# Vulnerabilities published in 2021


- [CVE-2021-32965](https://insights.sbomify.com/CVE-2021-32965/): Delta Electronics DIAScreen - Type Confusion, Out-of-bounds Write (high 7.8)
- [CVE-2021-32964](https://insights.sbomify.com/CVE-2021-32964/): Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel (medium 6.5)
- [CVE-2021-32963](https://insights.sbomify.com/CVE-2021-32963/): AVEVA SuiteLink Server Null Pointer Dereference (high 7.5)
- [CVE-2021-32962](https://insights.sbomify.com/CVE-2021-32962/): Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel (high 8.2)
- [CVE-2021-32961](https://insights.sbomify.com/CVE-2021-32961/): MDT AutoSave Unrestricted Upload of File with Dangerous Type (high 7.5)
- [CVE-2021-32960](https://insights.sbomify.com/CVE-2021-32960/): Rockwell Automation FactoryTalk Services Platform Protection Mechanism Failure (high 8.5)
- [CVE-2021-32959](https://insights.sbomify.com/CVE-2021-32959/): AVEVA SuiteLink Server Buffer Overflow (high 8.1)
- [CVE-2021-32958](https://insights.sbomify.com/CVE-2021-32958/): Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel (medium 5.5)
- [CVE-2021-32957](https://insights.sbomify.com/CVE-2021-32957/): MDT AutoSave Uncontrolled Search Path Element (high 7.5)
- [CVE-2021-32956](https://insights.sbomify.com/CVE-2021-32956/): Open redirect in Advantech WebAccess/SCADA (medium 6.1)
- [CVE-2021-32955](https://insights.sbomify.com/CVE-2021-32955/): File upload in Delta Electronics DIAEnergie (critical 9.8)
- [CVE-2021-32954](https://insights.sbomify.com/CVE-2021-32954/): Path traversal in Advantech WebAccess/SCADA (medium 6.5)
- [CVE-2021-32953](https://insights.sbomify.com/CVE-2021-32953/): MDT AutoSave SQL Injection (critical 9.8)
- [CVE-2021-32952](https://insights.sbomify.com/CVE-2021-32952/): Memory corruption in Drawings SDK (high 7.8)
- [CVE-2021-32951](https://insights.sbomify.com/CVE-2021-32951/): Advantech WebAccess/NMS Improper Authentication (medium 5.3)
- [CVE-2021-32950](https://insights.sbomify.com/CVE-2021-32950/): Memory corruption in Drawings SDK (high 7.1)
- [CVE-2021-32949](https://insights.sbomify.com/CVE-2021-32949/): MDT AutoSave Relative Path Traversal (high 7.5)
- [CVE-2021-32948](https://insights.sbomify.com/CVE-2021-32948/): Memory corruption in Drawings SDK (high 7.8)
- [CVE-2021-32947](https://insights.sbomify.com/CVE-2021-32947/): Memory corruption in FATEK Automation FvDesigner (high 7.8)
- [CVE-2021-32946](https://insights.sbomify.com/CVE-2021-32946/): Memory corruption in Drawings SDK (high 7.8)
- [CVE-2021-32945](https://insights.sbomify.com/CVE-2021-32945/): MDT AutoSave Inadequate Encryption Strength (high 7.5)
- [CVE-2021-32944](https://insights.sbomify.com/CVE-2021-32944/): Use after free in Drawings SDK (high 7.8)
- [CVE-2021-32943](https://insights.sbomify.com/CVE-2021-32943/): Memory corruption in WebAccess/SCADA (critical 9.8)
- [CVE-2021-32942](https://insights.sbomify.com/CVE-2021-32942/): Information disclosure in InTouch (medium 6.6)
- [CVE-2021-32941](https://insights.sbomify.com/CVE-2021-32941/): Annke Network Video Recorder - Stack-based Buffer Overflow (critical 9.4)
- [CVE-2021-32940](https://insights.sbomify.com/CVE-2021-32940/): Memory corruption in Drawings SDK (high 7.1)
- [CVE-2021-3294](https://insights.sbomify.com/CVE-2021-3294/): Cross-site scripting in casap automated enrollment system project:casap automated enrollment system (medium 5.4)
- [CVE-2021-32939](https://insights.sbomify.com/CVE-2021-32939/): Memory corruption in FATEK Automation FvDesigner (high 7.8)
- [CVE-2021-32938](https://insights.sbomify.com/CVE-2021-32938/): Memory corruption in Drawings SDK (high 7.1)
- [CVE-2021-32937](https://insights.sbomify.com/CVE-2021-32937/): MDT AutoSave Generation of Error Message Containing Sensitive Information (high 7.5)
- [CVE-2021-32936](https://insights.sbomify.com/CVE-2021-32936/): Memory corruption in Drawings SDK (high 7.8)
- [CVE-2021-32935](https://insights.sbomify.com/CVE-2021-32935/): Cognex In-Sight OPC Server - Deserialization of Untrusted Data (high 8.8)
