# Vulnerabilities published in 2021


- [CVE-2021-26085](https://insights.sbomify.com/CVE-2021-26085/): Atlassian Confluence Server Pre-Authorization Arbitrary File Read (medium 5.3, exploited in the wild)
- [CVE-2021-26084](https://insights.sbomify.com/CVE-2021-26084/): Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection (critical 9.8, exploited in the wild)
- [CVE-2021-26083](https://insights.sbomify.com/CVE-2021-26083/): Cross-site scripting in Jira Data Center (medium 5.4)
- [CVE-2021-26082](https://insights.sbomify.com/CVE-2021-26082/): Cross-site scripting in Jira Data Center (medium 5.4)
- [CVE-2021-26081](https://insights.sbomify.com/CVE-2021-26081/): Information disclosure in Jira Data Center (medium 5.3)
- [CVE-2021-26080](https://insights.sbomify.com/CVE-2021-26080/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2021-26079](https://insights.sbomify.com/CVE-2021-26079/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2021-26078](https://insights.sbomify.com/CVE-2021-26078/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2021-26077](https://insights.sbomify.com/CVE-2021-26077/): Improper Authentication in Atlassian Connect Spring Boot (critical 9.1)
- [CVE-2021-26076](https://insights.sbomify.com/CVE-2021-26076/): Information disclosure in Jira Data Center (low 3.7)
- [CVE-2021-26075](https://insights.sbomify.com/CVE-2021-26075/): Information disclosure in Jira Data Center (medium 4.3)
- [CVE-2021-26074](https://insights.sbomify.com/CVE-2021-26074/): Broken Authentication in Atlassian Connect Spring Boot (medium 6.5)
- [CVE-2021-26073](https://insights.sbomify.com/CVE-2021-26073/): Broken Authentication in Atlassian Connect Express (high 7.7)
- [CVE-2021-26072](https://insights.sbomify.com/CVE-2021-26072/): Server-side request forgery in Confluence Data Center (medium 4.3)
- [CVE-2021-26071](https://insights.sbomify.com/CVE-2021-26071/): Cross-site request forgery in Jira Data Center (low 3.5)
- [CVE-2021-26070](https://insights.sbomify.com/CVE-2021-26070/): Auth bypass in Jira Data Center (high 7.2)
- [CVE-2021-26069](https://insights.sbomify.com/CVE-2021-26069/): Information disclosure in Jira Data Center (medium 5.3)
- [CVE-2021-26068](https://insights.sbomify.com/CVE-2021-26068/): Code injection in Jira Server for Slack (high 8.8)
- [CVE-2021-26067](https://insights.sbomify.com/CVE-2021-26067/): Information disclosure in Bamboo (medium 5.3)
- [CVE-2021-26040](https://insights.sbomify.com/CVE-2021-26040/): [20210801] - Core - Insufficient access control for com_media deletion endpoint (critical 9.1)
- [CVE-2021-26039](https://insights.sbomify.com/CVE-2021-26039/): [20210705] - Core - XSS in com_media imagelist (medium 6.1)
- [CVE-2021-26038](https://insights.sbomify.com/CVE-2021-26038/): [20210704] - Core - Privilege escalation through com_installer (high 7.5)
- [CVE-2021-26037](https://insights.sbomify.com/CVE-2021-26037/): [20210703] - Core - Lack of enforced session termination (medium 5.3)
- [CVE-2021-26036](https://insights.sbomify.com/CVE-2021-26036/): [20210702] - Core - DoS through usergroup table manipulation (high 7.5)
- [CVE-2021-26035](https://insights.sbomify.com/CVE-2021-26035/): [20210701] - Core - XSS in JForm Rules field (medium 6.1)
- [CVE-2021-26034](https://insights.sbomify.com/CVE-2021-26034/): [20210503] - Core - CSRF in data download endpoints (medium 6.5)
- [CVE-2021-26033](https://insights.sbomify.com/CVE-2021-26033/): [20210502] - Core - CSRF in AJAX reordering endpoint (medium 6.5)
- [CVE-2021-26032](https://insights.sbomify.com/CVE-2021-26032/): [20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload (medium 6.1)
- [CVE-2021-26031](https://insights.sbomify.com/CVE-2021-26031/): [20210402] - Core - Inadequate filters on module layout settings (medium 5.3)
- [CVE-2021-26030](https://insights.sbomify.com/CVE-2021-26030/): [20210401] - Core - Escape xss in logo parameter error pages (medium 6.1)
- [CVE-2021-26029](https://insights.sbomify.com/CVE-2021-26029/): [20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field (medium 5.3)
- [CVE-2021-26028](https://insights.sbomify.com/CVE-2021-26028/): [20210308] - Core - Path Traversal within joomla/archive zip class (medium 5.5)
- [CVE-2021-26027](https://insights.sbomify.com/CVE-2021-26027/): [20210307] - Core - ACL violation within com_content frontend editing (medium 5.3)
