# Vulnerabilities published in 2021


- [CVE-2021-26309](https://insights.sbomify.com/CVE-2021-26309/): Information disclosure in jetbrains:teamcity (low 3.3)
- [CVE-2021-26308](https://insights.sbomify.com/CVE-2021-26308/): Uninitialized buffer use in marc (high 7.5)
- [CVE-2021-26307](https://insights.sbomify.com/CVE-2021-26307/): Error on unsupported architectures in raw-cpuid (medium 5.5)
- [CVE-2021-26306](https://insights.sbomify.com/CVE-2021-26306/): Soundness issue in raw-cpuid (high 7.5)
- [CVE-2021-26305](https://insights.sbomify.com/CVE-2021-26305/): Read of uninitialized memory in cdr (critical 9.8)
- [CVE-2021-26304](https://insights.sbomify.com/CVE-2021-26304/): Cross-site scripting in phpgurukul:daily expense tracker system (medium 5.4)
- [CVE-2021-26303](https://insights.sbomify.com/CVE-2021-26303/): Cross-site scripting in phpgurukul:daily expense tracker system (medium 6.1)
- [CVE-2021-26296](https://insights.sbomify.com/CVE-2021-26296/): Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces (high 7.5)
- [CVE-2021-26295](https://insights.sbomify.com/CVE-2021-26295/): RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI (critical 9.8)
- [CVE-2021-26294](https://insights.sbomify.com/CVE-2021-26294/): Path traversal in afterlogic:aurora (high 7.5)
- [CVE-2021-26293](https://insights.sbomify.com/CVE-2021-26293/): Path traversal in afterlogic:aurora (critical 9.8)
- [CVE-2021-26291](https://insights.sbomify.com/CVE-2021-26291/): block repositories using http by default (critical 9.1)
- [CVE-2021-26281](https://insights.sbomify.com/CVE-2021-26281/): Information disclosure vulnerability in Alarm clock module (medium 5.5)
- [CVE-2021-26280](https://insights.sbomify.com/CVE-2021-26280/): Permission bypass vulnerability in permission manager module (high 7.9)
- [CVE-2021-26279](https://insights.sbomify.com/CVE-2021-26279/): Information disclosure vulnerability in Weather module (medium 5.9)
- [CVE-2021-26278](https://insights.sbomify.com/CVE-2021-26278/): Sensitive information leakage vulnerability in wifi module (medium 6.3)
- [CVE-2021-26277](https://insights.sbomify.com/CVE-2021-26277/): Security Advisory | PendingIntent hijacking vulnerability in Framework Services (medium 5.6)
- [CVE-2021-26276](https://insights.sbomify.com/CVE-2021-26276/): Improper Control of Dynamically-Managed Code Resources in config-shield (medium 5.3)
- [CVE-2021-26275](https://insights.sbomify.com/CVE-2021-26275/): Command injection in eslint-fixer (critical 9.8)
- [CVE-2021-26274](https://insights.sbomify.com/CVE-2021-26274/): Misconfiguration in ninjarmm:ninjarmm (high 7.1)
- [CVE-2021-26273](https://insights.sbomify.com/CVE-2021-26273/): Missing authorization in ninjarmm:ninjarmm (high 7.8)
- [CVE-2021-26272](https://insights.sbomify.com/CVE-2021-26272/): Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4 (medium 6.5)
- [CVE-2021-26271](https://insights.sbomify.com/CVE-2021-26271/): CKEditor 4 ReDoS Vulnerability (medium 6.5)
- [CVE-2021-26267](https://insights.sbomify.com/CVE-2021-26267/): Security feature bypass in cpanel:cpanel (high 7.5)
- [CVE-2021-26266](https://insights.sbomify.com/CVE-2021-26266/): Security feature bypass in cpanel:cpanel (high 7.5)
- [CVE-2021-26264](https://insights.sbomify.com/CVE-2021-26264/): Emerson DeltaV Missing Authentication for Critical Function (medium 6.1)
- [CVE-2021-26263](https://insights.sbomify.com/CVE-2021-26263/): Cross-site scripting in Odoo Community (high 7.5)
- [CVE-2021-26262](https://insights.sbomify.com/CVE-2021-26262/): Philips MRI 1.5T and 3T Improper Access Control (medium 5.9)
- [CVE-2021-26260](https://insights.sbomify.com/CVE-2021-26260/): Integer overflow in OpenEXR (medium 5.5)
- [CVE-2021-26259](https://insights.sbomify.com/CVE-2021-26259/): Memory corruption in htmldoc (high 7.8)
- [CVE-2021-26258](https://insights.sbomify.com/CVE-2021-26258/): Privilege escalation in Intel(R) Killer(TM) Control Center software (high 7.8)
- [CVE-2021-26257](https://insights.sbomify.com/CVE-2021-26257/): Memory corruption in Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products (medium 5.5)
- [CVE-2021-26256](https://insights.sbomify.com/CVE-2021-26256/): WordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.7)
