# Vulnerabilities published in 2021


- [CVE-2021-26619](https://insights.sbomify.com/CVE-2021-26619/): BigFileAgent arbitrary file Deleting vulnerability (high 7.1)
- [CVE-2021-26618](https://insights.sbomify.com/CVE-2021-26618/): Tmax ToOffice arbitrary file creation vulnerability (high 7.1)
- [CVE-2021-26617](https://insights.sbomify.com/CVE-2021-26617/): Gabia Firstmall remote code execution vulnerability (high 8.1)
- [CVE-2021-26616](https://insights.sbomify.com/CVE-2021-26616/): SecuwaySSL OS command injection vulnerability (high 7.8)
- [CVE-2021-26615](https://insights.sbomify.com/CVE-2021-26615/): bandisoft ARK library integer overflow vulnerability (high 7.8)
- [CVE-2021-26614](https://insights.sbomify.com/CVE-2021-26614/): IpTime C200 IP camera remote code execution vulnerability (high 7.5)
- [CVE-2021-26613](https://insights.sbomify.com/CVE-2021-26613/): tobesoft nexacro arbitrary file creation vulnerability (high 8.1)
- [CVE-2021-26612](https://insights.sbomify.com/CVE-2021-26612/): tobesoft Nexacro platform arbitrary file creation vulnerability (high 8.1)
- [CVE-2021-26611](https://insights.sbomify.com/CVE-2021-26611/): HejHome IP Camera use of hard-coded credentials vulnerability (high 8.1)
- [CVE-2021-26610](https://insights.sbomify.com/CVE-2021-26610/): godomall5 remote code execution vulnerability (high 7.2)
- [CVE-2021-26609](https://insights.sbomify.com/CVE-2021-26609/): WordPress Mangboard SQL-Injection vulnerability (high 7.5)
- [CVE-2021-26608](https://insights.sbomify.com/CVE-2021-26608/): handysoft groupware arbitrary file download and execution vulnerability (high 8.8)
- [CVE-2021-26607](https://insights.sbomify.com/CVE-2021-26607/): TOBESOFT NEXACRO17 arbitrary command execution vulnerability (high 8.1)
- [CVE-2021-26606](https://insights.sbomify.com/CVE-2021-26606/): DreamSecurity MagicLine Buffer Overflow Vulnerability (critical 9.8)
- [CVE-2021-26605](https://insights.sbomify.com/CVE-2021-26605/): unidocs ezPDFReader arbitrary command execution vulnerability (high 7.5)
- [CVE-2021-26603](https://insights.sbomify.com/CVE-2021-26603/): bandisoft ARK library heap overflow vulnerability (high 8.6)
- [CVE-2021-26601](https://insights.sbomify.com/CVE-2021-26601/): Path Traversal in ImpressCMS (high 8.1)
- [CVE-2021-26600](https://insights.sbomify.com/CVE-2021-26600/): Type Confusion in ImpressCMS (critical 9.8)
- [CVE-2021-26599](https://insights.sbomify.com/CVE-2021-26599/): SQL Injection in ImpressCMS (critical 9.8)
- [CVE-2021-26598](https://insights.sbomify.com/CVE-2021-26598/): Incorrect Access Control in ImpressCMS (medium 5.3)
- [CVE-2021-26597](https://insights.sbomify.com/CVE-2021-26597/): File upload in nokia:netact (medium 6.5)
- [CVE-2021-26596](https://insights.sbomify.com/CVE-2021-26596/): Cross-site scripting in nokia:netact (medium 5.4)
- [CVE-2021-26595](https://insights.sbomify.com/CVE-2021-26595/): Information disclosure in rangerstudio:directus (medium 5.3)
- [CVE-2021-26594](https://insights.sbomify.com/CVE-2021-26594/): Privilege escalation in rangerstudio:directus (high 8.8)
- [CVE-2021-26593](https://insights.sbomify.com/CVE-2021-26593/): Information disclosure in rangerstudio:directus (high 7.5)
- [CVE-2021-26589](https://insights.sbomify.com/CVE-2021-26589/): Misconfiguration in HPE Superdome Flex Server (medium 6.1)
- [CVE-2021-26588](https://insights.sbomify.com/CVE-2021-26588/): Other in HP 3PAR StoreServ 10000 Storage; HP 3PAR StoreServ 7000 Storage; HPE 3PAR StoreServ 8000 Storage; HPE Primera 600 Storage; HPE 3PAR StoreServ 20000; HPE Alletra 9000; HPE 3PAR StoreServ 9000 Storage (critical 9.8)
- [CVE-2021-26587](https://insights.sbomify.com/CVE-2021-26587/): Cross-site scripting in HPE StoreOnce 3620; HPE StoreOnce 3640; HPE StoreOnce 5200; HPE StoreOnce 5250; HPE StoreOnce 5650; HPE StoreOnce VSA 4TB (medium 6.5)
- [CVE-2021-26586](https://insights.sbomify.com/CVE-2021-26586/): Information disclosure in HPE Edgeline Infrastructure Management Software (high 7.5)
- [CVE-2021-26585](https://insights.sbomify.com/CVE-2021-26585/): Information disclosure in HPE OneView Global Dashboard (medium 5.5)
- [CVE-2021-26584](https://insights.sbomify.com/CVE-2021-26584/): Cross-site scripting in HPE OneView for VMware vCenter with Operations Manager and Log Insight (medium 6.1)
