# Vulnerabilities published in 2021


- [CVE-2021-28398](https://insights.sbomify.com/CVE-2021-28398/): Command injection in osgeo:geonetwork (high 7.2)
- [CVE-2021-28382](https://insights.sbomify.com/CVE-2021-28382/): Cross-site scripting in zohocorp:manageengine key manager plus (medium 5.4)
- [CVE-2021-28381](https://insights.sbomify.com/CVE-2021-28381/): SQL injection in vhs (aka VHS: Fluid ViewHelpers) (critical 9.8)
- [CVE-2021-28380](https://insights.sbomify.com/CVE-2021-28380/): Aimeos Typo3 extension contains Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2021-28379](https://insights.sbomify.com/CVE-2021-28379/): File upload in myvestacp:myvesta (high 8.8)
- [CVE-2021-28378](https://insights.sbomify.com/CVE-2021-28378/): Cross-site Scripting in Gitea (low 3.7)
- [CVE-2021-28377](https://insights.sbomify.com/CVE-2021-28377/): Path traversal in chronoengine:chronoforums (medium 5.3)
- [CVE-2021-28376](https://insights.sbomify.com/CVE-2021-28376/): Path traversal in chronoengine:chronoforums (low 2.7)
- [CVE-2021-28375](https://insights.sbomify.com/CVE-2021-28375/): Missing authorization in fedoraproject:fedora (high 7.8)
- [CVE-2021-28374](https://insights.sbomify.com/CVE-2021-28374/): Misconfiguration in debian:courier-authlib (high 7.5)
- [CVE-2021-28373](https://insights.sbomify.com/CVE-2021-28373/): Auth bypass in tt-rss:tiny tiny rss (high 7.5)
- [CVE-2021-28372](https://insights.sbomify.com/CVE-2021-28372/): Auth bypass in throughtek:kalay p2p software development kit (high 8.3)
- [CVE-2021-28363](https://insights.sbomify.com/CVE-2021-28363/): Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection (medium 6.5)
- [CVE-2021-28362](https://insights.sbomify.com/CVE-2021-28362/): Integer overflow in contiki-os:contiki (high 7.5)
- [CVE-2021-28361](https://insights.sbomify.com/CVE-2021-28361/): Null dereference in spdk:storage performance development kit (high 7.5)
- [CVE-2021-28359](https://insights.sbomify.com/CVE-2021-28359/): Apache Airflow Reflected XSS via Origin Query Argument in URL (medium 6.1)
- [CVE-2021-28358](https://insights.sbomify.com/CVE-2021-28358/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28357](https://insights.sbomify.com/CVE-2021-28357/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28356](https://insights.sbomify.com/CVE-2021-28356/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28355](https://insights.sbomify.com/CVE-2021-28355/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28354](https://insights.sbomify.com/CVE-2021-28354/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28353](https://insights.sbomify.com/CVE-2021-28353/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28352](https://insights.sbomify.com/CVE-2021-28352/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28351](https://insights.sbomify.com/CVE-2021-28351/): Windows Speech Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-28350](https://insights.sbomify.com/CVE-2021-28350/): Windows GDI+ Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-28349](https://insights.sbomify.com/CVE-2021-28349/): Windows GDI+ Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-28348](https://insights.sbomify.com/CVE-2021-28348/): Windows GDI+ Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-28347](https://insights.sbomify.com/CVE-2021-28347/): Windows Speech Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-28346](https://insights.sbomify.com/CVE-2021-28346/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28345](https://insights.sbomify.com/CVE-2021-28345/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28344](https://insights.sbomify.com/CVE-2021-28344/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28343](https://insights.sbomify.com/CVE-2021-28343/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28342](https://insights.sbomify.com/CVE-2021-28342/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28341](https://insights.sbomify.com/CVE-2021