# Vulnerabilities published in 2021


- [CVE-2021-30185](https://insights.sbomify.com/CVE-2021-30185/): Indico Tampering with links (e.g. password reset) in sent emails (high 7.5)
- [CVE-2021-30184](https://insights.sbomify.com/CVE-2021-30184/): Memory corruption in fedoraproject:fedora (high 7.8)
- [CVE-2021-30183](https://insights.sbomify.com/CVE-2021-30183/): Information disclosure in octopus:server (high 7.5)
- [CVE-2021-30181](https://insights.sbomify.com/CVE-2021-30181/): Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) (critical 9.8)
- [CVE-2021-30180](https://insights.sbomify.com/CVE-2021-30180/): Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) (critical 9.8)
- [CVE-2021-3018](https://insights.sbomify.com/CVE-2021-3018/): SQL injection in ipeak:ipeakcms (critical 9.8)
- [CVE-2021-30179](https://insights.sbomify.com/CVE-2021-30179/): Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter (critical 9.8)
- [CVE-2021-30178](https://insights.sbomify.com/CVE-2021-30178/): Null dereference in fedoraproject:fedora (medium 5.5)
- [CVE-2021-30177](https://insights.sbomify.com/CVE-2021-30177/): SQL injection in phpnuke:php-nuke (critical 9.8)
- [CVE-2021-30176](https://insights.sbomify.com/CVE-2021-30176/): SQL injection in zerof:expert (critical 9.8)
- [CVE-2021-30175](https://insights.sbomify.com/CVE-2021-30175/): SQL injection in zerof:web server (critical 9.8)
- [CVE-2021-30174](https://insights.sbomify.com/CVE-2021-30174/): RiyaLab Co., Ltd. CloudISO - Stored XSS (medium 5.4)
- [CVE-2021-30173](https://insights.sbomify.com/CVE-2021-30173/): Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File Inclusion (medium 6.5)
- [CVE-2021-30172](https://insights.sbomify.com/CVE-2021-30172/): Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS (medium 4.6)
- [CVE-2021-30171](https://insights.sbomify.com/CVE-2021-30171/): Jun-He Technology Ltd. ERP POS - Stored XSS-2 (medium 4.6)
- [CVE-2021-30170](https://insights.sbomify.com/CVE-2021-30170/): Jun-He Technology Ltd. ERP POS - Stored XSS-1 (medium 4.6)
- [CVE-2021-3017](https://insights.sbomify.com/CVE-2021-3017/): Information disclosure in intelbras:win 300 firmware (high 7.5)
- [CVE-2021-30169](https://insights.sbomify.com/CVE-2021-30169/): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-2 (medium 5.3)
- [CVE-2021-30168](https://insights.sbomify.com/CVE-2021-30168/): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Sensitive Data Exposure-1 (critical 9.8)
- [CVE-2021-30167](https://insights.sbomify.com/CVE-2021-30167/): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Broken Authentication (critical 9.8)
- [CVE-2021-30166](https://insights.sbomify.com/CVE-2021-30166/): MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection (high 7.2)
- [CVE-2021-30165](https://insights.sbomify.com/CVE-2021-30165/): EDIMAX Technology Co., Ltd. HD Wireless Day & Night Network Camera IC-3140W - Hard-coded password (high 7.5)
- [CVE-2021-30164](https://insights.sbomify.com/CVE-2021-30164/): Missing authorization in debian:debian linux (critical 9.8)
- [CVE-2021-30163](https://insights.sbomify.com/CVE-2021-30163/): Information disclosure in debian:debian linux (high 7.5)
- [CVE-2021-30162](https://insights.sbomify.com/CVE-2021-30162/): Missing authorization in google:android (high 7.1)
- [CVE-2021-30161](https://insights.sbomify.com/CVE-2021-30161/): Security feature bypass in google:android (medium 5.5)
- [CVE-2021-30159](https://insights.sbomify.com/CVE-2021-30159/): Race condition in debian:debian linux (medium 4.3)
- [CVE-2021-30158](https://insights.sbomify.com/CVE-2021-30158/): Security feature bypass in debian:debian linux (medium 5.3)
- [CVE-2021-30157](https://insights.sbomify.com/CVE-2021-30157/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-30156](https://insights.sbomify.com/CVE-2021-30156/): Information disclosure in fedoraproject:fedora (medium 4.3)
- [CVE-2021-30155](https://insights.sbomify.com/CVE-2021-30155/): Missing authorization in debian:debian linux (medium 4.3)
- [CVE-2021-30154](https://insights.sbomify.com/CVE-2021-30154/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-30153](https://insights.sbomify.com/CVE-2021-30153/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2021-30152](https://insights.sbomify.com/CVE-2021-30152/): Privilege escalation in debian:debian linux (medium 4.3)