- [CVE-2021-32934](https://insights.sbomify.com/CVE-2021-32934/): ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information (critical 9.1)
- [CVE-2021-32933](https://insights.sbomify.com/CVE-2021-32933/): MDT AutoSave Command Injection (critical 10.0)
- [CVE-2021-32932](https://insights.sbomify.com/CVE-2021-32932/): SQL injection in iView (high 7.5)
- [CVE-2021-32931](https://insights.sbomify.com/CVE-2021-32931/): Memory corruption in FATEK Automation FvDesigner (high 7.8)
- [CVE-2021-32930](https://insights.sbomify.com/CVE-2021-32930/): Missing authorization in iView (critical 9.8)
- [CVE-2021-3293](https://insights.sbomify.com/CVE-2021-3293/): Information disclosure in emlog:emlog (medium 5.3)
- [CVE-2021-32929](https://insights.sbomify.com/CVE-2021-32929/): Uffizio GPS Tracker Cross-site Request Forgery (medium 4.3)
- [CVE-2021-32928](https://insights.sbomify.com/CVE-2021-32928/): Misconfiguration in Sentinel LDK Run-Time Environment (critical 9.8)
- [CVE-2021-32927](https://insights.sbomify.com/CVE-2021-32927/): Uffizio GPS Tracker Cross-site Scripting (high 7.1)
- [CVE-2021-32926](https://insights.sbomify.com/CVE-2021-32926/): Auth bypass in Micro800, MicroLogix 1400 (medium 5.9)
- [CVE-2021-32925](https://insights.sbomify.com/CVE-2021-32925/): XML external entity in chamilo:chamilo (medium 6.5)
- [CVE-2021-32924](https://insights.sbomify.com/CVE-2021-32924/): Code injection in invisioncommunity:ips community suite (high 8.8)
- [CVE-2021-32923](https://insights.sbomify.com/CVE-2021-32923/): Invalid session token expiration (high 7.4)
- [CVE-2021-32921](https://insights.sbomify.com/CVE-2021-32921/): Weak cryptography in debian:debian linux (medium 5.9)
- [CVE-2021-32920](https://insights.sbomify.com/CVE-2021-32920/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-32919](https://insights.sbomify.com/CVE-2021-32919/): Auth bypass in debian:debian linux (high 7.5)
- [CVE-2021-32918](https://insights.sbomify.com/CVE-2021-32918/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-32917](https://insights.sbomify.com/CVE-2021-32917/): Missing authorization in debian:debian linux (medium 5.3)
- [CVE-2021-3291](https://insights.sbomify.com/CVE-2021-3291/): Zen Cart vulnerable to authenticated remote code execution (high 7.2)
- [CVE-2021-3287](https://insights.sbomify.com/CVE-2021-3287/): Deserialization in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2021-32862](https://insights.sbomify.com/CVE-2021-32862/): nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths (high 7.5)
- [CVE-2021-32860](https://insights.sbomify.com/CVE-2021-32860/): iziModal vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-3286](https://insights.sbomify.com/CVE-2021-3286/): SQL injection in spotweb project:spotweb (critical 9.8)
- [CVE-2021-32859](https://insights.sbomify.com/CVE-2021-32859/): Baremetrics date range picker vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32858](https://insights.sbomify.com/CVE-2021-32858/): esdoc-publish-html-plugin vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32857](https://insights.sbomify.com/CVE-2021-32857/): Cockpit vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32856](https://insights.sbomify.com/CVE-2021-32856/): Microweber vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32855](https://insights.sbomify.com/CVE-2021-32855/): vditor vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32854](https://insights.sbomify.com/CVE-2021-32854/): textAngular text editor vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32853](https://insights.sbomify.com/CVE-2021-32853/): Erxes vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32852](https://insights.sbomify.com/CVE-2021-32852/): countly-server vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2021-32851](https://insights.sbomify.com/CVE-2021-32851/): jQuery MiniColors vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-32850](https://insights.sbomify.com/CVE-2021-32850/): jQuery MiniColors vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2021-3285](https://insights.sbomify.com/CVE-2021-3285/): Security feature bypass in ti:code composer studio intgrated development environment (medium 5.3)
