# Vulnerabilities published in 2021


- [CVE-2021-32623](https://insights.sbomify.com/CVE-2021-32623/): Opencast vulnerable to billion laughs attack (XML bomb) (high 8.1)
- [CVE-2021-32622](https://insights.sbomify.com/CVE-2021-32622/): File upload local preview can run embedded scripts after user interaction (medium 4.2)
- [CVE-2021-32621](https://insights.sbomify.com/CVE-2021-32621/): Script injection without script or programming rights through Gadget titles (high 8.8)
- [CVE-2021-32620](https://insights.sbomify.com/CVE-2021-32620/): Users registered with email verification can self re-activate their disabled accounts (high 8.8)
- [CVE-2021-3262](https://insights.sbomify.com/CVE-2021-3262/): SQL injection in trispark:novusedu (critical 9.8)
- [CVE-2021-32619](https://insights.sbomify.com/CVE-2021-32619/): Static imports inside dynamically imported modules do not adhere to permission checks (critical 9.8)
- [CVE-2021-32618](https://insights.sbomify.com/CVE-2021-32618/): Open Redirect Vulnerability (low 3.1)
- [CVE-2021-32617](https://insights.sbomify.com/CVE-2021-32617/): Denial of service in Exiv2 (medium 4.7)
- [CVE-2021-32616](https://insights.sbomify.com/CVE-2021-32616/): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in 1CDN (high 8.1)
- [CVE-2021-32615](https://insights.sbomify.com/CVE-2021-32615/): SQL injection in piwigo:piwigo (critical 9.8)
- [CVE-2021-32614](https://insights.sbomify.com/CVE-2021-32614/): Memory corruption in dmg2img (high 7.1)
- [CVE-2021-32613](https://insights.sbomify.com/CVE-2021-32613/): Memory corruption in radare2 (medium 5.5)
- [CVE-2021-32612](https://insights.sbomify.com/CVE-2021-32612/): Information disclosure in i-doo:veryfitpro (high 8.1)
- [CVE-2021-32611](https://insights.sbomify.com/CVE-2021-32611/): Null dereference in antisip:exosip2 (high 7.5)
- [CVE-2021-32610](https://insights.sbomify.com/CVE-2021-32610/): Directory Traversal in Archive_Tar (high 7.1)
- [CVE-2021-32609](https://insights.sbomify.com/CVE-2021-32609/): XSS vulnerability on Explore page (medium 5.4)
- [CVE-2021-32608](https://insights.sbomify.com/CVE-2021-32608/): Cross-site scripting in smartstore:smartstore (critical 9.8)
- [CVE-2021-32607](https://insights.sbomify.com/CVE-2021-32607/): Cross-site scripting in smartstore:smartstore (critical 9.8)
- [CVE-2021-32606](https://insights.sbomify.com/CVE-2021-32606/): Use after free in fedoraproject:fedora (high 7.8)
- [CVE-2021-32605](https://insights.sbomify.com/CVE-2021-32605/): Command injection in zzzcms:zzzphp (critical 9.8)
- [CVE-2021-32604](https://insights.sbomify.com/CVE-2021-32604/): Cross-site scripting in solarwinds:serv-u (medium 5.4)
- [CVE-2021-32603](https://insights.sbomify.com/CVE-2021-32603/): Server-side request forgery in Fortinet FortiAnalyzer, FortiManager (high 8.8)
- [CVE-2021-32602](https://insights.sbomify.com/CVE-2021-32602/): Cross-site scripting in Fortinet FortiPortal (medium 5.8)
- [CVE-2021-32600](https://insights.sbomify.com/CVE-2021-32600/): Information disclosure in Fortinet FortiOS (medium 5.0)
- [CVE-2021-32598](https://insights.sbomify.com/CVE-2021-32598/): Other in Fortinet FortiAnalyzer, FortiManager (medium 4.3)
- [CVE-2021-32597](https://insights.sbomify.com/CVE-2021-32597/): Cross-site scripting in Fortinet FortiAnalyzer, FortiManager (medium 4.6)
- [CVE-2021-32596](https://insights.sbomify.com/CVE-2021-32596/): Weak cryptography in Fortinet FortiPortal (medium 6.0)
- [CVE-2021-32595](https://insights.sbomify.com/CVE-2021-32595/): Denial of service in Fortinet FortiPortal (medium 6.5)
- [CVE-2021-32594](https://insights.sbomify.com/CVE-2021-32594/): File upload in Fortinet FortiPortal (medium 5.4)
- [CVE-2021-32593](https://insights.sbomify.com/CVE-2021-32593/): Weak cryptography in Fortinet FortiWAN (medium 6.5)
- [CVE-2021-32592](https://insights.sbomify.com/CVE-2021-32592/): Other in Fortinet FortiClientWindows, FortiClientEMS (high 7.8)
- [CVE-2021-32591](https://insights.sbomify.com/CVE-2021-32591/): Weak cryptography in Fortinet FortiSandbox (medium 5.3)
- [CVE-2021-32590](https://insights.sbomify.com/CVE-2021-32590/): SQL injection in Fortinet FortiPortal (critical 9.9)
