# Vulnerabilities published in 2021


- [CVE-2021-31422](https://insights.sbomify.com/CVE-2021-31422/): Race condition in Desktop (high 7.5)
- [CVE-2021-31421](https://insights.sbomify.com/CVE-2021-31421/): Path traversal in Desktop (low 3.2)
- [CVE-2021-31420](https://insights.sbomify.com/CVE-2021-31420/): Memory corruption in Desktop (high 8.8)
- [CVE-2021-31419](https://insights.sbomify.com/CVE-2021-31419/): Information disclosure in Desktop (medium 6.5)
- [CVE-2021-31418](https://insights.sbomify.com/CVE-2021-31418/): Information disclosure in Desktop (medium 6.5)
- [CVE-2021-31417](https://insights.sbomify.com/CVE-2021-31417/): Information disclosure in Desktop (medium 6.5)
- [CVE-2021-31414](https://insights.sbomify.com/CVE-2021-31414/): Code injection in rpm spec project:rpm spec (critical 9.8)
- [CVE-2021-31412](https://insights.sbomify.com/CVE-2021-31412/): Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 (medium 5.3)
- [CVE-2021-31411](https://insights.sbomify.com/CVE-2021-31411/): Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 (medium 6.3)
- [CVE-2021-31410](https://insights.sbomify.com/CVE-2021-31410/): Project sources exposure in Vaadin Designer (high 8.6)
- [CVE-2021-3141](https://insights.sbomify.com/CVE-2021-3141/): Information disclosure in unisys:stealth (high 7.8)
- [CVE-2021-31409](https://insights.sbomify.com/CVE-2021-31409/): Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 (high 7.5)
- [CVE-2021-31408](https://insights.sbomify.com/CVE-2021-31408/): Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 (medium 6.3)
- [CVE-2021-31407](https://insights.sbomify.com/CVE-2021-31407/): Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 (high 8.6)
- [CVE-2021-31406](https://insights.sbomify.com/CVE-2021-31406/): Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 (medium 4.0)
- [CVE-2021-31405](https://insights.sbomify.com/CVE-2021-31405/): Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 (high 7.5)
- [CVE-2021-31404](https://insights.sbomify.com/CVE-2021-31404/): Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 (medium 4.0)
- [CVE-2021-31403](https://insights.sbomify.com/CVE-2021-31403/): Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8 (medium 4.0)
- [CVE-2021-31402](https://insights.sbomify.com/CVE-2021-31402/): dio vulnerable to CRLF injection with HTTP method string (high 7.5)
- [CVE-2021-31401](https://insights.sbomify.com/CVE-2021-31401/): Integer overflow in hcc-embedded:nichestack (high 7.5)
- [CVE-2021-31400](https://insights.sbomify.com/CVE-2021-31400/): Denial of service in hcc-embedded:nichestack (high 7.5)
- [CVE-2021-31399](https://insights.sbomify.com/CVE-2021-31399/): Weak cryptography in 2n:access unit 2.0 firmware (medium 4.6)
- [CVE-2021-3139](https://insights.sbomify.com/CVE-2021-3139/): Path traversal in tcmu-runner project:tcmu-runner (high 8.1)
- [CVE-2021-31386](https://insights.sbomify.com/CVE-2021-31386/): Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks. (medium 5.3)
- [CVE-2021-31385](https://insights.sbomify.com/CVE-2021-31385/): Junos OS: J-Web: A path traversal vulnerability allows an authenticated attacker to elevate their privileges to root (high 8.8)
- [CVE-2021-31384](https://insights.sbomify.com/CVE-2021-31384/): Missing authorization in Junos OS (high 7.2)
- [CVE-2021-31383](https://insights.sbomify.com/CVE-2021-31383/): Memory corruption in Junos OS (high 7.5)
- [CVE-2021-31382](https://insights.sbomify.com/CVE-2021-31382/): Race condition in Junos OS (medium 6.5)
- [CVE-2021-31381](https://insights.sbomify.com/CVE-2021-31381/): SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files (medium 6.5)
- [CVE-2021-31380](https://insights.sbomify.com/CVE-2021-31380/): Information disclosure in SRC Series (medium 5.3)
- [CVE-2021-3138](https://insights.sbomify.com/CVE-2021-3138/): Security feature bypass in discourse:discourse (high 7.5)
- [CVE-2021-31379](https://insights.sbomify.com/CVE-2021-31379/): Denial of service in Junos OS (high 7.5)
- [CVE-2021-31378](https://insights.sbomify.com/CVE-2021-31378/): Denial of service in Junos OS (medium 6.8)
- [CVE-2021-31377](https://insights.sbomify.com/CVE-2021-31377/): Junos OS: A local authenticated attacker can cause RPD to core (medium 5.5)