- [CVE-2021-32849](https://insights.sbomify.com/CVE-2021-32849/): Arbitrary command execution in Gerapy (high 8.8)
- [CVE-2021-32848](https://insights.sbomify.com/CVE-2021-32848/): Octobox ReDoS vulnerability (high 7.5)
- [CVE-2021-32847](https://insights.sbomify.com/CVE-2021-32847/): Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx (high 7.1)
- [CVE-2021-32846](https://insights.sbomify.com/CVE-2021-32846/): Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx (high 7.7)
- [CVE-2021-32845](https://insights.sbomify.com/CVE-2021-32845/): Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notify (high 7.7)
- [CVE-2021-32844](https://insights.sbomify.com/CVE-2021-32844/): Null dereference in hyperkit (medium 6.2)
- [CVE-2021-32843](https://insights.sbomify.com/CVE-2021-32843/): Null dereference in hyperkit (medium 6.2)
- [CVE-2021-32842](https://insights.sbomify.com/CVE-2021-32842/): Path Traversal in SharpZipLib (medium 4.0)
- [CVE-2021-32841](https://insights.sbomify.com/CVE-2021-32841/): Path Traversal in SharpZipLib (medium 4.0)
- [CVE-2021-32840](https://insights.sbomify.com/CVE-2021-32840/): Path Traversal in SharpZipLib (high 7.3)
- [CVE-2021-32839](https://insights.sbomify.com/CVE-2021-32839/): Regular Expression Denial of Service in sqlparse (high 7.5)
- [CVE-2021-32838](https://insights.sbomify.com/CVE-2021-32838/): Regular Expression Denial of Service in flask-restx (high 7.5)
- [CVE-2021-32837](https://insights.sbomify.com/CVE-2021-32837/): mechanize vulnerable to ReDoS (high 7.5)
- [CVE-2021-32836](https://insights.sbomify.com/CVE-2021-32836/): Pre-auth unsafe deserialization in ZStack (high 7.5)
- [CVE-2021-32835](https://insights.sbomify.com/CVE-2021-32835/): Groovy Sandbox escape in Eclipse Keti (critical 9.9)
- [CVE-2021-32834](https://insights.sbomify.com/CVE-2021-32834/): Arbitrary Groovy script evaluation in Eclipse Keti (high 8.2)
- [CVE-2021-32833](https://insights.sbomify.com/CVE-2021-32833/): Unauthenticated file read in Emby Server (high 8.6)
- [CVE-2021-32832](https://insights.sbomify.com/CVE-2021-32832/): ReDOS in Rocket.Chat (medium 4.3)
- [CVE-2021-32831](https://insights.sbomify.com/CVE-2021-32831/): Code injection in total.js (high 7.5)
- [CVE-2021-32830](https://insights.sbomify.com/CVE-2021-32830/): Command injection in @diez/generation (low 3.9)
- [CVE-2021-3283](https://insights.sbomify.com/CVE-2021-3283/): Improper Privilege Management in HashiCorp Nomad (high 7.5)
- [CVE-2021-32829](https://insights.sbomify.com/CVE-2021-32829/): Post-authentication Remote Code Execution (RCE) in ZStack REST API (critical 9.6)
- [CVE-2021-32828](https://insights.sbomify.com/CVE-2021-32828/): Regular expression Denial of Service in MooTools (medium 5.4)
- [CVE-2021-32827](https://insights.sbomify.com/CVE-2021-32827/): Arbitrary code execution in MockServer (medium 6.1)
- [CVE-2021-32826](https://insights.sbomify.com/CVE-2021-32826/): Remote code execution in Proxyee-Down (medium 6.8)
- [CVE-2021-32825](https://insights.sbomify.com/CVE-2021-32825/): ZipSlip vulnerability in bblfshd (low 2.7)
- [CVE-2021-32824](https://insights.sbomify.com/CVE-2021-32824/): Regular expression Denial of Service in MooTools (critical 9.8)
- [CVE-2021-32823](https://insights.sbomify.com/CVE-2021-32823/): Potential Denial-of-Service in bindata (low 3.7)
- [CVE-2021-32822](https://insights.sbomify.com/CVE-2021-32822/): File disclosure in hbs (medium 4.0)
- [CVE-2021-32821](https://insights.sbomify.com/CVE-2021-32821/): Regular expression Denial of Service in MooTools (medium 6.2)
- [CVE-2021-32820](https://insights.sbomify.com/CVE-2021-32820/): File disclosure in Express Handlebars (high 8.6)
- [CVE-2021-3282](https://insights.sbomify.com/CVE-2021-3282/): Improper Authentication in HashiCorp Vault (high 7.5)
- [CVE-2021-32819](https://insights.sbomify.com/CVE-2021-32819/): Remote code execution in squirrelly (high 8.0)
- [CVE-2021-32818](https://insights.sbomify.com/CVE-2021-32818/): Remote code execution and Reflected cross site scripting in haml-coffee (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/153/