# Vulnerabilities published in 2021


- [CVE-2021-29421](https://insights.sbomify.com/CVE-2021-29421/): Improper Restriction of XML External Entity Reference in pikepdf (high 7.5)
- [CVE-2021-29418](https://insights.sbomify.com/CVE-2021-29418/): Security feature bypass in netmask project:netmask (medium 5.3)
- [CVE-2021-29417](https://insights.sbomify.com/CVE-2021-29417/): gitjacker arbitrary code execution (critical 9.8)
- [CVE-2021-29416](https://insights.sbomify.com/CVE-2021-29416/): Server-side request forgery in portswigger:burp suite (medium 6.5)
- [CVE-2021-29415](https://insights.sbomify.com/CVE-2021-29415/): Weak cryptography in nordicsemi:nrf52840 firmware (medium 5.5)
- [CVE-2021-29414](https://insights.sbomify.com/CVE-2021-29414/): Security feature bypass in st:stm32cubel4 firmware (medium 6.1)
- [CVE-2021-29400](https://insights.sbomify.com/CVE-2021-29400/): Cross-site request forgery in netexplorer:my smtp contact (medium 6.5)
- [CVE-2021-29399](https://insights.sbomify.com/CVE-2021-29399/): Cross-site scripting in xmbforum2:xmb (medium 6.1)
- [CVE-2021-29398](https://insights.sbomify.com/CVE-2021-29398/): Path traversal in globalnorthstar:northstar club management (medium 5.3)
- [CVE-2021-29397](https://insights.sbomify.com/CVE-2021-29397/): Information disclosure in globalnorthstar:northstar club management (high 7.5)
- [CVE-2021-29396](https://insights.sbomify.com/CVE-2021-29396/): Missing authorization in globalnorthstar:northstar club management (critical 9.8)
- [CVE-2021-29395](https://insights.sbomify.com/CVE-2021-29395/): Path traversal in globalnorthstar:northstar club management (high 7.5)
- [CVE-2021-29394](https://insights.sbomify.com/CVE-2021-29394/): Missing authorization in globalnorthstar:northstar club management (medium 6.5)
- [CVE-2021-29393](https://insights.sbomify.com/CVE-2021-29393/): Command injection in globalnorthstar:northstar club management (critical 9.8)
- [CVE-2021-29390](https://insights.sbomify.com/CVE-2021-29390/): Memory corruption in fedoraproject:fedora (high 7.1)
- [CVE-2021-29388](https://insights.sbomify.com/CVE-2021-29388/): Cross-site scripting in budget management system project:budget management system (medium 5.4)
- [CVE-2021-29387](https://insights.sbomify.com/CVE-2021-29387/): Cross-site scripting in equipment inventory system project:equipment inventory system (medium 5.4)
- [CVE-2021-29379](https://insights.sbomify.com/CVE-2021-29379/): Command injection in dlink:dir-802 firmware (high 8.8)
- [CVE-2021-29378](https://insights.sbomify.com/CVE-2021-29378/): SQL injection in pearadmin:pear admin think (high 8.8)
- [CVE-2021-29377](https://insights.sbomify.com/CVE-2021-29377/): File upload in pearadmin:pearadmin think (critical 9.8)
- [CVE-2021-29376](https://insights.sbomify.com/CVE-2021-29376/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-29370](https://insights.sbomify.com/CVE-2021-29370/): Cross-site scripting in cheetah browser project:cheetah browser (medium 6.1)
- [CVE-2021-29369](https://insights.sbomify.com/CVE-2021-29369/): Code injection in @rkesters/gnuplot (critical 9.8)
- [CVE-2021-29368](https://insights.sbomify.com/CVE-2021-29368/): Auth bypass in cuppacms:cuppacms (high 8.8)
- [CVE-2021-29367](https://insights.sbomify.com/CVE-2021-29367/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2021-29366](https://insights.sbomify.com/CVE-2021-29366/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2021-29365](https://insights.sbomify.com/CVE-2021-29365/): Denial of service in irfanview:irfanview (medium 5.5)
- [CVE-2021-29364](https://insights.sbomify.com/CVE-2021-29364/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2021-29363](https://insights.sbomify.com/CVE-2021-29363/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2021-29362](https://insights.sbomify.com/CVE-2021-29362/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2021-29361](https://insights.sbomify.com/CVE-2021-29361/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2021-29360](https://insights.sbomify.com/CVE-2021-29360/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2021-29358](https://insights.sbomify.com/CVE-2021-29358/): Memory corruption in irfanview:irfanview (medium 5.5)
