# Vulnerabilities published in 2021


- [CVE-2021-26797](https://insights.sbomify.com/CVE-2021-26797/): Auth bypass in hametech:hame sd1 wi-fi firmware (critical 9.8)
- [CVE-2021-26795](https://insights.sbomify.com/CVE-2021-26795/): SQL injection in talariax:sendquick alert plus server admin (high 8.8)
- [CVE-2021-26794](https://insights.sbomify.com/CVE-2021-26794/): File upload in frogcms project:frogcms (critical 9.8)
- [CVE-2021-26788](https://insights.sbomify.com/CVE-2021-26788/): Denial of service in oryx-embedded:cyclonetcp (high 7.5)
- [CVE-2021-26787](https://insights.sbomify.com/CVE-2021-26787/): Cross-site scripting in genesys:workforce management (medium 6.1)
- [CVE-2021-26786](https://insights.sbomify.com/CVE-2021-26786/): Code injection in playtuber project:playtuber (high 8.8)
- [CVE-2021-26777](https://insights.sbomify.com/CVE-2021-26777/): Memory corruption in circutor:compact dc-s basic firmware (critical 9.8)
- [CVE-2021-26776](https://insights.sbomify.com/CVE-2021-26776/): Cross-site scripting in cszcms:csz cms (medium 5.4)
- [CVE-2021-26765](https://insights.sbomify.com/CVE-2021-26765/): SQL injection in phpgurukul:student record system (critical 9.8)
- [CVE-2021-26764](https://insights.sbomify.com/CVE-2021-26764/): SQL injection in phpgurukul:student record system (high 8.8)
- [CVE-2021-26762](https://insights.sbomify.com/CVE-2021-26762/): SQL injection in phpgurukul:student record system (high 8.8)
- [CVE-2021-26758](https://insights.sbomify.com/CVE-2021-26758/): Privilege escalation in litespeedtech:openlitespeed (high 8.8)
- [CVE-2021-26754](https://insights.sbomify.com/CVE-2021-26754/): SQL injection in wpdatatables:wpdatatables (critical 9.8)
- [CVE-2021-26753](https://insights.sbomify.com/CVE-2021-26753/): Code injection in nedi:nedi (critical 9.9)
- [CVE-2021-26752](https://insights.sbomify.com/CVE-2021-26752/): Command injection in nedi:nedi (high 8.8)
- [CVE-2021-26751](https://insights.sbomify.com/CVE-2021-26751/): SQL injection in nedi:nedi (high 8.8)
- [CVE-2021-26750](https://insights.sbomify.com/CVE-2021-26750/): Privilege escalation in pandasecurity:panda adaptive defense 360 (high 7.8)
- [CVE-2021-26747](https://insights.sbomify.com/CVE-2021-26747/): Command injection in netis-systems:wf2411 firmware (critical 9.8)
- [CVE-2021-26746](https://insights.sbomify.com/CVE-2021-26746/): Cross-site scripting in chamilo:chamilo (medium 6.1)
- [CVE-2021-26740](https://insights.sbomify.com/CVE-2021-26740/): File upload in doyocms project:doyocms (critical 9.8)
- [CVE-2021-26739](https://insights.sbomify.com/CVE-2021-26739/): SQL injection in doyocms project:doyocms (critical 9.8)
- [CVE-2021-26738](https://insights.sbomify.com/CVE-2021-26738/): Privilege Escalation for ZCC macOS via PATH Variable (high 7.8)
- [CVE-2021-26737](https://insights.sbomify.com/CVE-2021-26737/): Privilege Escalation Using PID Reuse in ZCC macOS (medium 5.5)
- [CVE-2021-26736](https://insights.sbomify.com/CVE-2021-26736/): ZApp Installer Privilege Escalation Vulnerabilities (medium 6.7)
- [CVE-2021-26735](https://insights.sbomify.com/CVE-2021-26735/): Untrusted Search Path While Executing REG DELETE by Uninstaller (medium 6.7)
- [CVE-2021-26734](https://insights.sbomify.com/CVE-2021-26734/): Junction Delete leading to elevation of privilege (medium 4.4)
- [CVE-2021-26733](https://insights.sbomify.com/CVE-2021-26733/): spx_restservice FirstReset_handler_func Broken Access Control (medium 5.3)
- [CVE-2021-26732](https://insights.sbomify.com/CVE-2021-26732/): spx_restservice First_network_func Broken Access Control (medium 6.5)
- [CVE-2021-26731](https://insights.sbomify.com/CVE-2021-26731/): spx_restservice modifyUserb_func Command Injection and Multiple Stack-Based Buffer Overflows (critical 9.1)
- [CVE-2021-26730](https://insights.sbomify.com/CVE-2021-26730/): spx_restservice Login_handler_func Subfunction Stack-Based Buffer Overflow (critical 10.0)
- [CVE-2021-26729](https://insights.sbomify.com/CVE-2021-26729/): spx_restservice Login_handler_func Command Injection and Multiple Stack-Based Buffer Overflows (critical 10.0)
- [CVE-2021-26728](https://insights.sbomify.com/CVE-2021-26728/): spx_restservice KillDupUsr_func Command Injection and Stack-Based Buffer Overflow (critical 10.0)
