# Vulnerabilities published in 2021


- [CVE-2021-29047](https://insights.sbomify.com/CVE-2021-29047/): Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use (high 7.5)
- [CVE-2021-29046](https://insights.sbomify.com/CVE-2021-29046/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module Parameter (medium 6.1)
- [CVE-2021-29045](https://insights.sbomify.com/CVE-2021-29045/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin Page (medium 6.1)
- [CVE-2021-29044](https://insights.sbomify.com/CVE-2021-29044/): Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page (medium 6.1)
- [CVE-2021-29043](https://insights.sbomify.com/CVE-2021-29043/): Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password (medium 5.9)
- [CVE-2021-29041](https://insights.sbomify.com/CVE-2021-29041/): Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication Module (medium 6.5)
- [CVE-2021-29040](https://insights.sbomify.com/CVE-2021-29040/): Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages (medium 5.3)
- [CVE-2021-29039](https://insights.sbomify.com/CVE-2021-29039/): Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page (medium 6.1)
- [CVE-2021-29038](https://insights.sbomify.com/CVE-2021-29038/): Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers (medium 6.3)
- [CVE-2021-29033](https://insights.sbomify.com/CVE-2021-29033/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29032](https://insights.sbomify.com/CVE-2021-29032/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29031](https://insights.sbomify.com/CVE-2021-29031/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29030](https://insights.sbomify.com/CVE-2021-29030/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29029](https://insights.sbomify.com/CVE-2021-29029/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29028](https://insights.sbomify.com/CVE-2021-29028/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29027](https://insights.sbomify.com/CVE-2021-29027/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29026](https://insights.sbomify.com/CVE-2021-29026/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29025](https://insights.sbomify.com/CVE-2021-29025/): Cross-site scripting in bitweaver:bitweaver (medium 4.8)
- [CVE-2021-29024](https://insights.sbomify.com/CVE-2021-29024/): Misconfiguration in invoiceplane:invoiceplane (high 7.5)
- [CVE-2021-29023](https://insights.sbomify.com/CVE-2021-29023/): Weak cryptography in invoiceplane:invoiceplane (medium 5.3)
- [CVE-2021-29022](https://insights.sbomify.com/CVE-2021-29022/): Information disclosure in invoiceplane:invoiceplane (medium 5.3)
- [CVE-2021-29012](https://insights.sbomify.com/CVE-2021-29012/): Auth bypass in dmasoftlab:dma radius manager (critical 9.8)
- [CVE-2021-29011](https://insights.sbomify.com/CVE-2021-29011/): Cross-site scripting in dmasoftlab:dma radius manager (medium 6.1)
- [CVE-2021-29010](https://insights.sbomify.com/CVE-2021-29010/): Cross-site scripting in seopanel:seo panel (medium 4.8)
- [CVE-2021-29009](https://insights.sbomify.com/CVE-2021-29009/): Cross-site scripting in seopanel:seo panel (medium 4.8)
- [CVE-2021-29008](https://insights.sbomify.com/CVE-2021-29008/): Cross-site scripting in seopanel:seo panel (medium 4.8)
- [CVE-2021-29006](https://insights.sbomify.com/CVE-2021-29006/): Path traversal in rconfig:rconfig (medium 6.5)
- [CVE-2021-29005](https://insights.sbomify.com/CVE-2021-29005/): Privilege escalation in rconfig:rconfig (high 8.8)
- [CVE-2021-29004](https://insights.sbomify.com/CVE-2021-29004/): SQL injection in rconfig:rconfig (high 8.8)
- [CVE-2021-29003](https://insights.sbomify.com/CVE-2021-29003/): Command injection in genexis:platinum 4410 firmware (critical 9.8)
- [CVE-2021-29002](https://insights.sbomify.com/CVE-2021-29002/): Plone XSS Vulnerability (medium 5.4)
- [CVE-2021-28999](https://insights.sbomify.com/CVE-2021-28999/): SQL injection in cmsmadesimple:cms made simple (high 8.8)
- [CVE-2021-28998](https://insights.sbomify.com/CVE-2021-28998/): File upload in cmsmadesimple:cms made simple (high 7.2)