- [CVE-2021-31376](https://insights.sbomify.com/CVE-2021-31376/): Junos OS: ACX Series: Packet Forwarding Engine manager (FXPC) process crashes when processing DHCPv6 packets (high 7.5)
- [CVE-2021-31375](https://insights.sbomify.com/CVE-2021-31375/): Junos OS: Receipt of a specific BGP update may cause RPKI policy-checks to be bypassed (high 7.2)
- [CVE-2021-31374](https://insights.sbomify.com/CVE-2021-31374/): Junos OS and Junos OS Evolved: RPD crash while processing a specially crafted BGP UPDATE or KEEPALIVE message. (high 7.5)
- [CVE-2021-31373](https://insights.sbomify.com/CVE-2021-31373/): Junos OS: SRX Series: Persistent XSS vulnerability in J-Web (high 8.0)
- [CVE-2021-31372](https://insights.sbomify.com/CVE-2021-31372/): Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root. (high 8.8)
- [CVE-2021-31371](https://insights.sbomify.com/CVE-2021-31371/): Information disclosure in Junos OS (medium 5.3)
- [CVE-2021-31370](https://insights.sbomify.com/CVE-2021-31370/): Denial of service in Junos OS (medium 6.5)
- [CVE-2021-3137](https://insights.sbomify.com/CVE-2021-3137/): Cross Site Scripting (XSS) in XWiki (medium 5.4)
- [CVE-2021-31369](https://insights.sbomify.com/CVE-2021-31369/): Denial of service in Junos OS (medium 5.3)
- [CVE-2021-31368](https://insights.sbomify.com/CVE-2021-31368/): Denial of service in Junos OS (high 7.5)
- [CVE-2021-31367](https://insights.sbomify.com/CVE-2021-31367/): Denial of service in Junos OS (medium 6.5)
- [CVE-2021-31366](https://insights.sbomify.com/CVE-2021-31366/): Denial of service in Junos OS (medium 6.5)
- [CVE-2021-31365](https://insights.sbomify.com/CVE-2021-31365/): Denial of service in Junos OS (medium 6.5)
- [CVE-2021-31364](https://insights.sbomify.com/CVE-2021-31364/): Junos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is received (medium 5.9)
- [CVE-2021-31363](https://insights.sbomify.com/CVE-2021-31363/): Junos OS and Junos OS Evolved: Receipt of a specific LDP message will cause a Denial of Service (medium 6.5)
- [CVE-2021-31362](https://insights.sbomify.com/CVE-2021-31362/): Denial of service in Junos OS (medium 6.5)
- [CVE-2021-31361](https://insights.sbomify.com/CVE-2021-31361/): Denial of service in Junos OS (medium 5.3)
- [CVE-2021-31360](https://insights.sbomify.com/CVE-2021-31360/): Junos OS and Junos OS Evolved: Denial of Service vulnerability in local file processing (high 7.1)
- [CVE-2021-31359](https://insights.sbomify.com/CVE-2021-31359/): Junos OS and Junos OS Evolved: Local Privilege Escalation vulnerability (high 7.8)
- [CVE-2021-31358](https://insights.sbomify.com/CVE-2021-31358/): Junos OS Evolved: shell-injection vulnerabilities in evo_sftp UI wrapper script (high 7.8)
- [CVE-2021-31357](https://insights.sbomify.com/CVE-2021-31357/): Junos OS Evolved: shell-injection vulnerabilities in evo_tcpdump UI wrapper script (high 7.8)
- [CVE-2021-31356](https://insights.sbomify.com/CVE-2021-31356/): Junos OS Evolved: Multiple shell-injection vulnerabilities in EVO UI wrapper scripts (high 7.8)
- [CVE-2021-31355](https://insights.sbomify.com/CVE-2021-31355/): Junos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portal (high 8.0)
- [CVE-2021-31354](https://insights.sbomify.com/CVE-2021-31354/): Memory corruption in Junos OS (high 7.1)
- [CVE-2021-31353](https://insights.sbomify.com/CVE-2021-31353/): Junos OS and Junos OS Evolved: RPD core upon receipt of specific BGP update (high 7.5)
- [CVE-2021-31352](https://insights.sbomify.com/CVE-2021-31352/): SRC Series: NETCONF over SSH allows negotiation of weak ciphers (medium 5.3)
- [CVE-2021-31351](https://insights.sbomify.com/CVE-2021-31351/): Junos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card reset (high 7.5)
- [CVE-2021-31350](https://insights.sbomify.com/CVE-2021-31350/): Junos OS and Junos OS Evolved: Privilege escalation vulnerability in Juniper Extension Toolkit (JET) (high 7.5)
- [CVE-2021-3135](https://insights.sbomify.com/CVE-2021-3135/): Cross-site scripting in tagdiv:newspaper (medium 6.1)
- [CVE-2021-31349](https://insights.sbomify.com/CVE-2021-31349/): Session Smart Router: Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2021-31348](https://insights.sbomify.com/CVE-2021-31348/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2021-31347](https://insights.sbomify.com/CVE-2021-31347/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2021-31346](https://insights.sbomify.com/CVE-2021-31346/): Memory corruption in Capital Embedded AR Classic 431-422 (high 8.2)