- [CVE-2021-29357](https://insights.sbomify.com/CVE-2021-29357/): Server-side request forgery in outsystems:lifetime management console (high 8.6)
- [CVE-2021-29350](https://insights.sbomify.com/CVE-2021-29350/): SQL injection in shipment 100-design material download system project:shipment 100-design material download system (high 7.2)
- [CVE-2021-29349](https://insights.sbomify.com/CVE-2021-29349/): Cross-site request forgery in mahara:mahara (medium 6.5)
- [CVE-2021-29343](https://insights.sbomify.com/CVE-2021-29343/): SQL injection in ovidentia:ovidentia (medium 5.4)
- [CVE-2021-29338](https://insights.sbomify.com/CVE-2021-29338/): Integer overflow in debian:debian linux (medium 5.5)
- [CVE-2021-29337](https://insights.sbomify.com/CVE-2021-29337/): Privilege escalation in msi:dragon center (high 7.8)
- [CVE-2021-29334](https://insights.sbomify.com/CVE-2021-29334/): Cross-site request forgery in jizhicms:jizhicms (high 8.8)
- [CVE-2021-29329](https://insights.sbomify.com/CVE-2021-29329/): Memory corruption in moddable:moddable (high 7.8)
- [CVE-2021-29328](https://insights.sbomify.com/CVE-2021-29328/): Memory corruption in moddable:moddable (high 7.1)
- [CVE-2021-29327](https://insights.sbomify.com/CVE-2021-29327/): Memory corruption in moddable:moddable (high 7.8)
- [CVE-2021-29326](https://insights.sbomify.com/CVE-2021-29326/): Memory corruption in moddable:moddable (high 7.8)
- [CVE-2021-29325](https://insights.sbomify.com/CVE-2021-29325/): Memory corruption in moddable:moddable (high 7.8)
- [CVE-2021-29324](https://insights.sbomify.com/CVE-2021-29324/): Memory corruption in moddable:moddable (high 7.8)
- [CVE-2021-29323](https://insights.sbomify.com/CVE-2021-29323/): Memory corruption in moddable:moddable (medium 5.5)
- [CVE-2021-29313](https://insights.sbomify.com/CVE-2021-29313/): Cross-site scripting in seacms:seacms (medium 6.1)
- [CVE-2021-29302](https://insights.sbomify.com/CVE-2021-29302/): Memory corruption in tp-link:tl-wr802n firmware (high 8.1)
- [CVE-2021-29300](https://insights.sbomify.com/CVE-2021-29300/): Command Injection in @ronomon/opened (critical 9.8)
- [CVE-2021-29298](https://insights.sbomify.com/CVE-2021-29298/): Denial of service in emerson:proficy machine edition (medium 5.3)
- [CVE-2021-29297](https://insights.sbomify.com/CVE-2021-29297/): Memory corruption in emerson:proficy machine edition (medium 5.3)
- [CVE-2021-29296](https://insights.sbomify.com/CVE-2021-29296/): Null dereference in dlink:dir-825 firmware (high 7.5)
- [CVE-2021-29295](https://insights.sbomify.com/CVE-2021-29295/): Null dereference in dlink:dsp-w215 firmware (high 7.5)
- [CVE-2021-29294](https://insights.sbomify.com/CVE-2021-29294/): Null dereference in dlink:dsl-2740r firmware (high 7.5)
- [CVE-2021-29281](https://insights.sbomify.com/CVE-2021-29281/): File upload in gfi:archiver (critical 9.8)
- [CVE-2021-29280](https://insights.sbomify.com/CVE-2021-29280/): Memory corruption in tp-link:tl-wr840n firmware (medium 6.4)
- [CVE-2021-29279](https://insights.sbomify.com/CVE-2021-29279/): Integer overflow in gpac:gpac (high 7.8)
- [CVE-2021-29274](https://insights.sbomify.com/CVE-2021-29274/): Cross-site scripting in redmine:redmine (medium 6.1)
- [CVE-2021-29272](https://insights.sbomify.com/CVE-2021-29272/): Cross-site scripting in bluemonday (medium 6.1)
- [CVE-2021-29271](https://insights.sbomify.com/CVE-2021-29271/): Cross-site scripting in remark42:remark42 (medium 6.1)
- [CVE-2021-29267](https://insights.sbomify.com/CVE-2021-29267/): Cross-site scripting in sherlockim:sherlockim (medium 6.1)
- [CVE-2021-29266](https://insights.sbomify.com/CVE-2021-29266/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2021-29265](https://insights.sbomify.com/CVE-2021-29265/): Race condition in debian:debian linux (medium 4.7)
- [CVE-2021-29264](https://insights.sbomify.com/CVE-2021-29264/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2021-29263](https://insights.sbomify.com/CVE-2021-29263/): Code injection in jetbrains:intellij idea (high 7.8)
- [CVE-2021-29262](https://insights.sbomify.com/CVE-2021-29262/): Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings (high 7.5)