- [CVE-2021-26254](https://insights.sbomify.com/CVE-2021-26254/): Memory corruption in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products (medium 5.5)
- [CVE-2021-26253](https://insights.sbomify.com/CVE-2021-26253/): Bypass of Splunk Enterprise's implementation of DUO MFA (high 8.1)
- [CVE-2021-26252](https://insights.sbomify.com/CVE-2021-26252/): Memory corruption in htmldoc (high 7.8)
- [CVE-2021-26251](https://insights.sbomify.com/CVE-2021-26251/): Denial of service in Intel(R) Distribution of OpenVINO(TM) Toolkit (medium 5.3)
- [CVE-2021-26248](https://insights.sbomify.com/CVE-2021-26248/): Philips MRI 1.5T and 3T Incorrect Ownership Assignment (medium 5.9)
- [CVE-2021-26247](https://insights.sbomify.com/CVE-2021-26247/): Cross-site scripting in Cacti (medium 6.1)
- [CVE-2021-26237](https://insights.sbomify.com/CVE-2021-26237/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2021-26236](https://insights.sbomify.com/CVE-2021-26236/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2021-26235](https://insights.sbomify.com/CVE-2021-26235/): Null dereference in faststone:image viewer (high 7.8)
- [CVE-2021-26234](https://insights.sbomify.com/CVE-2021-26234/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2021-26233](https://insights.sbomify.com/CVE-2021-26233/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2021-26232](https://insights.sbomify.com/CVE-2021-26232/): SQL injection in simple college website project:simple college website (critical 9.8)
- [CVE-2021-26231](https://insights.sbomify.com/CVE-2021-26231/): SQL injection in fantastic blog cms project:fantastic blog cms (critical 9.8)
- [CVE-2021-26230](https://insights.sbomify.com/CVE-2021-26230/): Cross-site scripting in casap automated enrollment system project:casap automated enrollment system (medium 6.1)
- [CVE-2021-26229](https://insights.sbomify.com/CVE-2021-26229/): SQL injection in casap automated enrollment system project:casap automated enrollment system (critical 9.8)
- [CVE-2021-26228](https://insights.sbomify.com/CVE-2021-26228/): SQL injection in casap automated enrollment system project:casap automated enrollment system (critical 9.8)
- [CVE-2021-26227](https://insights.sbomify.com/CVE-2021-26227/): Cross-site scripting in casap automated enrollment system project:casap automated enrollment system (medium 6.1)
- [CVE-2021-26226](https://insights.sbomify.com/CVE-2021-26226/): SQL injection in casap automated enrollment system project:casap automated enrollment system (critical 9.8)
- [CVE-2021-26224](https://insights.sbomify.com/CVE-2021-26224/): Cross-site scripting in fantastic blog project:fantastic blog (medium 6.1)
- [CVE-2021-26223](https://insights.sbomify.com/CVE-2021-26223/): SQL injection in casap automated enrollment system project:casap automated enrollment system (critical 9.8)
- [CVE-2021-26222](https://insights.sbomify.com/CVE-2021-26222/): Memory corruption in ezxml project:ezxml (high 8.1)
- [CVE-2021-26221](https://insights.sbomify.com/CVE-2021-26221/): Memory corruption in ezxml project:ezxml (high 8.1)
- [CVE-2021-26220](https://insights.sbomify.com/CVE-2021-26220/): Memory corruption in ezxml project:ezxml (high 8.1)
- [CVE-2021-26216](https://insights.sbomify.com/CVE-2021-26216/): Cross-site request forgery in seeddms:seeddms (medium 4.3)
- [CVE-2021-26215](https://insights.sbomify.com/CVE-2021-26215/): Cross-site request forgery in seeddms:seeddms (medium 4.3)
- [CVE-2021-26201](https://insights.sbomify.com/CVE-2021-26201/): SQL injection in casap automated enrollment system project:casap automated enrollment system (critical 9.8)
- [CVE-2021-26200](https://insights.sbomify.com/CVE-2021-26200/): SQL injection in library system project:library system (critical 9.8)
- [CVE-2021-26199](https://insights.sbomify.com/CVE-2021-26199/): Use after free in jerryscript:jerryscript (medium 6.5)
- [CVE-2021-26198](https://insights.sbomify.com/CVE-2021-26198/): Memory corruption in jerryscript:jerryscript (medium 6.5)
- [CVE-2021-26197](https://insights.sbomify.com/CVE-2021-26197/): Null dereference in jerryscript:jerryscript (medium 6.5)
- [CVE-2021-26195](https://insights.sbomify.com/CVE-2021-26195/): Memory corruption in jerryscript:jerryscript (high 8.8)
- [CVE-2021-26194](https://insights.sbomify.com/CVE-2021-26194/): Use after free in jerryscript:jerryscript (medium 6.5)
