# Vulnerabilities published in 2021


- [CVE-2021-28092](https://insights.sbomify.com/CVE-2021-28092/): Regular Expression Denial of Service (ReDoS) (high 7.5)
- [CVE-2021-28091](https://insights.sbomify.com/CVE-2021-28091/): Security feature bypass in debian:debian linux (high 7.5)
- [CVE-2021-28090](https://insights.sbomify.com/CVE-2021-28090/): Denial of service in fedoraproject:fedora (medium 5.3)
- [CVE-2021-28089](https://insights.sbomify.com/CVE-2021-28089/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2021-28088](https://insights.sbomify.com/CVE-2021-28088/): Cross-site scripting (XSS) (medium 5.4)
- [CVE-2021-28079](https://insights.sbomify.com/CVE-2021-28079/): Cross-site scripting in jamovi:jamovi (medium 6.1)
- [CVE-2021-28075](https://insights.sbomify.com/CVE-2021-28075/): Path traversal in ikuai8:ikuaios (high 7.5)
- [CVE-2021-28070](https://insights.sbomify.com/CVE-2021-28070/): Cross-site request forgery in popojicms:popojicms (medium 4.3)
- [CVE-2021-28060](https://insights.sbomify.com/CVE-2021-28060/): Server-side request forgery in group-office:group office (medium 5.3)
- [CVE-2021-28055](https://insights.sbomify.com/CVE-2021-28055/): Predictable CSRF tokens in centreon/centreon (medium 6.5)
- [CVE-2021-28054](https://insights.sbomify.com/CVE-2021-28054/): Cross-site scripting in centreon:centreon (medium 5.4)
- [CVE-2021-28053](https://insights.sbomify.com/CVE-2021-28053/): SQL injection in centreon:centreon (high 8.8)
- [CVE-2021-28052](https://insights.sbomify.com/CVE-2021-28052/): Hitachi Content Platform Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-28048](https://insights.sbomify.com/CVE-2021-28048/): Misconfiguration in devolutions:devolutions server (medium 6.5)
- [CVE-2021-28047](https://insights.sbomify.com/CVE-2021-28047/): Cross-site scripting in devolutions:remote desktop manager (medium 5.4)
- [CVE-2021-28042](https://insights.sbomify.com/CVE-2021-28042/): Path traversal in deutschepost:mailoptimizer (high 7.8)
- [CVE-2021-28041](https://insights.sbomify.com/CVE-2021-28041/): Memory corruption in fedoraproject:fedora (high 7.1)
- [CVE-2021-28040](https://insights.sbomify.com/CVE-2021-28040/): Denial of service in ossec:ossec (high 7.5)
- [CVE-2021-28039](https://insights.sbomify.com/CVE-2021-28039/): Memory corruption in linux:linux kernel (medium 6.5)
- [CVE-2021-28038](https://insights.sbomify.com/CVE-2021-28038/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2021-28037](https://insights.sbomify.com/CVE-2021-28037/): Data race in internment (critical 9.8)
- [CVE-2021-28036](https://insights.sbomify.com/CVE-2021-28036/): quinn invalidly assumes the memory layout of std::net::SocketAddr (high 7.5)
- [CVE-2021-28035](https://insights.sbomify.com/CVE-2021-28035/): Drop of uninitialized memory in stack_dst (critical 9.8)
- [CVE-2021-28034](https://insights.sbomify.com/CVE-2021-28034/): Double free in stack_dst (critical 9.8)
- [CVE-2021-28033](https://insights.sbomify.com/CVE-2021-28033/): Deserializing an array can free uninitialized memory in byte_struct (critical 9.8)
- [CVE-2021-28032](https://insights.sbomify.com/CVE-2021-28032/): Use after free in nano_arena (critical 9.8)
- [CVE-2021-28031](https://insights.sbomify.com/CVE-2021-28031/): move_elements can double-free objects on panic (critical 9.8)
- [CVE-2021-28030](https://insights.sbomify.com/CVE-2021-28030/): Use of Uninitialized Resource in truetype (high 7.5)
- [CVE-2021-28029](https://insights.sbomify.com/CVE-2021-28029/): Uninitialized memory access in toodee (high 7.5)
- [CVE-2021-28028](https://insights.sbomify.com/CVE-2021-28028/): Double free in toodee (critical 9.8)
- [CVE-2021-28027](https://insights.sbomify.com/CVE-2021-28027/): Loading a bgzip block can write out of bounds if size overflows. (critical 9.8)
- [CVE-2021-28026](https://insights.sbomify.com/CVE-2021-28026/): Memory corruption in jpeg:jpeg-xl (high 7.8)
- [CVE-2021-28025](https://insights.sbomify.com/CVE-2021-28025/): Integer overflow in qt:qt (medium 5.5)
- [CVE-2021-28024](https://insights.sbomify.com/CVE-2021-28024/): Auth bypass in servicetonic:servicetonic (critical 9.8)
