# Vulnerabilities published in 2021


- [CVE-2021-28208](https://insights.sbomify.com/CVE-2021-28208/): ASUS BMC's firmware: path traversal - Get video file function (medium 4.9)
- [CVE-2021-28207](https://insights.sbomify.com/CVE-2021-28207/): ASUS BMC's firmware: path traversal - Get Help file function (medium 4.9)
- [CVE-2021-28206](https://insights.sbomify.com/CVE-2021-28206/): ASUS BMC's firmware: path traversal - Record video file function (medium 4.9)
- [CVE-2021-28205](https://insights.sbomify.com/CVE-2021-28205/): ASUS BMC's firmware: path traversal - Delete SOL video file function (medium 4.9)
- [CVE-2021-28204](https://insights.sbomify.com/CVE-2021-28204/): ASUS BMC's firmware: command injection - Modify user’s information function (high 7.2)
- [CVE-2021-28203](https://insights.sbomify.com/CVE-2021-28203/): ASUS BMC's firmware: command injection - Web Set Media Image function (high 7.2)
- [CVE-2021-28202](https://insights.sbomify.com/CVE-2021-28202/): ASUS BMC's firmware: buffer overflow - Service configuration-2 function (medium 4.9)
- [CVE-2021-28201](https://insights.sbomify.com/CVE-2021-28201/): ASUS BMC's firmware: buffer overflow - Service configuration-1 function (medium 4.9)
- [CVE-2021-28200](https://insights.sbomify.com/CVE-2021-28200/): ASUS BMC's firmware: buffer overflow - CD media configuration function (medium 4.9)
- [CVE-2021-28199](https://insights.sbomify.com/CVE-2021-28199/): ASUS BMC's firmware: buffer overflow - Modify user’s information function (medium 4.9)
- [CVE-2021-28198](https://insights.sbomify.com/CVE-2021-28198/): ASUS BMC's firmware: buffer overflow - Firmware protocol configuration (medium 4.9)
- [CVE-2021-28197](https://insights.sbomify.com/CVE-2021-28197/): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (medium 4.9)
- [CVE-2021-28196](https://insights.sbomify.com/CVE-2021-28196/): ASUS BMC's firmware: buffer overflow - Generate SSL certificate function (medium 4.9)
- [CVE-2021-28195](https://insights.sbomify.com/CVE-2021-28195/): ASUS BMC's firmware: buffer overflow - Radius configuration function (medium 4.9)
- [CVE-2021-28194](https://insights.sbomify.com/CVE-2021-28194/): ASUS BMC's firmware: buffer overflow - Remote image configuration setting (medium 4.9)
- [CVE-2021-28193](https://insights.sbomify.com/CVE-2021-28193/): ASUS BMC's firmware: buffer overflow - SMTP configuration function (medium 4.9)
- [CVE-2021-28192](https://insights.sbomify.com/CVE-2021-28192/): ASUS BMC's firmware: buffer overflow - Remote video storage function (medium 4.9)
- [CVE-2021-28191](https://insights.sbomify.com/CVE-2021-28191/): ASUS BMC's firmware: buffer overflow - Firmware update function (medium 4.9)
- [CVE-2021-28190](https://insights.sbomify.com/CVE-2021-28190/): ASUS BMC's firmware: buffer overflow - Generate new certificate function (medium 4.9)
- [CVE-2021-28189](https://insights.sbomify.com/CVE-2021-28189/): ASUS BMC's firmware: buffer overflow - SMTP configuration function (medium 4.9)
- [CVE-2021-28188](https://insights.sbomify.com/CVE-2021-28188/): ASUS BMC's firmware: buffer overflow - Modify user’s information function (medium 4.9)
- [CVE-2021-28187](https://insights.sbomify.com/CVE-2021-28187/): ASUS BMC's firmware: buffer overflow - Generate new SSL certificate (medium 4.9)
- [CVE-2021-28186](https://insights.sbomify.com/CVE-2021-28186/): ASUS BMC's firmware: buffer overflow - ActiveX configuration-2 acquisition (medium 4.9)
