# Vulnerabilities published in 2021


- [CVE-2021-29207](https://insights.sbomify.com/CVE-2021-29207/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29206](https://insights.sbomify.com/CVE-2021-29206/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29205](https://insights.sbomify.com/CVE-2021-29205/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29204](https://insights.sbomify.com/CVE-2021-29204/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29203](https://insights.sbomify.com/CVE-2021-29203/): Auth bypass in HPE Edgeline Infrastructure Management Software (critical 9.8)
- [CVE-2021-29202](https://insights.sbomify.com/CVE-2021-29202/): Memory corruption in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 6.7)
- [CVE-2021-29201](https://insights.sbomify.com/CVE-2021-29201/): Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers (medium 4.8)
- [CVE-2021-29200](https://insights.sbomify.com/CVE-2021-29200/): RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI (critical 9.8)
- [CVE-2021-29159](https://insights.sbomify.com/CVE-2021-29159/): Cross-site scripting in sonatype:nexus repository manager (medium 6.1)
- [CVE-2021-29158](https://insights.sbomify.com/CVE-2021-29158/): Missing authorization in sonatype:nexus repository manager (medium 4.9)
- [CVE-2021-29157](https://insights.sbomify.com/CVE-2021-29157/): Path traversal in dovecot:dovecot (high 7.5)
- [CVE-2021-29156](https://insights.sbomify.com/CVE-2021-29156/): Other in forgerock:openam (high 7.5)
- [CVE-2021-29155](https://insights.sbomify.com/CVE-2021-29155/): Information disclosure in debian:debian linux (medium 5.5)
- [CVE-2021-29154](https://insights.sbomify.com/CVE-2021-29154/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-29152](https://insights.sbomify.com/CVE-2021-29152/): Denial of service in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2021-29151](https://insights.sbomify.com/CVE-2021-29151/): Auth bypass in Aruba ClearPass Policy Manager (medium 4.3)
- [CVE-2021-29150](https://insights.sbomify.com/CVE-2021-29150/): Deserialization in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-29149](https://insights.sbomify.com/CVE-2021-29149/): Security feature bypass in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series (medium 6.2)
- [CVE-2021-29148](https://insights.sbomify.com/CVE-2021-29148/): Cross-site scripting in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series (medium 6.1)
- [CVE-2021-29147](https://insights.sbomify.com/CVE-2021-29147/): Command injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2021-29146](https://insights.sbomify.com/CVE-2021-29146/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 5.4)
- [CVE-2021-29145](https://insights.sbomify.com/CVE-2021-29145/): Server-side request forgery in Aruba ClearPass Policy Manager (critical 9.8)
- [CVE-2021-29144](https://insights.sbomify.com/CVE-2021-29144/): Information disclosure in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2021-29143](https://insights.sbomify.com/CVE-2021-29143/): Command injection in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series (high 7.2)
- [CVE-2021-29142](https://insights.sbomify.com/CVE-2021-29142/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 4.8)
- [CVE-2021-29141](https://insights.sbomify.com/CVE-2021-29141/): Information disclosure in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2021-29140](https://insights.sbomify.com/CVE-2021-29140/): XML external entity in Aruba ClearPass Policy Manager (high 8.2)
- [CVE-2021-29139](https://insights.sbomify.com/CVE-2021-29139/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 4.8)
- [CVE-2021-29138](https://insights.sbomify.com/CVE-2021-29138/): Information disclosure in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2021-29137](https://insights.sbomify.com/CVE-2021-29137/): Open redirect in Aruba AirWave Management Platform (medium 6.1)
- [CVE-2021-29136](https://insights.sbomify.com/CVE-2021-29136/): Improper input validation in umoci (medium 5.5)
- [CVE-2021-29134](https://insights.sbomify.com/CVE-2021-29134/): Path Traversal in Gitea (medium 5.3)
- [CVE-2021-29133](https://insights.sbomify.com/CVE-2021-29133/): Path traversal in haserl project:haserl (medium 5.5)