- [CVE-2021-28023](https://insights.sbomify.com/CVE-2021-28023/): File upload in servicetonic:servicetonic (critical 9.8)
- [CVE-2021-28022](https://insights.sbomify.com/CVE-2021-28022/): SQL injection in servicetonic:servicetonic (high 7.5)
- [CVE-2021-28021](https://insights.sbomify.com/CVE-2021-28021/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-28007](https://insights.sbomify.com/CVE-2021-28007/): Cross-site scripting in web based quiz system project:web based quiz system (medium 6.1)
- [CVE-2021-28006](https://insights.sbomify.com/CVE-2021-28006/): Cross-site scripting in web based quiz system project:web based quiz system (medium 6.1)
- [CVE-2021-28002](https://insights.sbomify.com/CVE-2021-28002/): Cross-site scripting in textpattern:textpattern (medium 5.4)
- [CVE-2021-28001](https://insights.sbomify.com/CVE-2021-28001/): Cross-site scripting in textpattern:textpattern (medium 5.4)
- [CVE-2021-28000](https://insights.sbomify.com/CVE-2021-28000/): Cross-site scripting in local services search engine management system project:local services search engine management system (medium 4.8)
- [CVE-2021-27999](https://insights.sbomify.com/CVE-2021-27999/): SQL injection in local services search engine management system project:local services search engine management system (medium 4.9)
- [CVE-2021-27990](https://insights.sbomify.com/CVE-2021-27990/): Auth bypass in appspace:appspace (high 7.5)
- [CVE-2021-27989](https://insights.sbomify.com/CVE-2021-27989/): Cross-site scripting in appspace:appspace (medium 5.4)
- [CVE-2021-27984](https://insights.sbomify.com/CVE-2021-27984/): File upload in pluck-cms:pluck (high 8.1)
- [CVE-2021-27983](https://insights.sbomify.com/CVE-2021-27983/): Code injection in max-3000:maxsite cms (critical 9.8)
- [CVE-2021-27973](https://insights.sbomify.com/CVE-2021-27973/): SQL injection in piwigo:piwigo (high 7.2)
- [CVE-2021-27971](https://insights.sbomify.com/CVE-2021-27971/): Other in alpsalpine:touchpad driver (high 7.8)
- [CVE-2021-27969](https://insights.sbomify.com/CVE-2021-27969/): Cross-site scripting in boonex:dolphin (medium 4.8)
- [CVE-2021-27965](https://insights.sbomify.com/CVE-2021-27965/): Memory corruption in msi:dragon center (critical 9.8)
- [CVE-2021-27964](https://insights.sbomify.com/CVE-2021-27964/): File upload in sfcyazilim:sonlogger (critical 9.8)
- [CVE-2021-27963](https://insights.sbomify.com/CVE-2021-27963/): Missing authorization in sfcyazilim:sonlogger (high 8.2)
- [CVE-2021-27962](https://insights.sbomify.com/CVE-2021-27962/): Missing authorization in grafana:grafana (high 7.1)
- [CVE-2021-27961](https://insights.sbomify.com/CVE-2021-27961/): evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS via the indexeva.php action parameter. (medium 6.5)
- [CVE-2021-27956](https://insights.sbomify.com/CVE-2021-27956/): Cross-site scripting in zohocorp:manageengine adselfservice plus (medium 6.1)
- [CVE-2021-27954](https://insights.sbomify.com/CVE-2021-27954/): Memory corruption in ecobee:ecobee3 lite firmware (high 8.2)
- [CVE-2021-27953](https://insights.sbomify.com/CVE-2021-27953/): Null dereference in ecobee:ecobee3 lite firmware (high 7.5)
- [CVE-2021-27952](https://insights.sbomify.com/CVE-2021-27952/): Hardcoded credentials in ecobee:ecobee3 lite firmware (critical 9.8)
- [CVE-2021-27950](https://insights.sbomify.com/CVE-2021-27950/): SQL injection in sitasoftware:azurcms (high 8.8)
- [CVE-2021-27949](https://insights.sbomify.com/CVE-2021-27949/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2021-27948](https://insights.sbomify.com/CVE-2021-27948/): SQL injection in mybb:mybb (high 7.2)
- [CVE-2021-27947](https://insights.sbomify.com/CVE-2021-27947/): SQL injection in mybb:mybb (high 7.2)
- [CVE-2021-27946](https://insights.sbomify.com/CVE-2021-27946/): SQL injection in mybb:mybb (high 8.8)
- [CVE-2021-27945](https://insights.sbomify.com/CVE-2021-27945/): Cross-site scripting in squirro:squirro (medium 6.1)
- [CVE-2021-27944](https://insights.sbomify.com/CVE-2021-27944/): Missing authorization in vizio:e50x-e1 firmware (critical 9.8)
- [CVE-2021-27943](https://insights.sbomify.com/CVE-2021-27943/): Auth bypass in vizio:e50x-e1 firmware (high 7.5)
