# Vulnerabilities published in 2021


- [CVE-2021-3341](https://insights.sbomify.com/CVE-2021-3341/): Path traversal in dh2i:dxenterprise (high 7.5)
- [CVE-2021-33408](https://insights.sbomify.com/CVE-2021-33408/): Path traversal in abinitio:control\>center (medium 6.5)
- [CVE-2021-33403](https://insights.sbomify.com/CVE-2021-33403/): Integer overflow in blocklancertoken project:blocklancertoken (high 7.5)
- [CVE-2021-3340](https://insights.sbomify.com/CVE-2021-3340/): Cross-site scripting in wikindx project:wikindx (medium 6.1)
- [CVE-2021-33396](https://insights.sbomify.com/CVE-2021-33396/): Cross-site request forgery in baijiacms project:baijiacms (medium 6.5)
- [CVE-2021-33394](https://insights.sbomify.com/CVE-2021-33394/): Auth bypass in cubecart:cubecart (medium 5.4)
- [CVE-2021-33393](https://insights.sbomify.com/CVE-2021-33393/): Misconfiguration in ipfire:ipfire (high 8.8)
- [CVE-2021-33391](https://insights.sbomify.com/CVE-2021-33391/): Use after free in htacg:tidy (critical 9.8)
- [CVE-2021-33390](https://insights.sbomify.com/CVE-2021-33390/): Use after free in dpic project:dpic (critical 9.8)
- [CVE-2021-3339](https://insights.sbomify.com/CVE-2021-3339/): Missing authorization in microsoft:modernflow (medium 4.3)
- [CVE-2021-33388](https://insights.sbomify.com/CVE-2021-33388/): Memory corruption in dpic project:dpic (critical 9.8)
- [CVE-2021-33387](https://insights.sbomify.com/CVE-2021-33387/): Cross-site scripting in 1234n:minicms (critical 9.6)
- [CVE-2021-33371](https://insights.sbomify.com/CVE-2021-33371/): Cross-site scripting in kabir-m-alhasan:student management system (medium 5.4)
- [CVE-2021-3337](https://insights.sbomify.com/CVE-2021-3337/): Security feature bypass in hide thread content project:hide thread content (high 7.5)
- [CVE-2021-33367](https://insights.sbomify.com/CVE-2021-33367/): Memory corruption in freeimage project:freeimage (medium 5.5)
- [CVE-2021-33366](https://insights.sbomify.com/CVE-2021-33366/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-33365](https://insights.sbomify.com/CVE-2021-33365/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-33364](https://insights.sbomify.com/CVE-2021-33364/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-33363](https://insights.sbomify.com/CVE-2021-33363/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-33362](https://insights.sbomify.com/CVE-2021-33362/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-33361](https://insights.sbomify.com/CVE-2021-33361/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-33360](https://insights.sbomify.com/CVE-2021-33360/): stoqey/gnuplot is vulnerable to command injection (critical 9.8)
- [CVE-2021-3336](https://insights.sbomify.com/CVE-2021-3336/): Security feature bypass in wolfssl:wolfssl (high 8.1)
- [CVE-2021-33359](https://insights.sbomify.com/CVE-2021-33359/): Path traversal in sensepost:gowitness (high 7.5)
- [CVE-2021-33358](https://insights.sbomify.com/CVE-2021-33358/): Command injection in raspap:raspap (high 8.8)
- [CVE-2021-33357](https://insights.sbomify.com/CVE-2021-33357/): Command injection in raspap:raspap (critical 9.8)
- [CVE-2021-33356](https://insights.sbomify.com/CVE-2021-33356/): Privilege escalation in raspap:raspap (high 8.8)
- [CVE-2021-33354](https://insights.sbomify.com/CVE-2021-33354/): Path traversal in htmly:htmly (high 8.1)
- [CVE-2021-33353](https://insights.sbomify.com/CVE-2021-33353/): Path traversal in wyomind:help desk (critical 9.8)
- [CVE-2021-33352](https://insights.sbomify.com/CVE-2021-33352/): File upload in wyomind:help desk (critical 9.8)
- [CVE-2021-33351](https://insights.sbomify.com/CVE-2021-33351/): Cross-site scripting in wyomind:help desk (critical 9.0)
- [CVE-2021-33348](https://insights.sbomify.com/CVE-2021-33348/): Cross-site scripting in jfinal (medium 6.1)
- [CVE-2021-33347](https://insights.sbomify.com/CVE-2021-33347/): Cross-site scripting in jpress:jpress (medium 5.4)
- [CVE-2021-33346](https://insights.sbomify.com/CVE-2021-33346/): Auth bypass in dlink:dsl-2888a firmware (critical 9.8)
- [CVE-2021-33339](https://insights.sbomify.com/CVE-2021-33339/): Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site Scripting (medium 4.8)