- [CVE-2021-26583](https://insights.sbomify.com/CVE-2021-26583/): Other in iLO Amplifier Pack (critical 9.8)
- [CVE-2021-26582](https://insights.sbomify.com/CVE-2021-26582/): Cross-site scripting in IceWall SSO Dgfw (medium 6.1)
- [CVE-2021-26581](https://insights.sbomify.com/CVE-2021-26581/): Denial of service in HPE Superdome Flex Server (medium 6.5)
- [CVE-2021-26580](https://insights.sbomify.com/CVE-2021-26580/): Cross-site scripting in iLO Amplifier Pack (medium 6.1)
- [CVE-2021-26579](https://insights.sbomify.com/CVE-2021-26579/): Hardcoded credentials in HPE Unified Data Management (UDM) (medium 5.5)
- [CVE-2021-26578](https://insights.sbomify.com/CVE-2021-26578/): SQL injection in HPE Network Orchestrator (high 7.5)
- [CVE-2021-26577](https://insights.sbomify.com/CVE-2021-26577/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26576](https://insights.sbomify.com/CVE-2021-26576/): Command injection in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26575](https://insights.sbomify.com/CVE-2021-26575/): Path traversal in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26574](https://insights.sbomify.com/CVE-2021-26574/): Path traversal in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26573](https://insights.sbomify.com/CVE-2021-26573/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26572](https://insights.sbomify.com/CVE-2021-26572/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26571](https://insights.sbomify.com/CVE-2021-26571/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26570](https://insights.sbomify.com/CVE-2021-26570/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-26569](https://insights.sbomify.com/CVE-2021-26569/): Race condition in Synology DiskStation Manager (DSM) (critical 9.8)
- [CVE-2021-26567](https://insights.sbomify.com/CVE-2021-26567/): Memory corruption in faad2 (high 7.8)
- [CVE-2021-26566](https://insights.sbomify.com/CVE-2021-26566/): Information disclosure in Synology DiskStation Manager (DSM) (high 8.3)
- [CVE-2021-26565](https://insights.sbomify.com/CVE-2021-26565/): Information disclosure in Synology DiskStation Manager (DSM) (high 8.3)
- [CVE-2021-26564](https://insights.sbomify.com/CVE-2021-26564/): Information disclosure in Synology DiskStation Manager (DSM) (high 8.3)
- [CVE-2021-26563](https://insights.sbomify.com/CVE-2021-26563/): Missing authorization in DiskStation Manager (DSM) (high 8.2)
- [CVE-2021-26562](https://insights.sbomify.com/CVE-2021-26562/): Memory corruption in Synology DiskStation Manager (DSM) (critical 9.0)
- [CVE-2021-26561](https://insights.sbomify.com/CVE-2021-26561/): Memory corruption in Synology DiskStation Manager (DSM) (critical 9.0)
- [CVE-2021-26560](https://insights.sbomify.com/CVE-2021-26560/): Information disclosure in Synology DiskStation Manager (DSM) (critical 9.0)
- [CVE-2021-26559](https://insights.sbomify.com/CVE-2021-26559/): CWE-284 Improper Access Control on Configurations Endpoint for the Stable API (medium 6.5)
- [CVE-2021-26558](https://insights.sbomify.com/CVE-2021-26558/): Deserialization of Untrusted Data (high 7.5)
- [CVE-2021-26557](https://insights.sbomify.com/CVE-2021-26557/): Privilege escalation in Octopus Tentacle (high 7.8)
- [CVE-2021-26556](https://insights.sbomify.com/CVE-2021-26556/): Privilege escalation in Octopus Server (high 7.8)
- [CVE-2021-26551](https://insights.sbomify.com/CVE-2021-26551/): Code injection in smartfoxserver:smartfoxserver (high 8.8)
- [CVE-2021-26550](https://insights.sbomify.com/CVE-2021-26550/): Information disclosure in smartfoxserver:smartfoxserver (medium 5.5)
- [CVE-2021-26549](https://insights.sbomify.com/CVE-2021-26549/): Cross-site scripting in smartfoxserver:smartfoxserver (medium 5.4)
- [CVE-2021-26544](https://insights.sbomify.com/CVE-2021-26544/): Apache Livy (Incubating) is vulnerable to cross site scripting (medium 5.4)
- [CVE-2021-26543](https://insights.sbomify.com/CVE-2021-26543/): Command injection in git-parse (high 8.8)
- [CVE-2021-26541](https://insights.sbomify.com/CVE-2021-26541/): Command injection in gitlog (critical 9.8)
- [CVE-2021-26540](https://insights.sbomify.com/CVE-2021-26540/): Improper Input Validation in sanitize-html (medium 5.3)
- [CVE-2021-26539](https://insights.sbomify.com/CVE-2021-26539/): Improper Input Validation in sanitize-html (medium 5.3)
- [CVE-2021-26530](https://insights.sbomify.com/CVE-2021-26530/): Memory corruption in cesanta:mongoose (critical 9.1)