- [CVE-2021-28994](https://insights.sbomify.com/CVE-2021-28994/): Denial of service in kopano:groupware core (high 7.5)
- [CVE-2021-28993](https://insights.sbomify.com/CVE-2021-28993/): SQL injection in plixer:scrutinizer (high 7.5)
- [CVE-2021-28979](https://insights.sbomify.com/CVE-2021-28979/): Other in thalesgroup:safenet keysecure (medium 6.5)
- [CVE-2021-28977](https://insights.sbomify.com/CVE-2021-28977/): Cross-site scripting in get-simple:getsimplecms (medium 4.8)
- [CVE-2021-28976](https://insights.sbomify.com/CVE-2021-28976/): File upload in get-simple:getsimplecms (high 7.2)
- [CVE-2021-28975](https://insights.sbomify.com/CVE-2021-28975/): Cross-site scripting in wpmailster:wp mailster (medium 6.1)
- [CVE-2021-28973](https://insights.sbomify.com/CVE-2021-28973/): XML external entity in perforce:helix alm (medium 4.9)
- [CVE-2021-28972](https://insights.sbomify.com/CVE-2021-28972/): Memory corruption in fedoraproject:fedora (medium 6.7)
- [CVE-2021-28971](https://insights.sbomify.com/CVE-2021-28971/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2021-28970](https://insights.sbomify.com/CVE-2021-28970/): SQL injection in fireeye:email malware protection system (medium 6.5)
- [CVE-2021-28969](https://insights.sbomify.com/CVE-2021-28969/): SQL injection in fireeye:email malware protection system (medium 6.5)
- [CVE-2021-28968](https://insights.sbomify.com/CVE-2021-28968/): Cross-site scripting in gnu:punbb (medium 5.4)
- [CVE-2021-28967](https://insights.sbomify.com/CVE-2021-28967/): Code injection in gimly:matlab (critical 9.8)
- [CVE-2021-28966](https://insights.sbomify.com/CVE-2021-28966/): Tempfile on Windows path traversal vulnerability (high 7.5)
- [CVE-2021-28965](https://insights.sbomify.com/CVE-2021-28965/): REXML round-trip instability (high 7.5)
- [CVE-2021-28964](https://insights.sbomify.com/CVE-2021-28964/): Race condition in debian:debian linux (medium 4.7)
- [CVE-2021-28963](https://insights.sbomify.com/CVE-2021-28963/): Code injection in debian:debian linux (medium 5.3)
- [CVE-2021-28962](https://insights.sbomify.com/CVE-2021-28962/): Privilege escalation in stormshield:stormshield network security (high 7.2)
- [CVE-2021-28961](https://insights.sbomify.com/CVE-2021-28961/): Command injection in openwrt:openwrt (high 8.8)
- [CVE-2021-28960](https://insights.sbomify.com/CVE-2021-28960/): Command injection in manageengine:desktop central (critical 9.8)
- [CVE-2021-28959](https://insights.sbomify.com/CVE-2021-28959/): Path traversal in zohocorp:manageengine eventlog analyzer (critical 9.8)
- [CVE-2021-28958](https://insights.sbomify.com/CVE-2021-28958/): Command injection in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2021-28957](https://insights.sbomify.com/CVE-2021-28957/): lxml vulnerable to Cross-Site Scripting (medium 6.1)
- [CVE-2021-28956](https://insights.sbomify.com/CVE-2021-28956/): Code injection in sass lint project:sass lint (high 8.8)
- [CVE-2021-28955](https://insights.sbomify.com/CVE-2021-28955/): Arbitrary code execution due to an uncontrolled search path for the git binary (critical 9.8)
- [CVE-2021-28954](https://insights.sbomify.com/CVE-2021-28954/): Code injection in bit project:bit (high 7.8)
- [CVE-2021-28953](https://insights.sbomify.com/CVE-2021-28953/): Code injection in c\/c\+\+ advanced lint project:c\/c\+\+ advanced lint (high 7.8)
- [CVE-2021-28952](https://insights.sbomify.com/CVE-2021-28952/): Memory corruption in fedoraproject:fedora (high 7.8)
- [CVE-2021-28951](https://insights.sbomify.com/CVE-2021-28951/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2021-28950](https://insights.sbomify.com/CVE-2021-28950/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2021-28941](https://insights.sbomify.com/CVE-2021-28941/): Server-side request forgery in magpierss project:magpierss (medium 5.3)
- [CVE-2021-28940](https://insights.sbomify.com/CVE-2021-28940/): Command injection in magpierss project:magpierss (critical 9.8)
- [CVE-2021-28938](https://insights.sbomify.com/CVE-2021-28938/): Information disclosure in siren:federate (medium 4.3)
- [CVE-2021-28937](https://insights.sbomify.com/CVE-2021-28937/): Information disclosure in acexy:wireless-n wifi repeater firmware (high 7.5)