- [CVE-2021-26026](https://insights.sbomify.com/CVE-2021-26026/): Memory corruption in acdsee:photo studio 2021 (high 7.8)
- [CVE-2021-26025](https://insights.sbomify.com/CVE-2021-26025/): Memory corruption in acdsee:photo studio 2021 (high 7.8)
- [CVE-2021-26024](https://insights.sbomify.com/CVE-2021-26024/): Missing authorization in nagios:favorites (medium 5.3)
- [CVE-2021-26023](https://insights.sbomify.com/CVE-2021-26023/): Cross-site scripting in nagios:favorites (medium 6.1)
- [CVE-2021-25994](https://insights.sbomify.com/CVE-2021-25994/): Userfrosting - Host-Header Injection Leads to Account Takeover (high 8.8)
- [CVE-2021-25993](https://insights.sbomify.com/CVE-2021-25993/): Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor (medium 5.4)
- [CVE-2021-25992](https://insights.sbomify.com/CVE-2021-25992/): ifme - Insufficient Session Expiration (critical 9.8)
- [CVE-2021-25991](https://insights.sbomify.com/CVE-2021-25991/): ifme - Improper Access Control leads to admin deactivation (medium 5.7)
- [CVE-2021-25990](https://insights.sbomify.com/CVE-2021-25990/): ifme - Stored Cross-Site Scripting (XSS) in Contacts section (medium 5.4)
- [CVE-2021-25989](https://insights.sbomify.com/CVE-2021-25989/): ifme - Stored Cross-Site Scripting (XSS) in Groups section (medium 5.4)
- [CVE-2021-25988](https://insights.sbomify.com/CVE-2021-25988/): ifme - Stored Cross-Site Scripting (XSS) in Notifications section (medium 5.4)
- [CVE-2021-25987](https://insights.sbomify.com/CVE-2021-25987/): Hexo - Stored XSS (medium 5.0)
- [CVE-2021-25986](https://insights.sbomify.com/CVE-2021-25986/): Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications Section (medium 5.4)
- [CVE-2021-25985](https://insights.sbomify.com/CVE-2021-25985/): FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover (high 7.8)
- [CVE-2021-25984](https://insights.sbomify.com/CVE-2021-25984/): FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality (medium 6.1)
- [CVE-2021-25983](https://insights.sbomify.com/CVE-2021-25983/): FactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories Functionality (medium 6.1)
- [CVE-2021-25982](https://insights.sbomify.com/CVE-2021-25982/): FactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality (medium 6.1)
- [CVE-2021-25981](https://insights.sbomify.com/CVE-2021-25981/): Talkyard - Insufficient Session Expiration (critical 9.8)
- [CVE-2021-25980](https://insights.sbomify.com/CVE-2021-25980/): Talkyard - Host-Header Injection Leads to Account Takeover (high 8.8)
- [CVE-2021-25979](https://insights.sbomify.com/CVE-2021-25979/): Apostrophe - Insufficient Session Expiration (critical 9.8)
- [CVE-2021-25978](https://insights.sbomify.com/CVE-2021-25978/): Apostrophe - XSS (medium 5.4)
- [CVE-2021-25977](https://insights.sbomify.com/CVE-2021-25977/): Piranha CMS - Stored XSS in Page Title (medium 5.4)
- [CVE-2021-25976](https://insights.sbomify.com/CVE-2021-25976/): Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF) (high 8.1)
- [CVE-2021-25975](https://insights.sbomify.com/CVE-2021-25975/): Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File Upload (medium 5.4)
- [CVE-2021-25974](https://insights.sbomify.com/CVE-2021-25974/): Publify - Stored Cross-Site Scripting (XSS) in Editor (medium 5.4)
- [CVE-2021-25973](https://insights.sbomify.com/CVE-2021-25973/): Publify - Improper Authorization Leads to Guest Signup Restriction Bypass (medium 6.5)
- [CVE-2021-25972](https://insights.sbomify.com/CVE-2021-25972/): Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature (medium 4.9)
- [CVE-2021-25971](https://insights.sbomify.com/CVE-2021-25971/): Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature (medium 4.3)
- [CVE-2021-25970](https://insights.sbomify.com/CVE-2021-25970/): Camaleon CMS - Insufficient Session Expiration after Password Change (high 8.8)
- [CVE-2021-25969](https://insights.sbomify.com/CVE-2021-25969/): Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments (medium 6.1)
- [CVE-2021-25968](https://insights.sbomify.com/CVE-2021-25968/): OpenCMS - Stored Cross-Site Scripting (XSS) in Sitemap (medium 5.4)
- [CVE-2021-25967](https://insights.sbomify.com/CVE-2021-25967/): CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload (medium 5.4)