- [CVE-2021-29118](https://insights.sbomify.com/CVE-2021-29118/): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-29117](https://insights.sbomify.com/CVE-2021-29117/): arcreader use-after-free (high 7.8)
- [CVE-2021-29116](https://insights.sbomify.com/CVE-2021-29116/): BUG-000142180 Hosted feature services vulnerable to stored XSS (medium 6.1)
- [CVE-2021-29115](https://insights.sbomify.com/CVE-2021-29115/): An information disclosure vulnerability (medium 5.3)
- [CVE-2021-29114](https://insights.sbomify.com/CVE-2021-29114/): SQL injection vulnerability in ArcGIS Server (high 7.3)
- [CVE-2021-29113](https://insights.sbomify.com/CVE-2021-29113/): Remote file inclusion vulnerability in ArcGIS Server help documentation (medium 4.7)
- [CVE-2021-29112](https://insights.sbomify.com/CVE-2021-29112/): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-29110](https://insights.sbomify.com/CVE-2021-29110/): Cross-site scripting in Portal for ArcGIS (medium 5.4)
- [CVE-2021-29109](https://insights.sbomify.com/CVE-2021-29109/): A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9. (medium 6.1)
- [CVE-2021-29108](https://insights.sbomify.com/CVE-2021-29108/): Auth bypass in Portal for ArcGIS (high 8.8)
- [CVE-2021-29107](https://insights.sbomify.com/CVE-2021-29107/): There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below. (medium 6.1)
- [CVE-2021-29106](https://insights.sbomify.com/CVE-2021-29106/): There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below. (medium 4.7)
- [CVE-2021-29105](https://insights.sbomify.com/CVE-2021-29105/): Cross-site scripting in ArcGIS Server (medium 5.4)
- [CVE-2021-29104](https://insights.sbomify.com/CVE-2021-29104/): There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below. (medium 6.1)
- [CVE-2021-29103](https://insights.sbomify.com/CVE-2021-29103/): There is a reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below. (medium 6.1)
- [CVE-2021-29102](https://insights.sbomify.com/CVE-2021-29102/): There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below. (critical 9.1)
- [CVE-2021-29101](https://insights.sbomify.com/CVE-2021-29101/): ArcGIS GeoEvent Server has a Directory Traversal security vulnerability. (high 8.6)
- [CVE-2021-29100](https://insights.sbomify.com/CVE-2021-29100/): ArcGIS Earth has a File Parsing Directory Traversal Vulnerability (high 7.8)
- [CVE-2021-29099](https://insights.sbomify.com/CVE-2021-29099/): There is a SQL injection vulnerability in ArcGIS Server (medium 5.3)
- [CVE-2021-29098](https://insights.sbomify.com/CVE-2021-29098/): ArcGIS general raster security update: uninitialized pointer (high 7.8)
- [CVE-2021-29097](https://insights.sbomify.com/CVE-2021-29097/): ArcGIS general raster security update: buffer overflow (high 7.8)
- [CVE-2021-29096](https://insights.sbomify.com/CVE-2021-29096/): ArcGIS general raster security update: use-after-free (high 7.8)
- [CVE-2021-29095](https://insights.sbomify.com/CVE-2021-29095/): ArcGIS Server image service and raster analytics security update: uninitialized pointer (medium 6.4)
- [CVE-2021-29094](https://insights.sbomify.com/CVE-2021-29094/): ArcGIS Server image service and raster analytics security update: buffer overflow (medium 6.4)
- [CVE-2021-29093](https://insights.sbomify.com/CVE-2021-29093/): ArcGIS Server image service and raster analytics security update: use-after-free (medium 6.4)
- [CVE-2021-29092](https://insights.sbomify.com/CVE-2021-29092/): File upload in Synology Photo Station (high 8.8)
- [CVE-2021-29091](https://insights.sbomify.com/CVE-2021-29091/): Path traversal in Synology Photo Station (high 7.7)
- [CVE-2021-29090](https://insights.sbomify.com/CVE-2021-29090/): SQL injection in Synology Photo Station (high 7.2)
- [CVE-2021-29089](https://insights.sbomify.com/CVE-2021-29089/): SQL injection in Synology Photo Station (critical 9.8)
- [CVE-2021-29088](https://insights.sbomify.com/CVE-2021-29088/): Path traversal in Synology DiskStation Manager (DSM) (high 7.8)
- [CVE-2021-29087](https://insights.sbomify.com/CVE-2021-29087/): Path traversal in DiskStation Manager (DSM) (high 7.5)
- [CVE-2021-29086](https://insights.sbomify.com/CVE-2021-29086/): Information disclosure in DiskStation Manager (DSM) (medium 5.3)
- [CVE-2021-29085](https://insights.sbomify.com/CVE-2021-29085/): Path traversal in DiskStation Manager (DSM) (high 8.6)