- [CVE-2021-28936](https://insights.sbomify.com/CVE-2021-28936/): Auth bypass in acexy:wireless-n wifi repeater firmware (high 7.5)
- [CVE-2021-28935](https://insights.sbomify.com/CVE-2021-28935/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2021-28931](https://insights.sbomify.com/CVE-2021-28931/): Arbitrary file upload in Fork CMS (high 8.8)
- [CVE-2021-28927](https://insights.sbomify.com/CVE-2021-28927/): Command injection in libretro:retroarch (high 7.8)
- [CVE-2021-28925](https://insights.sbomify.com/CVE-2021-28925/): SQL injection in nagios:network analyzer (critical 9.8)
- [CVE-2021-28924](https://insights.sbomify.com/CVE-2021-28924/): Cross-site scripting in nagios:network analyzer (medium 6.1)
- [CVE-2021-28918](https://insights.sbomify.com/CVE-2021-28918/): Security feature bypass in netmask project:netmask (critical 9.1)
- [CVE-2021-28914](https://insights.sbomify.com/CVE-2021-28914/): Security feature bypass in bab-technologie:eibport firmware (medium 6.5)
- [CVE-2021-28913](https://insights.sbomify.com/CVE-2021-28913/): Hardcoded credentials in bab-technologie:eibport firmware (critical 9.8)
- [CVE-2021-28912](https://insights.sbomify.com/CVE-2021-28912/): Hardcoded credentials in bab-technologie:eibport firmware (high 7.2)
- [CVE-2021-28911](https://insights.sbomify.com/CVE-2021-28911/): Information disclosure in bab-technologie:eibport firmware (critical 9.8)
- [CVE-2021-28910](https://insights.sbomify.com/CVE-2021-28910/): Server-side request forgery in bab-technologie:eibport firmware (high 7.5)
- [CVE-2021-28909](https://insights.sbomify.com/CVE-2021-28909/): Auth bypass in bab-technologie:eibport firmware (critical 9.8)
- [CVE-2021-28906](https://insights.sbomify.com/CVE-2021-28906/): Null dereference in cesnet:libyang (high 7.5)
- [CVE-2021-28905](https://insights.sbomify.com/CVE-2021-28905/): Denial of service in cesnet:libyang (high 7.5)
- [CVE-2021-28904](https://insights.sbomify.com/CVE-2021-28904/): Null dereference in cesnet:libyang (high 7.5)
- [CVE-2021-28903](https://insights.sbomify.com/CVE-2021-28903/): Denial of service in cesnet:libyang (high 7.5)
- [CVE-2021-28902](https://insights.sbomify.com/CVE-2021-28902/): Null dereference in cesnet:libyang (high 7.5)
- [CVE-2021-28901](https://insights.sbomify.com/CVE-2021-28901/): Cross-site scripting in sitasoftware:azurcms (medium 5.4)
- [CVE-2021-28899](https://insights.sbomify.com/CVE-2021-28899/): Other in live555:streaming media (high 7.5)
- [CVE-2021-28890](https://insights.sbomify.com/CVE-2021-28890/): SQL injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2021-28879](https://insights.sbomify.com/CVE-2021-28879/): Integer overflow in fedoraproject:fedora (critical 9.8)
- [CVE-2021-28878](https://insights.sbomify.com/CVE-2021-28878/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2021-28877](https://insights.sbomify.com/CVE-2021-28877/): Memory corruption in rust-lang:rust (high 7.5)
- [CVE-2021-28876](https://insights.sbomify.com/CVE-2021-28876/): Memory corruption in fedoraproject:fedora (medium 5.3)
- [CVE-2021-28875](https://insights.sbomify.com/CVE-2021-28875/): Memory corruption in rust-lang:rust (high 7.5)
- [CVE-2021-28874](https://insights.sbomify.com/CVE-2021-28874/): Memory corruption in serenityos:serenityos (high 7.8)
- [CVE-2021-28861](https://insights.sbomify.com/CVE-2021-28861/): Open redirect in fedoraproject:fedora (medium 6.5)
- [CVE-2021-28860](https://insights.sbomify.com/CVE-2021-28860/): Prototype Pollution in mixme (critical 9.1)
- [CVE-2021-28858](https://insights.sbomify.com/CVE-2021-28858/): Information disclosure in tp-link:tl-wpa4220 firmware (medium 5.5)
- [CVE-2021-28857](https://insights.sbomify.com/CVE-2021-28857/): Information disclosure in tp-link:tl-wpa4220 firmware (high 7.5)
- [CVE-2021-28856](https://insights.sbomify.com/CVE-2021-28856/): Denial of service in entropymine:deark (medium 5.5)
- [CVE-2021-28855](https://insights.sbomify.com/CVE-2021-28855/): Null dereference in entropymine:deark (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/181/