- [CVE-2021-29261](https://insights.sbomify.com/CVE-2021-29261/): Code injection in svelte:svelte (high 7.8)
- [CVE-2021-29258](https://insights.sbomify.com/CVE-2021-29258/): Denial of service in envoyproxy:envoy (high 7.5)
- [CVE-2021-29256](https://insights.sbomify.com/CVE-2021-29256/): Arm Mali GPU Kernel Driver Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2021-29255](https://insights.sbomify.com/CVE-2021-29255/): Information disclosure in microseven:mym71080i-b firmware (high 7.5)
- [CVE-2021-29253](https://insights.sbomify.com/CVE-2021-29253/): Information disclosure in rsa:archer (medium 5.1)
- [CVE-2021-29252](https://insights.sbomify.com/CVE-2021-29252/): Cross-site scripting in rsa:archer (medium 5.4)
- [CVE-2021-29251](https://insights.sbomify.com/CVE-2021-29251/): Business logic in btcpayserver:btcpay server (medium 6.5)
- [CVE-2021-29250](https://insights.sbomify.com/CVE-2021-29250/): Cross-site scripting in btcpayserver:btcpay server (medium 5.4)
- [CVE-2021-29249](https://insights.sbomify.com/CVE-2021-29249/): Information disclosure in btcpayserver:btcpay server (high 7.5)
- [CVE-2021-29248](https://insights.sbomify.com/CVE-2021-29248/): Information disclosure in btcpayserver:btcpay server (medium 5.3)
- [CVE-2021-29247](https://insights.sbomify.com/CVE-2021-29247/): Misconfiguration in btcpayserver:btcpay server (medium 5.3)
- [CVE-2021-29246](https://insights.sbomify.com/CVE-2021-29246/): Path traversal in btcpayserver:btcpay server (medium 6.7)
- [CVE-2021-29245](https://insights.sbomify.com/CVE-2021-29245/): Weak cryptography in btcpayserver:btcpay server (medium 5.3)
- [CVE-2021-29243](https://insights.sbomify.com/CVE-2021-29243/): Cross-site scripting in cloudera:cloudera manager (medium 6.1)
- [CVE-2021-29242](https://insights.sbomify.com/CVE-2021-29242/): Other in codesys:control for beaglebone sl (high 7.3)
- [CVE-2021-29241](https://insights.sbomify.com/CVE-2021-29241/): Null dereference in codesys:control for beaglebone sl (high 7.5)
- [CVE-2021-29240](https://insights.sbomify.com/CVE-2021-29240/): Security feature bypass in codesys:development system (high 7.8)
- [CVE-2021-29239](https://insights.sbomify.com/CVE-2021-29239/): Security feature bypass in codesys:development system (high 7.8)
- [CVE-2021-29238](https://insights.sbomify.com/CVE-2021-29238/): Cross-site request forgery in codesys:automation server (high 8.8)
- [CVE-2021-29221](https://insights.sbomify.com/CVE-2021-29221/): Privilege escalation in Erlang/OTP (high 7.0)
- [CVE-2021-29220](https://insights.sbomify.com/CVE-2021-29220/): Memory corruption in iLO Amplifier Pack (high 7.2)
- [CVE-2021-29219](https://insights.sbomify.com/CVE-2021-29219/): Memory corruption in HPE FlexNetwork 5130 EI Switch Series (high 7.8)
- [CVE-2021-29218](https://insights.sbomify.com/CVE-2021-29218/): Privilege escalation in HPE Agentless Management (medium 6.7)
- [CVE-2021-29217](https://insights.sbomify.com/CVE-2021-29217/): Open redirect in HPE OneView Global Dashboard (medium 6.1)
- [CVE-2021-29216](https://insights.sbomify.com/CVE-2021-29216/): Cross-site scripting in HPE OneView Global Dashboard (medium 6.1)
- [CVE-2021-29215](https://insights.sbomify.com/CVE-2021-29215/): Security feature bypass in HPE Ezmeral Data Fabric (critical 9.8)
- [CVE-2021-29214](https://insights.sbomify.com/CVE-2021-29214/): Code injection in HPE StoreServ Management Console (SSMC); HPE 3PAR StoreServ Management and Core Software Media (high 7.2)
- [CVE-2021-29213](https://insights.sbomify.com/CVE-2021-29213/): Security feature bypass in HPE ProLiant ML30 Gen10 Server; HPE ProLiant DL20 Gen10 Server; HPE ProLiant MicroServer Gen10 Plus (medium 6.7)
- [CVE-2021-29212](https://insights.sbomify.com/CVE-2021-29212/): Path traversal in iLO Amplifier Pack (critical 9.8)
- [CVE-2021-29211](https://insights.sbomify.com/CVE-2021-29211/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29210](https://insights.sbomify.com/CVE-2021-29210/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29209](https://insights.sbomify.com/CVE-2021-29209/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29208](https://insights.sbomify.com/CVE-2021-29208/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/179/