgery in paessler:prtg network monitor (medium 4.3)
- [CVE-2021-34546](https://insights.sbomify.com/CVE-2021-34546/): Auth bypass in netsetman:netsetman (medium 6.8)
- [CVE-2021-34544](https://insights.sbomify.com/CVE-2021-34544/): Information disclosure in bkw:solar-log 500 firmware (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/141/