-28341/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28340](https://insights.sbomify.com/CVE-2021-28340/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28339](https://insights.sbomify.com/CVE-2021-28339/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28338](https://insights.sbomify.com/CVE-2021-28338/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28337](https://insights.sbomify.com/CVE-2021-28337/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28336](https://insights.sbomify.com/CVE-2021-28336/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28335](https://insights.sbomify.com/CVE-2021-28335/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28334](https://insights.sbomify.com/CVE-2021-28334/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28333](https://insights.sbomify.com/CVE-2021-28333/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28332](https://insights.sbomify.com/CVE-2021-28332/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28331](https://insights.sbomify.com/CVE-2021-28331/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28330](https://insights.sbomify.com/CVE-2021-28330/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28329](https://insights.sbomify.com/CVE-2021-28329/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28328](https://insights.sbomify.com/CVE-2021-28328/): Windows DNS Information Disclosure Vulnerability (medium 6.5)
- [CVE-2021-28327](https://insights.sbomify.com/CVE-2021-28327/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-28326](https://insights.sbomify.com/CVE-2021-28326/): Windows AppX Deployment Server Denial of Service Vulnerability (medium 5.5)
- [CVE-2021-28325](https://insights.sbomify.com/CVE-2021-28325/): Windows SMB Information Disclosure Vulnerability (medium 6.5)
- [CVE-2021-28324](https://insights.sbomify.com/CVE-2021-28324/): Windows SMB Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-28323](https://insights.sbomify.com/CVE-2021-28323/): Windows DNS Information Disclosure Vulnerability (medium 6.5)
- [CVE-2021-28322](https://insights.sbomify.com/CVE-2021-28322/): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-28321](https://insights.sbomify.com/CVE-2021-28321/): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-28320](https://insights.sbomify.com/CVE-2021-28320/): Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-28319](https://insights.sbomify.com/CVE-2021-28319/): Windows TCP/IP Driver Denial of Service Vulnerability (high 7.5)
- [CVE-2021-28318](https://insights.sbomify.com/CVE-2021-28318/): Windows GDI+ Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-28317](https://insights.sbomify.com/CVE-2021-28317/): Microsoft Windows Codecs Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-28316](https://insights.sbomify.com/CVE-2021-28316/): Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability (medium 4.2)
- [CVE-2021-28315](https://insights.sbomify.com/CVE-2021-28315/): Windows Media Video Decoder Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-28314](https://insights.sbomify.com/CVE-2021-28314/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-28313](https://insights.sbomify.com/CVE-2021-28313/): Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-28312](https://insights.sbomify.com/CVE-2021-28312/): Windows NTFS Denial of Service Vulnerability (low 3.3)
- [CVE-2021-28311](https://insights.sbomify.com/CVE-2021-28311/): Windows Application Compatibility Cache Denial of Service Vulnerability (medium 6.5)
- [CVE-2021-28310](https://insights.sbomify.com/CVE-2021-28310/): Microsoft Win32k Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2021-28309](https://insights.sbomify.com/CVE-2021-28309/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-28308](https://insights.sbomify.com/CVE-2021-28308/): Memory corruption in fltk project:fltk (critical 9.1)
- [CVE-2021-28307](https://insights.sbomify.com/CVE-2021-28307/): Null dereference in fltk project:fltk (high 7.5)