- [CVE-2021-28185](https://insights.sbomify.com/CVE-2021-28185/): ASUS BMC's firmware: buffer overflow - ActiveX configuration-1 acquisition (medium 4.9)
- [CVE-2021-28184](https://insights.sbomify.com/CVE-2021-28184/): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (medium 4.9)
- [CVE-2021-28183](https://insights.sbomify.com/CVE-2021-28183/): ASUS BMC's firmware: buffer overflow - Web License configuration setting (medium 4.9)
- [CVE-2021-28182](https://insights.sbomify.com/CVE-2021-28182/): ASUS BMC's firmware: buffer overflow - Web Service configuration function (medium 4.9)
- [CVE-2021-28181](https://insights.sbomify.com/CVE-2021-28181/): ASUS BMC's firmware: buffer overflow - Remote video configuration setting (medium 4.9)
- [CVE-2021-28180](https://insights.sbomify.com/CVE-2021-28180/): ASUS BMC's firmware: buffer overflow - Audit log configuration setting (medium 4.9)
- [CVE-2021-28179](https://insights.sbomify.com/CVE-2021-28179/): ASUS BMC's firmware: buffer overflow - Media support configuration setting (medium 4.9)
- [CVE-2021-28178](https://insights.sbomify.com/CVE-2021-28178/): ASUS BMC's firmware: buffer overflow - UEFI configuration function (medium 4.9)
- [CVE-2021-28177](https://insights.sbomify.com/CVE-2021-28177/): ASUS BMC's firmware: buffer overflow - LDAP configuration function (medium 4.9)
- [CVE-2021-28176](https://insights.sbomify.com/CVE-2021-28176/): ASUS BMC's firmware: buffer overflow - DNS configuration function (medium 4.9)
- [CVE-2021-28175](https://insights.sbomify.com/CVE-2021-28175/): ASUS BMC's firmware: buffer overflow - Radius configuration function (medium 4.9)
- [CVE-2021-28174](https://insights.sbomify.com/CVE-2021-28174/): Mitake Smart Stock Selection System - Broken Authentication (medium 6.5)
- [CVE-2021-28173](https://insights.sbomify.com/CVE-2021-28173/): Vangene deltaFlow E-platform - Arbitrary File Upload (critical 9.8)
- [CVE-2021-28172](https://insights.sbomify.com/CVE-2021-28172/): Vangene deltaFlow E-platform - Path Traversal (high 7.5)
- [CVE-2021-28171](https://insights.sbomify.com/CVE-2021-28171/): Vangene deltaFlow E-platform - Broken Authentication (critical 9.8)
- [CVE-2021-28170](https://insights.sbomify.com/CVE-2021-28170/): Improper Input Validation in Jakarta Expression Language (medium 5.3)
- [CVE-2021-28169](https://insights.sbomify.com/CVE-2021-28169/): Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability (medium 5.3)
- [CVE-2021-28168](https://insights.sbomify.com/CVE-2021-28168/): Local information disclosure via system temporary directory (medium 6.2)
- [CVE-2021-28167](https://insights.sbomify.com/CVE-2021-28167/): Information disclosure in Eclipse OpenJ9 (medium 6.5)
- [CVE-2021-28166](https://insights.sbomify.com/CVE-2021-28166/): Null dereference in Eclipse Mosquitto (medium 6.5)
- [CVE-2021-28165](https://insights.sbomify.com/CVE-2021-28165/): Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources (high 7.5)
- [CVE-2021-28164](https://insights.sbomify.com/CVE-2021-28164/): Authorization Before Parsing and Canonicalization in jetty (medium 5.3)
- [CVE-2021-28163](https://insights.sbomify.com/CVE-2021-28163/): Directory exposure in jetty (low 2.7)
- [CVE-2021-28162](https://insights.sbomify.com/CVE-2021-28162/): Command Injection in @theia/messages (medium 6.1)
