# Vulnerabilities published in 2021


- [CVE-2021-27902](https://insights.sbomify.com/CVE-2021-27902/): Craft CMS Cross-site Scripting Vulnerability (medium 6.1)
- [CVE-2021-27901](https://insights.sbomify.com/CVE-2021-27901/): Security feature bypass in google:android (medium 6.8)
- [CVE-2021-27900](https://insights.sbomify.com/CVE-2021-27900/): Missing authorization in proofpoint:insider threat management (high 8.1)
- [CVE-2021-27899](https://insights.sbomify.com/CVE-2021-27899/): Security feature bypass in proofpoint:insider threat management (high 7.4)
- [CVE-2021-27893](https://insights.sbomify.com/CVE-2021-27893/): Privilege escalation in ssh:tectia client (high 7.0)
- [CVE-2021-27892](https://insights.sbomify.com/CVE-2021-27892/): Privilege escalation in ssh:tectia client (high 7.8)
- [CVE-2021-27891](https://insights.sbomify.com/CVE-2021-27891/): Weak cryptography in ssh:tectia client (high 8.8)
- [CVE-2021-27890](https://insights.sbomify.com/CVE-2021-27890/): SQL injection in mybb:mybb (high 8.8)
- [CVE-2021-27889](https://insights.sbomify.com/CVE-2021-27889/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2021-27888](https://insights.sbomify.com/CVE-2021-27888/): Cross-site scripting in zend:zendto (medium 6.1)
- [CVE-2021-27887](https://insights.sbomify.com/CVE-2021-27887/): Stored XSS vulnerability in Ellipse APM (medium 6.3)
- [CVE-2021-27886](https://insights.sbomify.com/CVE-2021-27886/): Command injection in docker dashboard project:docker dashboard (critical 9.8)
- [CVE-2021-27885](https://insights.sbomify.com/CVE-2021-27885/): Cross-site request forgery in e107:e107 (high 8.8)
- [CVE-2021-27884](https://insights.sbomify.com/CVE-2021-27884/): Weak JSON Web Token in yapi-vendor (medium 5.1)
- [CVE-2021-27878](https://insights.sbomify.com/CVE-2021-27878/): Veritas Backup Exec Agent Command Execution (high 8.8, exploited in the wild)
- [CVE-2021-27877](https://insights.sbomify.com/CVE-2021-27877/): Veritas Backup Exec Agent Improper Authentication (high 8.2, exploited in the wild)
- [CVE-2021-27876](https://insights.sbomify.com/CVE-2021-27876/): Veritas Backup Exec Agent File Access (high 8.1, exploited in the wild)
- [CVE-2021-27862](https://insights.sbomify.com/CVE-2021-27862/): Security feature bypass in 802.2 (medium 4.7)
- [CVE-2021-27861](https://insights.sbomify.com/CVE-2021-27861/): L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths (medium 4.7)
- [CVE-2021-27860](https://insights.sbomify.com/CVE-2021-27860/): FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit (critical 9.8, exploited in the wild)
- [CVE-2021-27859](https://insights.sbomify.com/CVE-2021-27859/): Missing authorization vulnerability in FatPipe software (high 8.8)
- [CVE-2021-27858](https://insights.sbomify.com/CVE-2021-27858/): Missing authorization vulnerability in FatPipe software (medium 5.3)
- [CVE-2021-27857](https://insights.sbomify.com/CVE-2021-27857/): FatPipe software allows unauthenticated configuration download (high 7.5)
- [CVE-2021-27856](https://insights.sbomify.com/CVE-2021-27856/): FatPipe software administrative account with no password (critical 9.8)
- [CVE-2021-27855](https://insights.sbomify.com/CVE-2021-27855/): FatPipe software allows privilege escalation (high 8.8)
- [CVE-2021-27854](https://insights.sbomify.com/CVE-2021-27854/): L2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation (medium 4.7)
- [CVE-2021-27853](https://insights.sbomify.com/CVE-2021-27853/): L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers (medium 4.7)
- [CVE-2021-27852](https://insights.sbomify.com/CVE-2021-27852/): Checkbox Survey Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2021-27851](https://insights.sbomify.com/CVE-2021-27851/): Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed' (medium 5.5)
- [CVE-2021-27850](https://insights.sbomify.com/CVE-2021-27850/): Bypass of the fix for CVE-2019-0195 (critical 9.8)
- [CVE-2021-27847](https://insights.sbomify.com/CVE-2021-27847/): Denial of service in libvips:libvips (medium 6.5)
- [CVE-2021-27845](https://insights.sbomify.com/CVE-2021-27845/): Denial of service in jasper project:jasper (medium 5.5)
- [CVE-2021-27839](https://insights.sbomify.com/CVE-2021-27839/): Code injection in bigprof:online invoicing system (medium 4.4)
- [CVE-2021-27836](https://insights.sbomify.com/CVE-2021-27836/): Null dereference in fedoraproject:fedora (medium 6.5)