- [CVE-2021-26529](https://insights.sbomify.com/CVE-2021-26529/): Memory corruption in cesanta:mongoose (critical 9.1)
- [CVE-2021-26528](https://insights.sbomify.com/CVE-2021-26528/): Memory corruption in cesanta:mongoose (critical 9.1)
- [CVE-2021-26505](https://insights.sbomify.com/CVE-2021-26505/): MrSwitch hello.js vulnerable to prototype pollution (critical 9.8)
- [CVE-2021-26504](https://insights.sbomify.com/CVE-2021-26504/): Path traversal in dgtl:huemagic (high 7.5)
- [CVE-2021-26476](https://insights.sbomify.com/CVE-2021-26476/): Command injection in eprints:eprints (critical 9.8)
- [CVE-2021-26475](https://insights.sbomify.com/CVE-2021-26475/): Cross-site scripting in eprints:eprints (medium 6.1)
- [CVE-2021-26474](https://insights.sbomify.com/CVE-2021-26474/): UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS (high 8.6)
- [CVE-2021-26473](https://insights.sbomify.com/CVE-2021-26473/): Unauthenticated arbitrary file upload and command execution in Vembu products (critical 9.8)
- [CVE-2021-26472](https://insights.sbomify.com/CVE-2021-26472/): Unauthenticated remote command execution with SYSTEM privileges in Vembu products (critical 10.0)
- [CVE-2021-26471](https://insights.sbomify.com/CVE-2021-26471/): Unauthenticated remote command execution in Vembu products (critical 9.8)
- [CVE-2021-26461](https://insights.sbomify.com/CVE-2021-26461/): malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds (critical 9.8)
- [CVE-2021-26444](https://insights.sbomify.com/CVE-2021-26444/): Azure RTOS Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-26443](https://insights.sbomify.com/CVE-2021-26443/): Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability (critical 9.0)
- [CVE-2021-26442](https://insights.sbomify.com/CVE-2021-26442/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2021-26441](https://insights.sbomify.com/CVE-2021-26441/): Storage Spaces Controller Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-26439](https://insights.sbomify.com/CVE-2021-26439/): Microsoft Edge for Android Information Disclosure Vulnerability (medium 4.6)
- [CVE-2021-26437](https://insights.sbomify.com/CVE-2021-26437/): Visual Studio Code Spoofing Vulnerability (medium 5.5)
- [CVE-2021-26436](https://insights.sbomify.com/CVE-2021-26436/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 6.1)
- [CVE-2021-26435](https://insights.sbomify.com/CVE-2021-26435/): Windows Scripting Engine Memory Corruption Vulnerability (high 8.1)
- [CVE-2021-26434](https://insights.sbomify.com/CVE-2021-26434/): Visual Studio Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-26433](https://insights.sbomify.com/CVE-2021-26433/): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-26432](https://insights.sbomify.com/CVE-2021-26432/): Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2021-26431](https://insights.sbomify.com/CVE-2021-26431/): Windows Recovery Environment Agent Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-26430](https://insights.sbomify.com/CVE-2021-26430/): Azure Sphere Denial of Service Vulnerability (medium 6.0)
- [CVE-2021-26429](https://insights.sbomify.com/CVE-2021-26429/): Azure Sphere Elevation of Privilege Vulnerability (high 7.7)
- [CVE-2021-26428](https://insights.sbomify.com/CVE-2021-26428/): Azure Sphere Information Disclosure Vulnerability (medium 4.4)
- [CVE-2021-26427](https://insights.sbomify.com/CVE-2021-26427/): Microsoft Exchange Server Remote Code Execution Vulnerability (critical 9.0)
- [CVE-2021-26426](https://insights.sbomify.com/CVE-2021-26426/): Windows User Account Profile Picture Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2021-26425](https://insights.sbomify.com/CVE-2021-26425/): Windows Event Tracing Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-26424](https://insights.sbomify.com/CVE-2021-26424/): Windows TCP/IP Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2021-26423](https://insights.sbomify.com/CVE-2021-26423/): .NET Core and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2021-26422](https://insights.sbomify.com/CVE-2021-26422/): Skype for Business and Lync Remote Code Execution Vulnerability (high 7.2)
- [CVE-2021-26421](https://insights.sbomify.com/CVE-2021-26421/): Skype for Business and Lync Spoofing Vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/197/