- [CVE-2021-32589](https://insights.sbomify.com/CVE-2021-32589/): Use after free in FortiAnalyzer (high 7.7)
- [CVE-2021-32588](https://insights.sbomify.com/CVE-2021-32588/): Hardcoded credentials in Fortinet FortiPortal (critical 9.8)
- [CVE-2021-32587](https://insights.sbomify.com/CVE-2021-32587/): Missing authorization in Fortinet FortiAnalyzer, FortiManager (medium 4.3)
- [CVE-2021-32586](https://insights.sbomify.com/CVE-2021-32586/): Other in Fortinet FortiMail (high 7.7)
- [CVE-2021-32585](https://insights.sbomify.com/CVE-2021-32585/): Cross-site scripting in Fortinet FortiWAN (high 7.2)
- [CVE-2021-32584](https://insights.sbomify.com/CVE-2021-32584/): Missing authorization in FortiWLC (medium 4.8)
- [CVE-2021-32582](https://insights.sbomify.com/CVE-2021-32582/): SQL injection in connectwise:connectwise automate (high 7.5)
- [CVE-2021-32581](https://insights.sbomify.com/CVE-2021-32581/): Security feature bypass in acronis:cyber protect cloud (high 8.1)
- [CVE-2021-32580](https://insights.sbomify.com/CVE-2021-32580/): Privilege escalation in acronis:true image (high 7.8)
- [CVE-2021-3258](https://insights.sbomify.com/CVE-2021-3258/): Cross-site scripting in qa-themes:q2a ultimate seo (medium 5.4)
- [CVE-2021-32579](https://insights.sbomify.com/CVE-2021-32579/): Auth bypass in acronis:true image (high 7.8)
- [CVE-2021-32578](https://insights.sbomify.com/CVE-2021-32578/): Privilege escalation in acronis:true image (high 7.8)
- [CVE-2021-32577](https://insights.sbomify.com/CVE-2021-32577/): Privilege escalation in acronis:true image (high 7.8)
- [CVE-2021-32576](https://insights.sbomify.com/CVE-2021-32576/): Privilege escalation in acronis:true image (high 7.8)
- [CVE-2021-32575](https://insights.sbomify.com/CVE-2021-32575/): Improper network isolation in Hashicorp Nomad (medium 6.5)
- [CVE-2021-32574](https://insights.sbomify.com/CVE-2021-32574/): Hashicorp Consul Missing SSL Certificate Validation (high 7.5)
- [CVE-2021-32573](https://insights.sbomify.com/CVE-2021-32573/): Cross-site Scripting in express-cart (medium 4.8)
- [CVE-2021-32572](https://insights.sbomify.com/CVE-2021-32572/): Path traversal in specotech:web viewer (high 7.5)
- [CVE-2021-32571](https://insights.sbomify.com/CVE-2021-32571/): Information disclosure in ericsson:operations support system-radio and core firmware (medium 4.9)
- [CVE-2021-32570](https://insights.sbomify.com/CVE-2021-32570/): Information disclosure in ericsson:network manager (medium 4.9)
- [CVE-2021-32569](https://insights.sbomify.com/CVE-2021-32569/): Cross-site scripting in ericsson:operations support system-radio and core firmware (medium 6.1)
- [CVE-2021-32568](https://insights.sbomify.com/CVE-2021-32568/): Deserialization of Untrusted Data in zmister2016/mrdoc (high 7.5)
- [CVE-2021-32567](https://insights.sbomify.com/CVE-2021-32567/): Reading HTTP/2 frames too many times (high 7.5)
- [CVE-2021-32566](https://insights.sbomify.com/CVE-2021-32566/): Specific sequence of HTTP/2 frames can cause ATS to crash (high 7.5)
- [CVE-2021-32565](https://insights.sbomify.com/CVE-2021-32565/): HTTP Request Smuggling, content length with invalid charters (high 7.5)
- [CVE-2021-32563](https://insights.sbomify.com/CVE-2021-32563/): Code injection in xfce:thunar (critical 9.8)
- [CVE-2021-32561](https://insights.sbomify.com/CVE-2021-32561/): OctoPrint API Error Messages vulnerable to XSS (medium 6.1)
- [CVE-2021-32560](https://insights.sbomify.com/CVE-2021-32560/): OctoPrint Incorrect Access Control (medium 6.5)
- [CVE-2021-3256](https://insights.sbomify.com/CVE-2021-3256/): Path traversal in kuaifan:kuaifancms (medium 6.5)
- [CVE-2021-32559](https://insights.sbomify.com/CVE-2021-32559/): Integer overflow in pywin32 (medium 6.5)
- [CVE-2021-32558](https://insights.sbomify.com/CVE-2021-32558/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-32557](https://insights.sbomify.com/CVE-2021-32557/): apport process_report() arbitrary file write (medium 5.2)
- [CVE-2021-32556](https://insights.sbomify.com/CVE-2021-32556/): apport get_modified_conffiles() function command injection (low 3.8)