- [CVE-2021-27828](https://insights.sbomify.com/CVE-2021-27828/): SQL injection in in4velocity:in4suite erp (critical 9.1)
- [CVE-2021-27825](https://insights.sbomify.com/CVE-2021-27825/): Path traversal in mercurycom:mac1200r firmware (high 7.5)
- [CVE-2021-27823](https://insights.sbomify.com/CVE-2021-27823/): Information disclosure in mediateknet:netwave system (high 7.5)
- [CVE-2021-27822](https://insights.sbomify.com/CVE-2021-27822/): Cross-site scripting in phpgurukul:vehicle parking management system (medium 4.8)
- [CVE-2021-27821](https://insights.sbomify.com/CVE-2021-27821/): Cross-site scripting in openwrt:luci (medium 6.1)
- [CVE-2021-27817](https://insights.sbomify.com/CVE-2021-27817/): ShopXO RCE Vulnerability (critical 9.8)
- [CVE-2021-27815](https://insights.sbomify.com/CVE-2021-27815/): Null dereference in fedoraproject:fedora (medium 5.5)
- [CVE-2021-27811](https://insights.sbomify.com/CVE-2021-27811/): Code injection in qibosoft:qibosoft (high 7.2)
- [CVE-2021-27807](https://insights.sbomify.com/CVE-2021-27807/): A carefully crafted PDF file can trigger an infinite loop while loading the file (medium 5.5)
- [CVE-2021-27804](https://insights.sbomify.com/CVE-2021-27804/): Memory corruption in libjxl project:libjxl (critical 9.8)
- [CVE-2021-27803](https://insights.sbomify.com/CVE-2021-27803/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2021-27799](https://insights.sbomify.com/CVE-2021-27799/): Memory corruption in zint:barcode generator (high 7.5)
- [CVE-2021-27798](https://insights.sbomify.com/CVE-2021-27798/): privileged directory transversal.in Brocade Fabric OS versions 7.4.1.x and 7.3.x (medium 5.5)
- [CVE-2021-27797](https://insights.sbomify.com/CVE-2021-27797/): Hardcoded credentials in Brocade Fabric OS (critical 9.8)
- [CVE-2021-27796](https://insights.sbomify.com/CVE-2021-27796/): Privilege escalation in Brocade Fabric OS (medium 6.5)
- [CVE-2021-27795](https://insights.sbomify.com/CVE-2021-27795/): License forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, (medium 6.4)
- [CVE-2021-27794](https://insights.sbomify.com/CVE-2021-27794/): Auth bypass in Brocade Fabric OS (high 7.8)
- [CVE-2021-27793](https://insights.sbomify.com/CVE-2021-27793/): Auth bypass in Brocade Fabric OS (medium 5.3)
- [CVE-2021-27792](https://insights.sbomify.com/CVE-2021-27792/): Denial of service in Brocade Fabric OS (high 7.8)
- [CVE-2021-27791](https://insights.sbomify.com/CVE-2021-27791/): Auth bypass in Brocade Fabric OS (medium 5.4)
- [CVE-2021-27790](https://insights.sbomify.com/CVE-2021-27790/): Memory corruption in Brocade Fabric OS (high 7.8)
- [CVE-2021-27789](https://insights.sbomify.com/CVE-2021-27789/): Information disclosure in Brocade Fabric OS (medium 6.5)
- [CVE-2021-27788](https://insights.sbomify.com/CVE-2021-27788/): HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability (high 8.3)
- [CVE-2021-27786](https://insights.sbomify.com/CVE-2021-27786/): HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted (medium 4.6)
- [CVE-2021-27785](https://insights.sbomify.com/CVE-2021-27785/): HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785) (low 3.9)
- [CVE-2021-27784](https://insights.sbomify.com/CVE-2021-27784/): HCL Launch container images may contain non-unique https certificates and database encryption key (medium 5.9)
- [CVE-2021-27783](https://insights.sbomify.com/CVE-2021-27783/): HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure (medium 6.8)
- [CVE-2021-27782](https://insights.sbomify.com/CVE-2021-27782/): HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack (medium 5.4)
- [CVE-2021-27781](https://insights.sbomify.com/CVE-2021-27781/): HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting (medium 6.6)
- [CVE-2021-27780](https://insights.sbomify.com/CVE-2021-27780/): HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction (medium 5.3)
- [CVE-2021-27779](https://insights.sbomify.com/CVE-2021-27779/): A Security Misconfiguration vulnerability affects HCL VersionVault Express (critical 9.1)
- [CVE-2021-27778](https://insights.sbomify.com/CVE-2021-27778/): Cross-site scripting in HCL Traveler (medium 4.9)
- [CVE-2021-27777](https://insights.sbomify.com/CVE-2021-27777/): HCL Unica Platform is vulnerable to XML External Entity (XXE) injection (high 7.5)