- [CVE-2021-28161](https://insights.sbomify.com/CVE-2021-28161/): Improper Neutralization of Input in Theia console (medium 6.1)
- [CVE-2021-28160](https://insights.sbomify.com/CVE-2021-28160/): Cross-site scripting in acexy wireless-n wifi repeater project:acexy wireless-n wifi repeater firmware (medium 6.1)
- [CVE-2021-28157](https://insights.sbomify.com/CVE-2021-28157/): SQL injection in devolutions:devolutions server (high 7.2)
- [CVE-2021-28156](https://insights.sbomify.com/CVE-2021-28156/): Security feature bypass in hashicorp:consul (high 7.5)
- [CVE-2021-28155](https://insights.sbomify.com/CVE-2021-28155/): Denial of service in jbl:tune500bt firmware (medium 6.5)
- [CVE-2021-28154](https://insights.sbomify.com/CVE-2021-28154/): Missing authorization in camunda:modeler (critical 9.1)
- [CVE-2021-28153](https://insights.sbomify.com/CVE-2021-28153/): Other in broadcom:brocade fabric operating system firmware (medium 5.3)
- [CVE-2021-28152](https://insights.sbomify.com/CVE-2021-28152/): Hardcoded credentials in hongdian:h8922 firmware (critical 9.8)
- [CVE-2021-28151](https://insights.sbomify.com/CVE-2021-28151/): Command injection in hongdian:h8922 firmware (high 8.8)
- [CVE-2021-28150](https://insights.sbomify.com/CVE-2021-28150/): Missing authorization in hongdian:h8922 firmware (medium 5.5)
- [CVE-2021-28149](https://insights.sbomify.com/CVE-2021-28149/): Path traversal in hongdian:h8922 firmware (medium 6.5)
- [CVE-2021-28148](https://insights.sbomify.com/CVE-2021-28148/): Denial of service in grafana:grafana (high 7.5)
- [CVE-2021-28147](https://insights.sbomify.com/CVE-2021-28147/): Missing authorization in grafana:grafana (medium 6.5)
- [CVE-2021-28146](https://insights.sbomify.com/CVE-2021-28146/): Missing authorization in grafana:grafana (medium 6.5)
- [CVE-2021-28145](https://insights.sbomify.com/CVE-2021-28145/): Concrete CMS Cross-site Scripting via Survey Blocks (medium 5.4)
- [CVE-2021-28144](https://insights.sbomify.com/CVE-2021-28144/): Command injection in dlink:dir-3060 firmware (high 8.8)
- [CVE-2021-28143](https://insights.sbomify.com/CVE-2021-28143/): Command injection in dlink:dir-841 firmware (high 8.0)
- [CVE-2021-28142](https://insights.sbomify.com/CVE-2021-28142/): SQL injection in citsmart:citsmart (high 8.8)
- [CVE-2021-28141](https://insights.sbomify.com/CVE-2021-28141/): Missing authorization in progress:telerik ui for asp.net ajax (critical 9.8)
- [CVE-2021-28139](https://insights.sbomify.com/CVE-2021-28139/): Memory corruption in espressif:esp-idf (high 8.8)
- [CVE-2021-28136](https://insights.sbomify.com/CVE-2021-28136/): Memory corruption in espressif:esp-idf (medium 6.5)
- [CVE-2021-28135](https://insights.sbomify.com/CVE-2021-28135/): Denial of service in espressif:esp-idf (medium 6.5)
- [CVE-2021-28134](https://insights.sbomify.com/CVE-2021-28134/): Code injection in clipper project:clipper (critical 9.8)
- [CVE-2021-28133](https://insights.sbomify.com/CVE-2021-28133/): Information disclosure in zoom:zoom (medium 4.3)
- [CVE-2021-28132](https://insights.sbomify.com/CVE-2021-28132/): File upload in lucysecurity:security awareness (critical 9.8)
- [CVE-2021-28131](https://insights.sbomify.com/CVE-2021-28131/): Impala logs contain secrets (high 7.5)
- [CVE-2021-28130](https://insights.sbomify.com/CVE-2021-28130/): Security feature bypass in drweb:security space (high 7.8)