- [CVE-2021-30151](https://insights.sbomify.com/CVE-2021-30151/): Cross-site Scripting in Sidekiq (medium 6.1)
- [CVE-2021-30150](https://insights.sbomify.com/CVE-2021-30150/): Cross-site scripting in ocproducts:composr (medium 6.1)
- [CVE-2021-30149](https://insights.sbomify.com/CVE-2021-30149/): File upload in ocproducts:composr (critical 9.8)
- [CVE-2021-30147](https://insights.sbomify.com/CVE-2021-30147/): Cross-site request forgery in dmasoftlab:radius manager (high 8.8)
- [CVE-2021-30146](https://insights.sbomify.com/CVE-2021-30146/): Cross-site scripting in seafile:seafile (medium 5.4)
- [CVE-2021-30145](https://insights.sbomify.com/CVE-2021-30145/): Memory corruption in mpv:mpv (high 7.8)
- [CVE-2021-30144](https://insights.sbomify.com/CVE-2021-30144/): Missing authorization in glpi-project:dashboard (medium 4.3)
- [CVE-2021-30141](https://insights.sbomify.com/CVE-2021-30141/): Denial of service in friendica:friendica (high 7.5)
- [CVE-2021-30140](https://insights.sbomify.com/CVE-2021-30140/): Cross-site scripting in liquidfiles:liquidfiles (medium 5.4)
- [CVE-2021-3014](https://insights.sbomify.com/CVE-2021-3014/): Cross-site scripting in mikrotik:routeros (medium 6.1)
- [CVE-2021-30139](https://insights.sbomify.com/CVE-2021-30139/): Memory corruption in alpinelinux:apk-tools (high 7.5)
- [CVE-2021-30137](https://insights.sbomify.com/CVE-2021-30137/): XML external entity in axiossystems:assyst (high 7.7)
- [CVE-2021-30134](https://insights.sbomify.com/CVE-2021-30134/): php-mod/curl allows Cross-site Scripting (medium 6.1)
- [CVE-2021-30133](https://insights.sbomify.com/CVE-2021-30133/): Cross-site scripting in cloverdx:cloverdx (medium 6.1)
- [CVE-2021-30132](https://insights.sbomify.com/CVE-2021-30132/): Privilege escalation in cloudera:cloudera manager (critical 9.8)
- [CVE-2021-30130](https://insights.sbomify.com/CVE-2021-30130/): Improper Certificate Validation in phpseclib (high 7.5)
- [CVE-2021-3013](https://insights.sbomify.com/CVE-2021-3013/): OS command injection in ripgrep (critical 9.8)
- [CVE-2021-30129](https://insights.sbomify.com/CVE-2021-30129/): DoS/OOM leak vulnerability in Apache Mina SSHD Server (medium 6.5)
- [CVE-2021-30128](https://insights.sbomify.com/CVE-2021-30128/): Unsafe deserialization in Apache OFBiz (critical 9.8)
- [CVE-2021-30127](https://insights.sbomify.com/CVE-2021-30127/): Misconfiguration in terra-master:f2-210 firmware (high 7.3)
- [CVE-2021-30126](https://insights.sbomify.com/CVE-2021-30126/): Information disclosure in lightmeter:controlcenter (medium 6.5)
- [CVE-2021-30125](https://insights.sbomify.com/CVE-2021-30125/): Cross-site scripting in jamf:jamf (medium 6.1)
- [CVE-2021-30124](https://insights.sbomify.com/CVE-2021-30124/): Code injection in vscode-phpmd project:vscode-phpmd (critical 9.8)
- [CVE-2021-30123](https://insights.sbomify.com/CVE-2021-30123/): Memory corruption in ffmpeg:ffmpeg (high 8.8)
- [CVE-2021-30121](https://insights.sbomify.com/CVE-2021-30121/): (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6 (medium 6.5)
- [CVE-2021-30120](https://insights.sbomify.com/CVE-2021-30120/): 2FA bypass in Kaseya VSA <= v9.5.6 (critical 9.9)
- [CVE-2021-3012](https://insights.sbomify.com/CVE-2021-3012/): Cross-site scripting in esri:arcgis enterprise (medium 5.4)
- [CVE-2021-30119](https://insights.sbomify.com/CVE-2021-30119/): Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6 (medium 5.4)
- [CVE-2021-30118](https://insights.sbomify.com/CVE-2021-30118/): Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5 (critical 9.8)
- [CVE-2021-30117](https://insights.sbomify.com/CVE-2021-30117/): Authenticated SQL injection in Kaseya VSA < v9.5.6 (critical 9.8)
- [CVE-2021-30116](https://insights.sbomify.com/CVE-2021-30116/): Kaseya Virtual System/Server Administrator (VSA) Information Disclosure (critical 10.0, exploited in the wild)
- [CVE-2021-30114](https://insights.sbomify.com/CVE-2021-30114/): Cross-site request forgery in web-school:enterprise resource planning (medium 6.5)
- [CVE-2021-30113](https://insights.sbomify.com/CVE-2021-30113/): Cross-site scripting in web-school:enterprise resource planning (medium 6.1)