- [CVE-2021-26123](https://insights.sbomify.com/CVE-2021-26123/): Cross-site scripting in livinglogic:xist4c (medium 6.1)
- [CVE-2021-26122](https://insights.sbomify.com/CVE-2021-26122/): Cross-site scripting in livinglogic:xist4c (medium 6.1)
- [CVE-2021-26120](https://insights.sbomify.com/CVE-2021-26120/): PHP Code Injection by malicious function name in smarty (critical 9.8)
- [CVE-2021-26119](https://insights.sbomify.com/CVE-2021-26119/): Sandbox escape through template_object in smarty (high 7.5)
- [CVE-2021-26118](https://insights.sbomify.com/CVE-2021-26118/): Flaw in ActiveMQ Artemis OpenWire support (high 7.5)
- [CVE-2021-26117](https://insights.sbomify.com/CVE-2021-26117/): ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind (high 7.5)
- [CVE-2021-26116](https://insights.sbomify.com/CVE-2021-26116/): Command injection in Fortinet FortiAuthenticator (medium 6.7)
- [CVE-2021-26115](https://insights.sbomify.com/CVE-2021-26115/): Command injection in FortiWAN (high 7.6)
- [CVE-2021-26114](https://insights.sbomify.com/CVE-2021-26114/): SQL injection in Fortinet FortiWAN (critical 9.8)
- [CVE-2021-26113](https://insights.sbomify.com/CVE-2021-26113/): Weak cryptography in Fortinet FortiWAN (medium 6.2)
- [CVE-2021-26112](https://insights.sbomify.com/CVE-2021-26112/): Memory corruption in Fortinet FortiWAN (high 8.1)
- [CVE-2021-26111](https://insights.sbomify.com/CVE-2021-26111/): Denial of service in Fortinet FortiSwitch (medium 6.5)
- [CVE-2021-26110](https://insights.sbomify.com/CVE-2021-26110/): Privilege escalation in Fortinet FortiOS, FortiProxy (high 7.8)
- [CVE-2021-26109](https://insights.sbomify.com/CVE-2021-26109/): Integer overflow in Fortinet FortiOS (high 8.1)
- [CVE-2021-26108](https://insights.sbomify.com/CVE-2021-26108/): Hardcoded credentials in Fortinet FortiOS (high 7.5)
- [CVE-2021-26107](https://insights.sbomify.com/CVE-2021-26107/): Missing authorization in Fortinet FortiManager (medium 6.3)
- [CVE-2021-26106](https://insights.sbomify.com/CVE-2021-26106/): Command injection in Fortinet FortiAP-W2, FortiAP-S, FortiAP (high 7.8)
- [CVE-2021-26105](https://insights.sbomify.com/CVE-2021-26105/): Memory corruption in FortiSandbox (medium 6.4)
- [CVE-2021-26104](https://insights.sbomify.com/CVE-2021-26104/): Command injection in Fortinet FortiManager, FortiAnalyzer, FortiPortal (high 7.8)
- [CVE-2021-26103](https://insights.sbomify.com/CVE-2021-26103/): Cross-site request forgery in Fortinet FortiOS (medium 6.3)
- [CVE-2021-26102](https://insights.sbomify.com/CVE-2021-26102/): Path traversal in FortiWAN (critical 9.8)
- [CVE-2021-26100](https://insights.sbomify.com/CVE-2021-26100/): Weak cryptography in Fortinet FortiMail (medium 5.9)
- [CVE-2021-26099](https://insights.sbomify.com/CVE-2021-26099/): Weak cryptography in Fortinet FortiMail (medium 4.4)
- [CVE-2021-26098](https://insights.sbomify.com/CVE-2021-26098/): Weak cryptography in Fortinet FortiSandbox (medium 5.3)
- [CVE-2021-26097](https://insights.sbomify.com/CVE-2021-26097/): Command injection in Fortinet FortiSandbox (high 8.8)
- [CVE-2021-26096](https://insights.sbomify.com/CVE-2021-26096/): Memory corruption in Fortinet FortiSandbox (medium 6.4)
- [CVE-2021-26095](https://insights.sbomify.com/CVE-2021-26095/): Weak cryptography in Fortinet FortiMail (high 7.5)
- [CVE-2021-26093](https://insights.sbomify.com/CVE-2021-26093/): Memory corruption in FortiWLC (medium 6.6)
- [CVE-2021-26092](https://insights.sbomify.com/CVE-2021-26092/): Cross-site scripting in Fortinet FortiOS, FortiProxy (medium 4.7)
- [CVE-2021-26091](https://insights.sbomify.com/CVE-2021-26091/): Weak cryptography in FortiMail (medium 6.9)
- [CVE-2021-26090](https://insights.sbomify.com/CVE-2021-26090/): Denial of service in Fortinet FortiMail (medium 5.3)
- [CVE-2021-26089](https://insights.sbomify.com/CVE-2021-26089/): Privilege escalation in Fortinet FortiClientMac (medium 6.7)
- [CVE-2021-26088](https://insights.sbomify.com/CVE-2021-26088/): Auth bypass in Fortinet FSSO Windows DC Agent, FSSO Windows CA (high 7.1)
- [CVE-2021-26087](https://insights.sbomify.com/CVE-2021-26087/): Cross-site scripting in FortiWLC (medium 4.2)
- [CVE-2021-26086](https://insights.sbomify.com/CVE-2021-26086/): Atlassian Jira Server and Data Center Path Traversal (medium 5.3, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/199/