- [CVE-2021-28129](https://insights.sbomify.com/CVE-2021-28129/): DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid (high 7.8)
- [CVE-2021-28128](https://insights.sbomify.com/CVE-2021-28128/): Weak Password Recovery Mechanism for Forgotten Password in Strapi (high 8.1)
- [CVE-2021-28127](https://insights.sbomify.com/CVE-2021-28127/): Auth bypass in stormshield:stormshield network security (high 7.5)
- [CVE-2021-28126](https://insights.sbomify.com/CVE-2021-28126/): Cross-site scripting in compassplus:tranzware e-commerce payment gateway (medium 6.1)
- [CVE-2021-28125](https://insights.sbomify.com/CVE-2021-28125/): Apache Superset Open Redirect (medium 6.1)
- [CVE-2021-28124](https://insights.sbomify.com/CVE-2021-28124/): Auth bypass in cohesity:cohesity dataplatform (medium 5.9)
- [CVE-2021-28123](https://insights.sbomify.com/CVE-2021-28123/): Hardcoded credentials in cohesity:cohesity dataplatform (critical 9.8)
- [CVE-2021-28122](https://insights.sbomify.com/CVE-2021-28122/): Missing authorization in open5gs:open5gs (critical 9.8)
- [CVE-2021-28121](https://insights.sbomify.com/CVE-2021-28121/): Other in virtual robots.txt project:virtual robots.txt (critical 9.8)
- [CVE-2021-28119](https://insights.sbomify.com/CVE-2021-28119/): Code injection in twinkletray:twinkle tray (critical 9.8)
- [CVE-2021-28117](https://insights.sbomify.com/CVE-2021-28117/): Other in kde:discover (high 7.5)
- [CVE-2021-28116](https://insights.sbomify.com/CVE-2021-28116/): Memory corruption in debian:debian linux (low 3.7)
- [CVE-2021-28115](https://insights.sbomify.com/CVE-2021-28115/): Cross-site scripting in ougc feedback project:ougc feedback (medium 6.1)
- [CVE-2021-28114](https://insights.sbomify.com/CVE-2021-28114/): Cross-site Scripting in Froala WYSIWYG Editor (medium 5.4)
- [CVE-2021-28113](https://insights.sbomify.com/CVE-2021-28113/): Command injection in okta:access gateway (medium 6.7)
- [CVE-2021-28112](https://insights.sbomify.com/CVE-2021-28112/): Other in draeger:x-dock firmware (high 8.8)
- [CVE-2021-28111](https://insights.sbomify.com/CVE-2021-28111/): Hardcoded credentials in draeger:x-dock firmware (high 8.8)
- [CVE-2021-28110](https://insights.sbomify.com/CVE-2021-28110/): XML external entity in compassplus:tranzware e-commerce payment gateway (high 7.5)
- [CVE-2021-28109](https://insights.sbomify.com/CVE-2021-28109/): Cross-site scripting in compassplus:tranzware fimi (medium 6.1)
- [CVE-2021-28100](https://insights.sbomify.com/CVE-2021-28100/): Netflix/Priam: Temporary Directory Information Disclosure (medium 5.5)
- [CVE-2021-28099](https://insights.sbomify.com/CVE-2021-28099/): Insecure temporary file in Netflix OSS Hollow (medium 4.4)
- [CVE-2021-28098](https://insights.sbomify.com/CVE-2021-28098/): Privilege escalation in forescout:counteract (high 7.8)
- [CVE-2021-28096](https://insights.sbomify.com/CVE-2021-28096/): Denial of service in stormshield:stormshield network security (medium 5.3)
- [CVE-2021-28095](https://insights.sbomify.com/CVE-2021-28095/): Weak cryptography in open-xchange:open-xchange documents (medium 4.8)
- [CVE-2021-28094](https://insights.sbomify.com/CVE-2021-28094/): Weak cryptography in open-xchange:open-xchange documents (medium 6.5)
- [CVE-2021-28093](https://insights.sbomify.com/CVE-2021-28093/): Weak cryptography in open-xchange:open-xchange documents (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/186/