- [CVE-2021-26727](https://insights.sbomify.com/CVE-2021-26727/): spx_restservice SubNet_handler_func Multiple Command Injections and Stack-Based Buffer Overflows (critical 10.0)
- [CVE-2021-26726](https://insights.sbomify.com/CVE-2021-26726/): Remote code execution in Valmet DNA before Collection 2021 (high 8.8)
- [CVE-2021-26725](https://insights.sbomify.com/CVE-2021-26725/): Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4 (high 8.6)
- [CVE-2021-26724](https://insights.sbomify.com/CVE-2021-26724/): Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 (high 8.6)
- [CVE-2021-26723](https://insights.sbomify.com/CVE-2021-26723/): Cross-site scripting in jenzabar:jenzabar (medium 6.1)
- [CVE-2021-26722](https://insights.sbomify.com/CVE-2021-26722/): LinkedIn Oncall vulnerable to Cross-Site Scripting (medium 6.1)
- [CVE-2021-26720](https://insights.sbomify.com/CVE-2021-26720/): Other in avahi:avahi (high 7.8)
- [CVE-2021-26719](https://insights.sbomify.com/CVE-2021-26719/): Path traversal in gradle:enterprise test distribution agent (medium 6.5)
- [CVE-2021-26718](https://insights.sbomify.com/CVE-2021-26718/): Security feature bypass in Kaspersky Internet Security for Mac (medium 5.5)
- [CVE-2021-26717](https://insights.sbomify.com/CVE-2021-26717/): Denial of service in digium:asterisk (high 7.5)
- [CVE-2021-26716](https://insights.sbomify.com/CVE-2021-26716/): Cross-site scripting in openenergymonitor:emoncms (medium 6.1)
- [CVE-2021-26715](https://insights.sbomify.com/CVE-2021-26715/): Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server (critical 9.1)
- [CVE-2021-26714](https://insights.sbomify.com/CVE-2021-26714/): Path traversal in mitel:micontact center enterprise (critical 9.8)
- [CVE-2021-26713](https://insights.sbomify.com/CVE-2021-26713/): Memory corruption in digium:asterisk (medium 6.5)
- [CVE-2021-26712](https://insights.sbomify.com/CVE-2021-26712/): Auth bypass in digium:asterisk (high 7.5)
- [CVE-2021-26711](https://insights.sbomify.com/CVE-2021-26711/): Other in redwood:report2web (medium 5.3)
- [CVE-2021-26710](https://insights.sbomify.com/CVE-2021-26710/): Cross-site scripting in redwood:report2web (medium 6.1)
- [CVE-2021-26709](https://insights.sbomify.com/CVE-2021-26709/): Memory corruption in d-link:dsl-320b-d1 (critical 9.8)
- [CVE-2021-26708](https://insights.sbomify.com/CVE-2021-26708/): Race condition in linux:linux kernel (high 7.0)
- [CVE-2021-26707](https://insights.sbomify.com/CVE-2021-26707/): Prototype pollution in Merge-deep (critical 9.8)
- [CVE-2021-26706](https://insights.sbomify.com/CVE-2021-26706/): Integer overflow in micrium:uc\/lib (critical 9.8)
- [CVE-2021-26705](https://insights.sbomify.com/CVE-2021-26705/): Auth bypass in squarebox:catdv (critical 9.1)
- [CVE-2021-26704](https://insights.sbomify.com/CVE-2021-26704/): Command injection in eprints:eprints (high 8.8)
- [CVE-2021-26703](https://insights.sbomify.com/CVE-2021-26703/): XML external entity in eprints:eprints (critical 9.8)
- [CVE-2021-26702](https://insights.sbomify.com/CVE-2021-26702/): Cross-site scripting in eprints:eprints (medium 6.1)
- [CVE-2021-26701](https://insights.sbomify.com/CVE-2021-26701/): .NET Core Remote Code Execution Vulnerability (high 8.1)
- [CVE-2021-26700](https://insights.sbomify.com/CVE-2021-26700/): Visual Studio Code npm-script Extension Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-26699](https://insights.sbomify.com/CVE-2021-26699/): Server-side request forgery in open-xchange:open-xchange appsuite (medium 5.4)
- [CVE-2021-26698](https://insights.sbomify.com/CVE-2021-26698/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2021-26697](https://insights.sbomify.com/CVE-2021-26697/): Apache Airflow: Lineage API endpoint for Experimental API missed authentication check (medium 5.3)
- [CVE-2021-26691](https://insights.sbomify.com/CVE-2021-26691/): Apache HTTP Server mod_session response handling heap overflow (critical 9.8)
- [CVE-2021-26690](https://insights.sbomify.com/CVE-2021-26690/): mod_session NULL pointer dereference (high 7.5)
- [CVE-2021-26689](https://insights.sbomify.com/CVE-2021-26689/): Use after free in google:android (critical 9.8)