- [CVE-2021-30112](https://insights.sbomify.com/CVE-2021-30112/): Cross-site request forgery in web-school:enterprise resource planning (medium 6.5)
- [CVE-2021-30111](https://insights.sbomify.com/CVE-2021-30111/): Cross-site scripting in web-school:enterprise resource planning (medium 5.4)
- [CVE-2021-30110](https://insights.sbomify.com/CVE-2021-30110/): Other in greyware:domain time ii (high 7.5)
- [CVE-2021-3011](https://insights.sbomify.com/CVE-2021-3011/): Information disclosure in ftsafe:k13 (medium 4.2)
- [CVE-2021-30109](https://insights.sbomify.com/CVE-2021-30109/): Cross-site Scripting in Froala Editor (medium 6.1)
- [CVE-2021-30108](https://insights.sbomify.com/CVE-2021-30108/): Server-Side Request Forgery in Feehi CMS (critical 9.1)
- [CVE-2021-3010](https://insights.sbomify.com/CVE-2021-3010/): Cross-site scripting in opentext:content server (medium 5.4)
- [CVE-2021-30086](https://insights.sbomify.com/CVE-2021-30086/): Cross-site scripting in kindsoft:kindeditor (medium 6.1)
- [CVE-2021-30083](https://insights.sbomify.com/CVE-2021-30083/): Cross-site scripting in webfairy:mediat (medium 6.1)
- [CVE-2021-30082](https://insights.sbomify.com/CVE-2021-30082/): Cross-site scripting in gris cms project:gris cms (medium 6.1)
- [CVE-2021-30081](https://insights.sbomify.com/CVE-2021-30081/): SQL injection in emlog:emlog (high 8.8)
- [CVE-2021-30080](https://insights.sbomify.com/CVE-2021-30080/): Access control bypass in Beego (critical 9.8)
- [CVE-2021-30074](https://insights.sbomify.com/CVE-2021-30074/): Docsify vulnerable to cross-site scripting due to mishandled encoding (medium 6.1)
- [CVE-2021-30072](https://insights.sbomify.com/CVE-2021-30072/): Memory corruption in dlink:dir-878 firmware (critical 9.8)
- [CVE-2021-30071](https://insights.sbomify.com/CVE-2021-30071/): Cross-site scripting in hestiacp:control panel (medium 6.1)
- [CVE-2021-30070](https://insights.sbomify.com/CVE-2021-30070/): Command injection in hestiacp:hestiacp (high 7.5)
- [CVE-2021-3007](https://insights.sbomify.com/CVE-2021-3007/): Remote code execution in zendframework and laminas-http (critical 9.8)
- [CVE-2021-30066](https://insights.sbomify.com/CVE-2021-30066/): Security feature bypass in belden:eagle 20 tofino 943 987-501-tx\/tx firmware (medium 6.8)
- [CVE-2021-30065](https://insights.sbomify.com/CVE-2021-30065/): Security feature bypass in belden:eagle 20 tofino 943 987-501-tx\/tx firmware (high 7.5)
- [CVE-2021-30064](https://insights.sbomify.com/CVE-2021-30064/): Hardcoded credentials in belden:eagle 20 tofino 943 987-501-tx\/tx firmware (critical 9.8)
- [CVE-2021-30063](https://insights.sbomify.com/CVE-2021-30063/): Denial of service in belden:eagle 20 tofino 943 987-501-tx\/tx firmware (high 7.5)
- [CVE-2021-30062](https://insights.sbomify.com/CVE-2021-30062/): Security feature bypass in belden:eagle 20 tofino 943 987-501-tx\/tx firmware (high 7.5)
- [CVE-2021-30061](https://insights.sbomify.com/CVE-2021-30061/): Code injection in belden:eagle 20 tofino 943 987-501-tx\/tx firmware (medium 6.8)
- [CVE-2021-3006](https://insights.sbomify.com/CVE-2021-3006/): Missing authorization in seal finance project:seal finance (high 7.5)
- [CVE-2021-30058](https://insights.sbomify.com/CVE-2021-30058/): Cross-site scripting in eng:knowage (medium 6.1)
- [CVE-2021-30057](https://insights.sbomify.com/CVE-2021-30057/): Cross-site scripting in eng:knowage (medium 4.8)
- [CVE-2021-30056](https://insights.sbomify.com/CVE-2021-30056/): Cross-site scripting in eng:knowage (medium 5.4)
- [CVE-2021-30055](https://insights.sbomify.com/CVE-2021-30055/): SQL injection in eng:knowage (high 8.8)
- [CVE-2021-3005](https://insights.sbomify.com/CVE-2021-3005/): Information disclosure in mk-auth:mk-auth (medium 4.3)
- [CVE-2021-30049](https://insights.sbomify.com/CVE-2021-30049/): Cross-site scripting in sysaid:sysaid (medium 6.1)
- [CVE-2021-30048](https://insights.sbomify.com/CVE-2021-30048/): Path traversal in novel boutique house-plus project:novel boutique house-plus (medium 5.3)
- [CVE-2021-30047](https://insights.sbomify.com/CVE-2021-30047/): Denial of service in vsftpd project:vsftpd (high 7.5)
- [CVE-2021-30046](https://insights.sbomify.com/CVE-2021-30046/): Denial of service in vigra computer vision library project:vigra computer vision library (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/173/