- [CVE-2021-27774](https://insights.sbomify.com/CVE-2021-27774/): An injection vulnerability affects HCL Digital Experience (low 3.1)
- [CVE-2021-27773](https://insights.sbomify.com/CVE-2021-27773/): HCL Sametime is vulnerable to clickjacking (medium 4.2)
- [CVE-2021-27772](https://insights.sbomify.com/CVE-2021-27772/): HCL Sametime is vulnerable to an information disclosure (high 7.1)
- [CVE-2021-27771](https://insights.sbomify.com/CVE-2021-27771/): HCL Sametime is susceptible a file transfer service vulnerability (high 8.2)
- [CVE-2021-27770](https://insights.sbomify.com/CVE-2021-27770/): HCL Sametime is vulnerable to arbitrary HTTP requests (medium 6.8)
- [CVE-2021-27769](https://insights.sbomify.com/CVE-2021-27769/): HCL Sametime is vulnerable to an information disclosure (medium 5.3)
- [CVE-2021-27768](https://insights.sbomify.com/CVE-2021-27768/): An SSL certificate host verification vulnerability affects HCL Verse for Android (medium 6.3)
- [CVE-2021-27767](https://insights.sbomify.com/CVE-2021-27767/): HCL BigFix Platform Console is affected by a Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2021-27766](https://insights.sbomify.com/CVE-2021-27766/): HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2021-27765](https://insights.sbomify.com/CVE-2021-27765/): HCL BigFix Platform Server API is affected by Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2021-27764](https://insights.sbomify.com/CVE-2021-27764/): HCL BigFix WebUI Cookie missing attributes (high 7.4)
- [CVE-2021-27762](https://insights.sbomify.com/CVE-2021-27762/): HCL BigFix Platform is affected by misconfigured security-related HTTP headers (medium 4.7)
- [CVE-2021-27761](https://insights.sbomify.com/CVE-2021-27761/): HCL BigFix Platform is affected by weak web transport security (medium 4.8)
- [CVE-2021-27760](https://insights.sbomify.com/CVE-2021-27760/): HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart (medium 4.6)
- [CVE-2021-27759](https://insights.sbomify.com/CVE-2021-27759/): Cross-site request forgery in HCL BigFix Inventory (low 2.3)
- [CVE-2021-27758](https://insights.sbomify.com/CVE-2021-27758/): Cross-site request forgery in HCL BigFix Inventory (medium 4.3)
- [CVE-2021-27757](https://insights.sbomify.com/CVE-2021-27757/): Information disclosure in "BigFix Insights" (high 7.5)
- [CVE-2021-27756](https://insights.sbomify.com/CVE-2021-27756/): Weak cryptography in "BigFix Compliance Server" (high 7.5)
- [CVE-2021-27755](https://insights.sbomify.com/CVE-2021-27755/): Path traversal in "HCL Sametime" (medium 5.5)
- [CVE-2021-27753](https://insights.sbomify.com/CVE-2021-27753/): Path traversal in "HCL Sametime" (medium 5.5)
- [CVE-2021-27751](https://insights.sbomify.com/CVE-2021-27751/): HCL Commerce is affected by an Insufficient Session Expiration vulnerability. (medium 4.4)
- [CVE-2021-27746](https://insights.sbomify.com/CVE-2021-27746/): Cross-site scripting in "HCL Connections" (medium 5.4)
- [CVE-2021-27741](https://insights.sbomify.com/CVE-2021-27741/): XML external entity in Commerce (critical 9.1)
- [CVE-2021-27738](https://insights.sbomify.com/CVE-2021-27738/): Improper Access Control to Streaming Coordinator & SSRF (high 7.5)
- [CVE-2021-27737](https://insights.sbomify.com/CVE-2021-27737/): Denial of service in Apache Traffic Server (high 7.5)
- [CVE-2021-27736](https://insights.sbomify.com/CVE-2021-27736/): XML external entity in fusionauth:saml v2 (medium 6.5)
- [CVE-2021-27734](https://insights.sbomify.com/CVE-2021-27734/): Auth bypass in belden:hirschmann hios (critical 9.8)
- [CVE-2021-27733](https://insights.sbomify.com/CVE-2021-27733/): Cross-site scripting in jetbrains:youtrack (medium 5.4)
- [CVE-2021-27731](https://insights.sbomify.com/CVE-2021-27731/): Cross-site scripting in accellion:fta (medium 6.1)
- [CVE-2021-27730](https://insights.sbomify.com/CVE-2021-27730/): Command injection in accellion:fta (critical 9.8)
- [CVE-2021-27722](https://insights.sbomify.com/CVE-2021-27722/): Memory corruption in nsasoft:spotauditor (medium 5.5)
- [CVE-2021-27715](https://insights.sbomify.com/CVE-2021-27715/): Auth bypass in mofinetwork:mofi4500-4gxelte-v2 firmware (critical 9.8)
- [CVE-2021-27710](https://insights.sbomify.com/CVE-2021-27710/): Command injection in totolink:a720r firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/188/