- [CVE-2021-25966](https://insights.sbomify.com/CVE-2021-25966/): Orchard Core CMS - Improper Session Termination after Password Change (high 8.8)
- [CVE-2021-25965](https://insights.sbomify.com/CVE-2021-25965/): Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF) (high 8.8)
- [CVE-2021-25964](https://insights.sbomify.com/CVE-2021-25964/): Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata (medium 5.4)
- [CVE-2021-25963](https://insights.sbomify.com/CVE-2021-25963/): Shuup - Reflected XSS in Error Page (medium 6.1)
- [CVE-2021-25962](https://insights.sbomify.com/CVE-2021-25962/): Shuup - Formula Injection in Checkout Addresses (high 8.0)
- [CVE-2021-25961](https://insights.sbomify.com/CVE-2021-25961/): SuiteCRM - Account Takeover in Password Reset Functionality (high 8.0)
- [CVE-2021-25960](https://insights.sbomify.com/CVE-2021-25960/): SuiteCRM - CSV Injection in Accounts Module (high 8.0)
- [CVE-2021-25959](https://insights.sbomify.com/CVE-2021-25959/): OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality (medium 6.1)
- [CVE-2021-25958](https://insights.sbomify.com/CVE-2021-25958/): Generation of Error Message Containing Sensitive Information in Apache OFBiz (medium 6.5)
- [CVE-2021-25957](https://insights.sbomify.com/CVE-2021-25957/): Account Takeover in "Dolibarr" via Password Reset Functionality (high 8.8)
- [CVE-2021-25956](https://insights.sbomify.com/CVE-2021-25956/): Improper User Access Control in "Dolibarr" Leads to Account Takeover (medium 4.7)
- [CVE-2021-25955](https://insights.sbomify.com/CVE-2021-25955/): Stored XSS in “Dolibarr” leads to privilege escalation (critical 9.0)
- [CVE-2021-25954](https://insights.sbomify.com/CVE-2021-25954/): Improper Access Control in “Dolibarr” (medium 4.3)
- [CVE-2021-25953](https://insights.sbomify.com/CVE-2021-25953/): Prototype Pollution in putil-merge (critical 9.8)
- [CVE-2021-25952](https://insights.sbomify.com/CVE-2021-25952/): Prototype polluation in just-safe-set (critical 9.8)
- [CVE-2021-25951](https://insights.sbomify.com/CVE-2021-25951/): XML2Dict XML Entity Expansion Vulnerability (high 7.5)
- [CVE-2021-25949](https://insights.sbomify.com/CVE-2021-25949/): set-getter Prototype Pollution Vulnerability (critical 9.8)
- [CVE-2021-25948](https://insights.sbomify.com/CVE-2021-25948/): Prototype Pollution (critical 9.8)
- [CVE-2021-25947](https://insights.sbomify.com/CVE-2021-25947/): Prototype pollution in nestie (critical 9.8)
- [CVE-2021-25946](https://insights.sbomify.com/CVE-2021-25946/): Prototype pollution in nconf-toml (critical 9.8)
- [CVE-2021-25945](https://insights.sbomify.com/CVE-2021-25945/): Prototype pollution vulnerability in js-extend (critical 9.8)
- [CVE-2021-25944](https://insights.sbomify.com/CVE-2021-25944/): deep-defaults vulnerable to prototype pollution (critical 9.8)
- [CVE-2021-25943](https://insights.sbomify.com/CVE-2021-25943/): Prototype pollution in 101 (critical 9.8)
- [CVE-2021-25941](https://insights.sbomify.com/CVE-2021-25941/): Prototype Pollution in deep-override (critical 9.8)
- [CVE-2021-25940](https://insights.sbomify.com/CVE-2021-25940/): ArangoDB - Insufficient Session Expiration after Password Change (high 8.8)
- [CVE-2021-25939](https://insights.sbomify.com/CVE-2021-25939/): ArangoDB - Blind SSRF when Downloading Foxx Service from URL (low 2.7)
- [CVE-2021-25938](https://insights.sbomify.com/CVE-2021-25938/): Cross-site scripting in ArangoDB (medium 6.1)
- [CVE-2021-25935](https://insights.sbomify.com/CVE-2021-25935/): Cross-site scripting in OpenNMS (medium 5.4)
- [CVE-2021-25934](https://insights.sbomify.com/CVE-2021-25934/): OpenNMS Horizon vulnerable to XSS (medium 5.4)
- [CVE-2021-25933](https://insights.sbomify.com/CVE-2021-25933/): Cross-site Scripting in OpenNMS Horizon (medium 4.8)
- [CVE-2021-25932](https://insights.sbomify.com/CVE-2021-25932/): Cross-site scripting in OpenNMS (medium 5.4)
- [CVE-2021-25931](https://insights.sbomify.com/CVE-2021-25931/): Cross-Site Request Forgery in OpenNMS Horizon (high 8.8)
- [CVE-2021-25930](https://insights.sbomify.com/CVE-2021-25930/): Cross-Site Request Forgery in OpenNMS Horizon (medium 4.3)
- [CVE-2021-25929](https://insights.sbomify.com/CVE-2021-25929/): Cross-site Scripting in OpenNMS Horizon (medium 4.8)
- [CVE-2021-25928](https://insights.sbomify.com/CVE-2021-25928/): Prototype pollution in safe-obj (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/200/