- [CVE-2021-29084](https://insights.sbomify.com/CVE-2021-29084/): Code injection in DiskStation Manager (DSM) (high 7.5)
- [CVE-2021-29083](https://insights.sbomify.com/CVE-2021-29083/): Command injection in Synology DiskStation Manager (DSM) (high 7.2)
- [CVE-2021-29082](https://insights.sbomify.com/CVE-2021-29082/): Information disclosure in netgear:rbk752 firmware (critical 9.6)
- [CVE-2021-29081](https://insights.sbomify.com/CVE-2021-29081/): Memory corruption in netgear:rbk752 firmware (high 8.4)
- [CVE-2021-29080](https://insights.sbomify.com/CVE-2021-29080/): Auth bypass in netgear:cbr40 firmware (high 8.1)
- [CVE-2021-29079](https://insights.sbomify.com/CVE-2021-29079/): Command injection in netgear:rbk852 firmware (critical 9.6)
- [CVE-2021-29078](https://insights.sbomify.com/CVE-2021-29078/): Command injection in netgear:rbk752 firmware (critical 9.6)
- [CVE-2021-29077](https://insights.sbomify.com/CVE-2021-29077/): Command injection in netgear:rbk752 firmware (critical 9.6)
- [CVE-2021-29076](https://insights.sbomify.com/CVE-2021-29076/): Command injection in netgear:rbk852 firmware (critical 9.6)
- [CVE-2021-29075](https://insights.sbomify.com/CVE-2021-29075/): Memory corruption in netgear:rbk752 firmware (high 8.4)
- [CVE-2021-29074](https://insights.sbomify.com/CVE-2021-29074/): Memory corruption in netgear:rbk752 firmware (high 8.4)
- [CVE-2021-29073](https://insights.sbomify.com/CVE-2021-29073/): Memory corruption in netgear:mk62 firmware (high 7.6)
- [CVE-2021-29072](https://insights.sbomify.com/CVE-2021-29072/): Command injection in netgear:rbk852 firmware (high 8.4)
- [CVE-2021-29071](https://insights.sbomify.com/CVE-2021-29071/): Command injection in netgear:rbk852 firmware (critical 9.6)
- [CVE-2021-29070](https://insights.sbomify.com/CVE-2021-29070/): Command injection in netgear:rbk852 firmware (high 8.4)
- [CVE-2021-29069](https://insights.sbomify.com/CVE-2021-29069/): Command injection in netgear:wnr2000v5 firmware (high 7.3)
- [CVE-2021-29068](https://insights.sbomify.com/CVE-2021-29068/): Memory corruption in netgear:ac2100 firmware (critical 9.9)
- [CVE-2021-29067](https://insights.sbomify.com/CVE-2021-29067/): Auth bypass in netgear:rbk752 firmware (critical 9.6)
- [CVE-2021-29066](https://insights.sbomify.com/CVE-2021-29066/): Auth bypass in netgear:rbk852 firmware (critical 9.6)
- [CVE-2021-29065](https://insights.sbomify.com/CVE-2021-29065/): Auth bypass in netgear:rbr850 firmware (critical 9.6)
- [CVE-2021-29063](https://insights.sbomify.com/CVE-2021-29063/): ReDOS in Mpmath (high 7.5)
- [CVE-2021-29061](https://insights.sbomify.com/CVE-2021-29061/): ReDOS in Vfsjfilechooser2 (high 7.5)
- [CVE-2021-29060](https://insights.sbomify.com/CVE-2021-29060/): Regular Expression Denial of Service (ReDOS) (medium 5.3)
- [CVE-2021-29059](https://insights.sbomify.com/CVE-2021-29059/): ReDOS in IS-SVG (high 7.5)
- [CVE-2021-29057](https://insights.sbomify.com/CVE-2021-29057/): SUCHMOKUO node-worker-threads-pool denial of service Vulnerability (medium 6.5)
- [CVE-2021-29056](https://insights.sbomify.com/CVE-2021-29056/): Cross-site scripting in pixelimity:pixelimity (medium 4.8)
- [CVE-2021-29055](https://insights.sbomify.com/CVE-2021-29055/): Cross-site scripting in school file management system project:school file management system (medium 6.1)
- [CVE-2021-29054](https://insights.sbomify.com/CVE-2021-29054/): Cross-site request forgery in papoo:papoo (high 8.8)
- [CVE-2021-29053](https://insights.sbomify.com/CVE-2021-29053/): Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections (high 8.8)
- [CVE-2021-29052](https://insights.sbomify.com/CVE-2021-29052/): Liferay Portal and Liferay DXP Fails to Check Permissions (medium 4.3)
- [CVE-2021-29051](https://insights.sbomify.com/CVE-2021-29051/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App (medium 6.1)
- [CVE-2021-29050](https://insights.sbomify.com/CVE-2021-29050/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page (high 8.8)
- [CVE-2021-29049](https://insights.sbomify.com/CVE-2021-29049/): Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL Parameter (medium 6.1)
- [CVE-2021-29048](https://insights.sbomify.com/CVE-2021-29048/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/180/