- [CVE-2021-31345](https://insights.sbomify.com/CVE-2021-31345/): Other in Capital Embedded AR Classic 431-422 (high 7.5)
- [CVE-2021-31344](https://insights.sbomify.com/CVE-2021-31344/): Other in Capital Embedded AR Classic 431-422 (medium 6.9)
- [CVE-2021-31343](https://insights.sbomify.com/CVE-2021-31343/): Memory corruption in Siemens Solid Edge (high 8.8)
- [CVE-2021-31342](https://insights.sbomify.com/CVE-2021-31342/): Memory corruption in Siemens Solid Edge (high 8.8)
- [CVE-2021-31341](https://insights.sbomify.com/CVE-2021-31341/): Information disclosure in Mendix Database Replication Module (medium 4.3)
- [CVE-2021-31340](https://insights.sbomify.com/CVE-2021-31340/): Denial of service in SIMATIC RF166C (high 7.5)
- [CVE-2021-3134](https://insights.sbomify.com/CVE-2021-3134/): Privilege escalation in mubu:mubu (high 7.8)
- [CVE-2021-31339](https://insights.sbomify.com/CVE-2021-31339/): Information disclosure in Mendix Excel Importer Module (medium 4.3)
- [CVE-2021-31338](https://insights.sbomify.com/CVE-2021-31338/): Missing authorization in SINEMA Remote Connect Client (high 7.8)
- [CVE-2021-31337](https://insights.sbomify.com/CVE-2021-31337/): Auth bypass in SINAMICS Medium Voltage Products (critical 9.8)
- [CVE-2021-31330](https://insights.sbomify.com/CVE-2021-31330/): Cross-site scripting in reviewboard:review board (medium 5.4)
- [CVE-2021-3133](https://insights.sbomify.com/CVE-2021-3133/): Cross-site request forgery in sean-barton:elementor contact form db (medium 6.5)
- [CVE-2021-31329](https://insights.sbomify.com/CVE-2021-31329/): Cross-site scripting in remoteclinic:remote clinic (medium 5.4)
- [CVE-2021-31327](https://insights.sbomify.com/CVE-2021-31327/): Cross-site scripting in remoteclinic:remote clinic (medium 5.4)
- [CVE-2021-31326](https://insights.sbomify.com/CVE-2021-31326/): Auth bypass in dlink:dir-816 firmware (critical 9.8)
- [CVE-2021-31324](https://insights.sbomify.com/CVE-2021-31324/): Command injection in control-webpanel:webpanel (critical 9.8)
- [CVE-2021-31323](https://insights.sbomify.com/CVE-2021-31323/): Memory corruption in telegram:telegram (medium 5.5)
- [CVE-2021-31322](https://insights.sbomify.com/CVE-2021-31322/): Memory corruption in telegram:telegram (medium 5.5)
- [CVE-2021-31321](https://insights.sbomify.com/CVE-2021-31321/): Memory corruption in telegram:telegram (high 7.1)
- [CVE-2021-31320](https://insights.sbomify.com/CVE-2021-31320/): Memory corruption in telegram:telegram (high 7.1)
- [CVE-2021-31319](https://insights.sbomify.com/CVE-2021-31319/): Integer overflow in telegram:telegram (medium 5.5)
- [CVE-2021-31318](https://insights.sbomify.com/CVE-2021-31318/): Memory corruption in telegram:telegram (medium 5.5)
- [CVE-2021-31317](https://insights.sbomify.com/CVE-2021-31317/): Memory corruption in telegram:telegram (medium 5.5)
- [CVE-2021-31316](https://insights.sbomify.com/CVE-2021-31316/): SQL injection in control-webpanel:webpanel (critical 9.8)
- [CVE-2021-31315](https://insights.sbomify.com/CVE-2021-31315/): Memory corruption in telegram:telegram (medium 5.5)
- [CVE-2021-31314](https://insights.sbomify.com/CVE-2021-31314/): File upload in ejinshan:terminal security system (critical 9.8)
- [CVE-2021-3131](https://insights.sbomify.com/CVE-2021-3131/): Information disclosure in 1c:1c\ (high 7.5)
- [CVE-2021-3130](https://insights.sbomify.com/CVE-2021-3130/): Information disclosure in opmantek:open-audit (medium 5.9)
- [CVE-2021-31294](https://insights.sbomify.com/CVE-2021-31294/): Denial of service in redis:redis (medium 5.9)
- [CVE-2021-31292](https://insights.sbomify.com/CVE-2021-31292/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2021-3129](https://insights.sbomify.com/CVE-2021-3129/): Laravel Ignition File Upload (critical 9.8, exploited in the wild)
- [CVE-2021-31280](https://insights.sbomify.com/CVE-2021-31280/): Cross-site scripting in tp5cms project:tp5cms (medium 6.1)
- [CVE-2021-3128](https://insights.sbomify.com/CVE-2021-3128/): Denial of service in asus:rt-ac1750 b1 firmware (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/164/