- [CVE-2021-33338](https://insights.sbomify.com/CVE-2021-33338/): Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs (high 7.5)
- [CVE-2021-33337](https://insights.sbomify.com/CVE-2021-33337/): Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library module (medium 6.1)
- [CVE-2021-33336](https://insights.sbomify.com/CVE-2021-33336/): Liferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-33335](https://insights.sbomify.com/CVE-2021-33335/): Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers (high 7.2)
- [CVE-2021-33334](https://insights.sbomify.com/CVE-2021-33334/): Liferay Portal and Liferay DXP Fails to Properly Check User Permissions (medium 4.3)
- [CVE-2021-33333](https://insights.sbomify.com/CVE-2021-33333/): Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions (medium 6.3)
- [CVE-2021-33332](https://insights.sbomify.com/CVE-2021-33332/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-33331](https://insights.sbomify.com/CVE-2021-33331/): Liferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs (medium 6.1)
- [CVE-2021-33330](https://insights.sbomify.com/CVE-2021-33330/): Exposure of Resource to Wrong Sphere in Liferay Portal (medium 4.3)
- [CVE-2021-3333](https://insights.sbomify.com/CVE-2021-3333/): Cross-site scripting in opmantek:open-audit (medium 6.1)
- [CVE-2021-33328](https://insights.sbomify.com/CVE-2021-33328/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page (medium 5.4)
- [CVE-2021-33327](https://insights.sbomify.com/CVE-2021-33327/): Liferay Portal and Liferay DXP does not properly check user permission (medium 4.3)
- [CVE-2021-33326](https://insights.sbomify.com/CVE-2021-33326/): Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module (medium 6.1)
- [CVE-2021-33325](https://insights.sbomify.com/CVE-2021-33325/): Liferay Portal and Liferay DXP Stores User Passwords in Cleartext (medium 4.9)
- [CVE-2021-33324](https://insights.sbomify.com/CVE-2021-33324/): Liferay Portal and Liferay DXP Don't Check Permissions of Pages (medium 4.3)
- [CVE-2021-33323](https://insights.sbomify.com/CVE-2021-33323/): Liferay Portal and Liferay DXP autosaves form data for other users to see (high 7.5)
- [CVE-2021-33322](https://insights.sbomify.com/CVE-2021-33322/): Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use (high 7.5)
- [CVE-2021-33321](https://insights.sbomify.com/CVE-2021-33321/): Liferay Portal and Liferay DXP insecure default configuration (high 7.5)
- [CVE-2021-33320](https://insights.sbomify.com/CVE-2021-33320/): Liferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rate (medium 4.3)
- [CVE-2021-3332](https://insights.sbomify.com/CVE-2021-3332/): Auth bypass in wpserveur:wps hide login (medium 5.3)
- [CVE-2021-33318](https://insights.sbomify.com/CVE-2021-33318/): Improper Input Validation in IpMatcher (critical 9.8)
- [CVE-2021-33317](https://insights.sbomify.com/CVE-2021-33317/): Null dereference in trendnet:teg-30102ws firmware (high 7.5)
- [CVE-2021-33316](https://insights.sbomify.com/CVE-2021-33316/): Integer overflow in trendnet:teg-30102ws firmware (critical 9.8)
- [CVE-2021-33315](https://insights.sbomify.com/CVE-2021-33315/): Integer overflow in trendnet:teg-30102ws firmware (critical 9.8)
- [CVE-2021-3331](https://insights.sbomify.com/CVE-2021-3331/): Code injection in winscp:winscp (critical 9.8)
- [CVE-2021-33304](https://insights.sbomify.com/CVE-2021-33304/): Memory corruption in altran:picotcp (critical 9.8)
- [CVE-2021-3330](https://insights.sbomify.com/CVE-2021-3330/): RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr (high 7.1)
- [CVE-2021-33295](https://insights.sbomify.com/CVE-2021-33295/): Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags (medium 5.4)
- [CVE-2021-33294](https://insights.sbomify.com/CVE-2021-33294/): Denial of service in elfutils project:elfutils (medium 5.5)
- [CVE-2021-33293](https://insights.sbomify.com/CVE-2021-33293/): Memory corruption in debian:debian linux (critical 9.1)
- [CVE-2021-3329](https://insights.sbomify.com/CVE-2021-3329/): DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer (critical 9.6)