- [CVE-2021-27942](https://insights.sbomify.com/CVE-2021-27942/): Code injection in vizio:e50x-e1 firmware (medium 6.8)
- [CVE-2021-27941](https://insights.sbomify.com/CVE-2021-27941/): Information disclosure in coolkit:ewelink (medium 4.6)
- [CVE-2021-27940](https://insights.sbomify.com/CVE-2021-27940/): openark/orchestrator cross-site scripting vulnerability (medium 6.1)
- [CVE-2021-27938](https://insights.sbomify.com/CVE-2021-27938/): XSS in CreateQueuedJobTask (medium 6.1)
- [CVE-2021-27935](https://insights.sbomify.com/CVE-2021-27935/): Weak cryptography in adguard:adguard home (high 7.5)
- [CVE-2021-27933](https://insights.sbomify.com/CVE-2021-27933/): Cross-site scripting in pfsense:pfsense (medium 6.1)
- [CVE-2021-27932](https://insights.sbomify.com/CVE-2021-27932/): Misconfiguration in stormshield:ssl vpn client (high 7.8)
- [CVE-2021-27931](https://insights.sbomify.com/CVE-2021-27931/): XML external entity in lumis:lumis experience platform (critical 9.1)
- [CVE-2021-27930](https://insights.sbomify.com/CVE-2021-27930/): Cross-site scripting in irislink:irisnext (medium 5.4)
- [CVE-2021-27928](https://insights.sbomify.com/CVE-2021-27928/): Code injection in debian:debian linux (high 7.2)
- [CVE-2021-27927](https://insights.sbomify.com/CVE-2021-27927/): Cross-site request forgery in zabbix:zabbix (high 8.8)
- [CVE-2021-27925](https://insights.sbomify.com/CVE-2021-27925/): Race condition in couchbase:couchbase server (medium 4.4)
- [CVE-2021-27924](https://insights.sbomify.com/CVE-2021-27924/): Information disclosure in couchbase:couchbase server (medium 5.9)
- [CVE-2021-27923](https://insights.sbomify.com/CVE-2021-27923/): Pillow Denial of Service by Uncontrolled Resource Consumption (high 7.5)
- [CVE-2021-27922](https://insights.sbomify.com/CVE-2021-27922/): Pillow Uncontrolled Resource Consumption (high 7.5)
- [CVE-2021-27921](https://insights.sbomify.com/CVE-2021-27921/): Pillow Denial of Service by Uncontrolled Resource Consumption (high 7.5)
- [CVE-2021-27919](https://insights.sbomify.com/CVE-2021-27919/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2021-27918](https://insights.sbomify.com/CVE-2021-27918/): Denial of service in golang:go (high 7.5)
- [CVE-2021-27917](https://insights.sbomify.com/CVE-2021-27917/): XSS in contact tracking and page hits report (high 7.3)
- [CVE-2021-27916](https://insights.sbomify.com/CVE-2021-27916/): Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) (high 8.1)
- [CVE-2021-27915](https://insights.sbomify.com/CVE-2021-27915/): XSS Cross-site Scripting Stored (XSS) - Description field (high 7.6)
- [CVE-2021-27914](https://insights.sbomify.com/CVE-2021-27914/): Cross-site scripting in Mautic (high 7.6)
- [CVE-2021-27913](https://insights.sbomify.com/CVE-2021-27913/): Use of a Broken or Risky Cryptographic Algorithm (low 3.5)
- [CVE-2021-27912](https://insights.sbomify.com/CVE-2021-27912/): XSS vulnerability on asset view (high 7.1)
- [CVE-2021-27911](https://insights.sbomify.com/CVE-2021-27911/): XSS vulnerability on contacts view (high 8.3)
- [CVE-2021-27910](https://insights.sbomify.com/CVE-2021-27910/): Stored XSS vulnerability on Bounce Management Callback (high 8.2)
- [CVE-2021-27909](https://insights.sbomify.com/CVE-2021-27909/): XSS vulnerability on password reset page (medium 6.3)
- [CVE-2021-27908](https://insights.sbomify.com/CVE-2021-27908/): Mautic vulnerable to secret data exfiltration via symfony parameters (medium 5.8)
- [CVE-2021-27907](https://insights.sbomify.com/CVE-2021-27907/): Apache Superset stored XSS on Dashboard markdown (medium 5.4)
- [CVE-2021-27906](https://insights.sbomify.com/CVE-2021-27906/): A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file (medium 5.5)
- [CVE-2021-27905](https://insights.sbomify.com/CVE-2021-27905/): SSRF vulnerability with the Replication handler (critical 9.8)
- [CVE-2021-27904](https://insights.sbomify.com/CVE-2021-27904/): Missing authorization in misp-project:misp (medium 5.5)
- [CVE-2021-27903](https://insights.sbomify.com/CVE-2021-27903/): Craft CMS Remote Code Injection (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/187/