- [CVE-2021-32555](https://insights.sbomify.com/CVE-2021-32555/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32554](https://insights.sbomify.com/CVE-2021-32554/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32553](https://insights.sbomify.com/CVE-2021-32553/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32552](https://insights.sbomify.com/CVE-2021-32552/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32551](https://insights.sbomify.com/CVE-2021-32551/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32550](https://insights.sbomify.com/CVE-2021-32550/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32549](https://insights.sbomify.com/CVE-2021-32549/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32548](https://insights.sbomify.com/CVE-2021-32548/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32547](https://insights.sbomify.com/CVE-2021-32547/): apport read_file() function could follow maliciously constructed symbolic links (high 7.3)
- [CVE-2021-32546](https://insights.sbomify.com/CVE-2021-32546/): OS Command Injection in gogs (high 8.8)
- [CVE-2021-32545](https://insights.sbomify.com/CVE-2021-32545/): Denial of service in pexip:infinity (high 7.5)
- [CVE-2021-32544](https://insights.sbomify.com/CVE-2021-32544/): Intelligent global technology Ltd, igt+ - DOM-based Cross-Site Scripting (medium 5.4)
- [CVE-2021-32543](https://insights.sbomify.com/CVE-2021-32543/): SysJust CTS Web - Broken Authentication (medium 6.5)
- [CVE-2021-32542](https://insights.sbomify.com/CVE-2021-32542/): SysJust CTS Web - Reflected XSS (medium 4.7)
- [CVE-2021-32541](https://insights.sbomify.com/CVE-2021-32541/): SysJust CTS Web - Broken Access Control (medium 5.3)
- [CVE-2021-32540](https://insights.sbomify.com/CVE-2021-32540/): Hundred Plus 101EIP - Stored XSS-2 (medium 5.4)
- [CVE-2021-3254](https://insights.sbomify.com/CVE-2021-3254/): Denial of service in asus:dsl-n14u-b1 firmware (high 7.5)
- [CVE-2021-32539](https://insights.sbomify.com/CVE-2021-32539/): Hundred Plus 101EIP - Stored XSS-1 (medium 5.4)
- [CVE-2021-32538](https://insights.sbomify.com/CVE-2021-32538/): ARTWARE CMS - Unrestricted Upload of File (critical 9.8)
- [CVE-2021-32537](https://insights.sbomify.com/CVE-2021-32537/): Realtek High definition audio Windows driver crashed (medium 6.5)
- [CVE-2021-32536](https://insights.sbomify.com/CVE-2021-32536/): MCU Technologies MCUsystem - Reflected XSS (medium 6.1)
- [CVE-2021-32535](https://insights.sbomify.com/CVE-2021-32535/): QSAN SANOS - Use of Hard-coded Credentials (critical 9.8)
- [CVE-2021-32534](https://insights.sbomify.com/CVE-2021-32534/): QSAN SANOS - Command Injection (critical 9.8)
- [CVE-2021-32533](https://insights.sbomify.com/CVE-2021-32533/): QSAN SANOS - Command Injection (critical 9.8)
- [CVE-2021-32532](https://insights.sbomify.com/CVE-2021-32532/): QSAN XEVO - Path Traversal (high 7.5)
- [CVE-2021-32531](https://insights.sbomify.com/CVE-2021-32531/): QSAN XEVO - Command Injection Following via Init function (critical 9.8)
- [CVE-2021-32530](https://insights.sbomify.com/CVE-2021-32530/): QSAN XEVO - Command Injection Following via Array function (critical 9.8)
- [CVE-2021-32529](https://insights.sbomify.com/CVE-2021-32529/): QSAN XEVO, SANOS - Command Injection -1 (critical 9.8)
- [CVE-2021-32528](https://insights.sbomify.com/CVE-2021-32528/): QSAN Storage Manager - Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2021-32527](https://insights.sbomify.com/CVE-2021-32527/): QSAN Storage Manager - Path Traversal-2 (high 7.5)
- [CVE-2021-32526](https://insights.sbomify.com/CVE-2021-32526/): QSAN Storage Manager - Incorrect Permission Assignment for Critical Resource (medium 6.5)
- [CVE-2021-32525](https://insights.sbomify.com/CVE-2021-32525/): QSAN Storage Manager - Use of Hard-coded Password-2 (critical 9.1)
- [CVE-2021-32524](https://insights.sbomify.com/CVE-2021-32524/): QSAN Storage Manager - Command Injection-3 (critical 9.1)
- [CVE-2021-32523](https://insights.sbomify.com/CVE-2021-32523/): QSAN Storage Manager - Improper Authorization (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/156/