- [CVE-2021-28306](https://insights.sbomify.com/CVE-2021-28306/): Null dereference in fltk project:fltk (high 7.5)
- [CVE-2021-28305](https://insights.sbomify.com/CVE-2021-28305/): Fix a use-after-free bug in diesels Sqlite backend (critical 9.8)
- [CVE-2021-28302](https://insights.sbomify.com/CVE-2021-28302/): Denial of service in pupnp project:pupnp (high 7.5)
- [CVE-2021-28300](https://insights.sbomify.com/CVE-2021-28300/): Null dereference in gpac:gpac (critical 9.8)
- [CVE-2021-28295](https://insights.sbomify.com/CVE-2021-28295/): SQL injection in online ordering system project:online ordering system (high 7.5)
- [CVE-2021-28294](https://insights.sbomify.com/CVE-2021-28294/): File upload in online ordering system project:online ordering system (critical 9.8)
- [CVE-2021-28293](https://insights.sbomify.com/CVE-2021-28293/): Auth bypass in seceon:aisiem (critical 9.8)
- [CVE-2021-28290](https://insights.sbomify.com/CVE-2021-28290/): Cross-site scripting in identityserver4.admin project:identityserver4.admin (medium 6.1)
- [CVE-2021-28280](https://insights.sbomify.com/CVE-2021-28280/): Cross-site scripting in php-fusion:phpfusion (medium 6.1)
- [CVE-2021-28278](https://insights.sbomify.com/CVE-2021-28278/): Memory corruption in jhead project:jhead (high 7.8)
- [CVE-2021-28277](https://insights.sbomify.com/CVE-2021-28277/): Memory corruption in jhead project:jhead (high 7.8)
- [CVE-2021-28276](https://insights.sbomify.com/CVE-2021-28276/): Memory corruption in jhead project:jhead (high 7.5)
- [CVE-2021-28275](https://insights.sbomify.com/CVE-2021-28275/): Memory corruption in jhead project:jhead (medium 5.5)
- [CVE-2021-28271](https://insights.sbomify.com/CVE-2021-28271/): Privilege escalation in soyal:701clientsql (high 8.8)
- [CVE-2021-28269](https://insights.sbomify.com/CVE-2021-28269/): Misconfiguration in soyal:701client (high 8.8)
- [CVE-2021-28254](https://insights.sbomify.com/CVE-2021-28254/): Deserialization in laravel:laravel (critical 9.8)
- [CVE-2021-28250](https://insights.sbomify.com/CVE-2021-28250/): Privilege escalation in ca:ehealth performance manager (high 7.8)
- [CVE-2021-28249](https://insights.sbomify.com/CVE-2021-28249/): Privilege escalation in ca:ehealth performance manager (high 8.8)
- [CVE-2021-28248](https://insights.sbomify.com/CVE-2021-28248/): Auth bypass in broadcom:ehealth (high 7.5)
- [CVE-2021-28247](https://insights.sbomify.com/CVE-2021-28247/): Cross-site scripting in ca:ehealth performance manager (medium 5.4)
- [CVE-2021-28246](https://insights.sbomify.com/CVE-2021-28246/): Privilege escalation in broadcom:ehealth (high 7.8)
- [CVE-2021-28245](https://insights.sbomify.com/CVE-2021-28245/): SQL injection in pbootcms:pbootcms (high 7.5)
- [CVE-2021-28242](https://insights.sbomify.com/CVE-2021-28242/): SQL injection in b2evolution:b2evolution (high 8.8)
- [CVE-2021-28237](https://insights.sbomify.com/CVE-2021-28237/): Memory corruption in gnu:libredwg (critical 9.8)
- [CVE-2021-28236](https://insights.sbomify.com/CVE-2021-28236/): Null dereference in gnu:libredwg (high 7.5)
- [CVE-2021-28235](https://insights.sbomify.com/CVE-2021-28235/): Etcd-io Improper Authentication vulnerability (critical 9.8)
- [CVE-2021-28233](https://insights.sbomify.com/CVE-2021-28233/): Memory corruption in ok-file-formats project:ok-file-formats (high 8.8)
- [CVE-2021-28216](https://insights.sbomify.com/CVE-2021-28216/): Memory corruption in EDK II (high 7.8)
- [CVE-2021-28213](https://insights.sbomify.com/CVE-2021-28213/): Hardcoded credentials in EDK II (high 7.5)
- [CVE-2021-28211](https://insights.sbomify.com/CVE-2021-28211/): Memory corruption in EDK II (medium 6.7)
- [CVE-2021-28210](https://insights.sbomify.com/CVE-2021-28210/): Denial of service in EDK II (high 7.8)
- [CVE-2021-28209](https://insights.sbomify.com/CVE-2021-28209/): ASUS BMC's firmware: path traversal - Delete video file function (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/185/