- [CVE-2021-26688](https://insights.sbomify.com/CVE-2021-26688/): Weak cryptography in google:android (critical 9.8)
- [CVE-2021-26687](https://insights.sbomify.com/CVE-2021-26687/): Misconfiguration in google:android (critical 9.8)
- [CVE-2021-26686](https://insights.sbomify.com/CVE-2021-26686/): SQL injection in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2021-26685](https://insights.sbomify.com/CVE-2021-26685/): SQL injection in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2021-26684](https://insights.sbomify.com/CVE-2021-26684/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-26683](https://insights.sbomify.com/CVE-2021-26683/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-26682](https://insights.sbomify.com/CVE-2021-26682/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 6.1)
- [CVE-2021-26681](https://insights.sbomify.com/CVE-2021-26681/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-26680](https://insights.sbomify.com/CVE-2021-26680/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-26679](https://insights.sbomify.com/CVE-2021-26679/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-26678](https://insights.sbomify.com/CVE-2021-26678/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 6.1)
- [CVE-2021-26677](https://insights.sbomify.com/CVE-2021-26677/): Privilege escalation in Aruba ClearPass Policy Manager (high 7.8)
- [CVE-2021-26676](https://insights.sbomify.com/CVE-2021-26676/): Information disclosure in debian:debian linux (medium 6.5)
- [CVE-2021-26675](https://insights.sbomify.com/CVE-2021-26675/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2021-26644](https://insights.sbomify.com/CVE-2021-26644/): SQL injection in Mangboard WP BASIC (high 8.8)
- [CVE-2021-26642](https://insights.sbomify.com/CVE-2021-26642/): XpressEngine file upload vulnerability (high 8.8)
- [CVE-2021-26639](https://insights.sbomify.com/CVE-2021-26639/): WISA Smart Wing CMS File Download Vulnerability (high 8.1)
- [CVE-2021-26638](https://insights.sbomify.com/CVE-2021-26638/): Xi Smarthome wallpad authentication bypass vulnerability (high 7.3)
- [CVE-2021-26637](https://insights.sbomify.com/CVE-2021-26637/): SiHAS Improper Authentication vulnerability (high 8.8)
- [CVE-2021-26636](https://insights.sbomify.com/CVE-2021-26636/): Maxboard Remote Code Execution (high 8.8)
- [CVE-2021-26635](https://insights.sbomify.com/CVE-2021-26635/): Bandisoft ARK Library buffer overflow vulnerability (high 7.8)
- [CVE-2021-26634](https://insights.sbomify.com/CVE-2021-26634/): Maxboard multiple vulnerabilities (critical 9.8)
- [CVE-2021-26633](https://insights.sbomify.com/CVE-2021-26633/): Maxboard SQL injection and LFI vulnerability (high 7.5)
- [CVE-2021-26631](https://insights.sbomify.com/CVE-2021-26631/): Mangboard parameter modulation vulnerability (high 8.0)
- [CVE-2021-26630](https://insights.sbomify.com/CVE-2021-26630/): HANDY Groupware file download and execute vulnerability (high 7.8)
- [CVE-2021-26629](https://insights.sbomify.com/CVE-2021-26629/): tobesoft XPLATFORM Path Traversal Vulnerability (high 8.8)
- [CVE-2021-26628](https://insights.sbomify.com/CVE-2021-26628/): MaxBoard XSS and File Upload Vulnerability (high 8.1)
- [CVE-2021-26627](https://insights.sbomify.com/CVE-2021-26627/): EDrhyme QCP 200W Information Exposure Vulnerability (high 7.5)
- [CVE-2021-26626](https://insights.sbomify.com/CVE-2021-26626/): tobesoft XPLATFORM Arbitrary file execution Vulnerability (high 8.1)
- [CVE-2021-26625](https://insights.sbomify.com/CVE-2021-26625/): tobesoft Nexacro arbitrary file download vulnerability (high 8.8)
- [CVE-2021-26624](https://insights.sbomify.com/CVE-2021-26624/): eScan Anti-Virus Local privilege escalation Vulnerability (high 7.8)
- [CVE-2021-26623](https://insights.sbomify.com/CVE-2021-26623/): Bandisoft ARK Library Out-of-bound Vulnerability (high 7.8)
- [CVE-2021-26622](https://insights.sbomify.com/CVE-2021-26622/): Genian NAC remote code execution vulnerability (critical 9.6)
- [CVE-2021-26621](https://insights.sbomify.com/CVE-2021-26621/): Netis Korea MEX01 Buffer overflow vulnerability (high 8.1)
- [CVE-2021-26620](https://insights.sbomify.com/CVE-2021-26620/): IPTIME NAS2dual improper authentication vulnerability (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/196/