- [CVE-2021-33289](https://insights.sbomify.com/CVE-2021-33289/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-33287](https://insights.sbomify.com/CVE-2021-33287/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-33286](https://insights.sbomify.com/CVE-2021-33286/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-33285](https://insights.sbomify.com/CVE-2021-33285/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-3328](https://insights.sbomify.com/CVE-2021-3328/): Memory corruption in aprelium:abyss web server x1 (high 7.5)
- [CVE-2021-33274](https://insights.sbomify.com/CVE-2021-33274/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-33271](https://insights.sbomify.com/CVE-2021-33271/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-33270](https://insights.sbomify.com/CVE-2021-33270/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-3327](https://insights.sbomify.com/CVE-2021-3327/): Cross-site scripting in ovation:dynamic content (medium 5.4)
- [CVE-2021-33269](https://insights.sbomify.com/CVE-2021-33269/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-33268](https://insights.sbomify.com/CVE-2021-33268/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-33267](https://insights.sbomify.com/CVE-2021-33267/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-33266](https://insights.sbomify.com/CVE-2021-33266/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-33265](https://insights.sbomify.com/CVE-2021-33265/): Memory corruption in dlink:dir-809 firmware (critical 9.8)
- [CVE-2021-3326](https://insights.sbomify.com/CVE-2021-3326/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-33259](https://insights.sbomify.com/CVE-2021-33259/): Missing authorization in d-link:dir-868lw firmware (medium 5.3)
- [CVE-2021-33256](https://insights.sbomify.com/CVE-2021-33256/): Code injection in zohocorp:manageengine adselfservice plus (high 8.8)
- [CVE-2021-33254](https://insights.sbomify.com/CVE-2021-33254/): Null dereference in embedthis:appweb (high 7.5)
- [CVE-2021-3325](https://insights.sbomify.com/CVE-2021-3325/): Auth bypass in fedoraproject:fedora (critical 9.8)
- [CVE-2021-33231](https://insights.sbomify.com/CVE-2021-33231/): Cross-site scripting in easyvista:service manager (medium 5.4)
- [CVE-2021-3323](https://insights.sbomify.com/CVE-2021-3323/): Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr (high 8.3)
- [CVE-2021-33226](https://insights.sbomify.com/CVE-2021-33226/): Code injection in saltstack:salt (critical 9.8)
- [CVE-2021-33224](https://insights.sbomify.com/CVE-2021-33224/): File upload in umbraco:umbraco forms (critical 9.8)
- [CVE-2021-33223](https://insights.sbomify.com/CVE-2021-33223/): Privilege escalation in seeddms:seeddms (high 8.8)
- [CVE-2021-33221](https://insights.sbomify.com/CVE-2021-33221/): Missing authorization in commscope:ruckus iot controller (critical 9.8)
- [CVE-2021-33220](https://insights.sbomify.com/CVE-2021-33220/): Hardcoded credentials in commscope:ruckus iot controller (high 7.8)
- [CVE-2021-3322](https://insights.sbomify.com/CVE-2021-3322/): Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr (medium 6.5)
- [CVE-2021-33219](https://insights.sbomify.com/CVE-2021-33219/): Hardcoded credentials in commscope:ruckus iot controller (critical 9.8)
- [CVE-2021-33218](https://insights.sbomify.com/CVE-2021-33218/): Hardcoded credentials in commscope:ruckus iot controller (critical 9.8)
- [CVE-2021-33217](https://insights.sbomify.com/CVE-2021-33217/): Path traversal in commscope:ruckus iot controller (high 8.8)
- [CVE-2021-33216](https://insights.sbomify.com/CVE-2021-33216/): Hardcoded credentials in commscope:ruckus iot controller (critical 9.8)
- [CVE-2021-33215](https://insights.sbomify.com/CVE-2021-33215/): Path traversal in commscope:ruckus iot controller (medium 4.3)
- [CVE-2021-33214](https://insights.sbomify.com/CVE-2021-33214/): Misconfiguration in hms-networks:ecatcher (medium 6.1)
- [CVE-2021-33213](https://insights.sbomify.com/CVE-2021-33213/): Server-side request forgery in element-it:http commander (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/150/