# Vulnerabilities published in 2021


- [CVE-2021-25927](https://insights.sbomify.com/CVE-2021-25927/): Prototype pollution in safe-flat (critical 9.8)
- [CVE-2021-25926](https://insights.sbomify.com/CVE-2021-25926/): Cross-site scripting in sickrage (medium 6.1)
- [CVE-2021-25925](https://insights.sbomify.com/CVE-2021-25925/): Cross-site scripting in SiCKRAGE (medium 5.4)
- [CVE-2021-25924](https://insights.sbomify.com/CVE-2021-25924/): Cross-site request forgery in gocd (high 8.8)
- [CVE-2021-25923](https://insights.sbomify.com/CVE-2021-25923/): Weak cryptography in openemr (high 8.1)
- [CVE-2021-25922](https://insights.sbomify.com/CVE-2021-25922/): Cross-site scripting in openemr (medium 6.1)
- [CVE-2021-25921](https://insights.sbomify.com/CVE-2021-25921/): Cross-site scripting in openemr (medium 5.4)
- [CVE-2021-25920](https://insights.sbomify.com/CVE-2021-25920/): Missing authorization in openemr (medium 6.5)
- [CVE-2021-25919](https://insights.sbomify.com/CVE-2021-25919/): Cross-site scripting in openemr (medium 4.8)
- [CVE-2021-25918](https://insights.sbomify.com/CVE-2021-25918/): Cross-site scripting in openemr (medium 4.8)
- [CVE-2021-25917](https://insights.sbomify.com/CVE-2021-25917/): Cross-site scripting in openemr (medium 4.8)
- [CVE-2021-25916](https://insights.sbomify.com/CVE-2021-25916/): Prototype pollution vulnerability in 'patchmerge' (critical 9.8)
- [CVE-2021-25915](https://insights.sbomify.com/CVE-2021-25915/): Changeset vulnerable to prototype pollution (critical 9.8)
- [CVE-2021-25914](https://insights.sbomify.com/CVE-2021-25914/): Prototype Pollution Vulnerability in object-collider (critical 9.8)
- [CVE-2021-25913](https://insights.sbomify.com/CVE-2021-25913/): Prototype Pollution in set-or-get (critical 9.8)
- [CVE-2021-25912](https://insights.sbomify.com/CVE-2021-25912/): Prototype pollution in dotty (critical 9.8)
- [CVE-2021-25910](https://insights.sbomify.com/CVE-2021-25910/): ZIV AUTOMATION 4CCT vulnerable to improper authentication (high 8.0)
- [CVE-2021-25909](https://insights.sbomify.com/CVE-2021-25909/): ZIV AUTOMATION 4CCT Denial of Service vulnerability (high 8.6)
- [CVE-2021-25908](https://insights.sbomify.com/CVE-2021-25908/): Double free in fil-ocl (high 7.5)
- [CVE-2021-25907](https://insights.sbomify.com/CVE-2021-25907/): Double free in containers (critical 9.8)
- [CVE-2021-25906](https://insights.sbomify.com/CVE-2021-25906/): Double free in basic_dsp_matrix (high 7.5)
- [CVE-2021-25905](https://insights.sbomify.com/CVE-2021-25905/): Out of bounds read in bra (critical 9.1)
- [CVE-2021-25904](https://insights.sbomify.com/CVE-2021-25904/): Null pointer deference in av-data (high 7.5)
- [CVE-2021-25903](https://insights.sbomify.com/CVE-2021-25903/): Null pointer deference in cache (high 7.5)
- [CVE-2021-25902](https://insights.sbomify.com/CVE-2021-25902/): Double free in glsl-layout (high 7.5)
- [CVE-2021-25901](https://insights.sbomify.com/CVE-2021-25901/): Out of bounds read in lazy-init (medium 5.3)
- [CVE-2021-25900](https://insights.sbomify.com/CVE-2021-25900/): Buffer overflow in SmallVec::insert_many (critical 9.8)
- [CVE-2021-25899](https://insights.sbomify.com/CVE-2021-25899/): SQL injection in void:aurall rec monitor (high 7.5)
- [CVE-2021-25898](https://insights.sbomify.com/CVE-2021-25898/): Hardcoded credentials in void:aural rec monitor (high 7.5)
- [CVE-2021-25894](https://insights.sbomify.com/CVE-2021-25894/): Cross-site scripting in magnolia-cms:magnolia cms (medium 6.1)
- [CVE-2021-25893](https://insights.sbomify.com/CVE-2021-25893/): Cross-site scripting in magnolia-cms:magnolia cms (medium 5.4)
- [CVE-2021-25878](https://insights.sbomify.com/CVE-2021-25878/): Cross-site scripting in youphptube:youphptube (medium 6.1)
- [CVE-2021-25877](https://insights.sbomify.com/CVE-2021-25877/): Code injection in youphptube:youphptube (high 7.2)
- [CVE-2021-25876](https://insights.sbomify.com/CVE-2021-25876/): Cross-site scripting in youphptube:youphptube (medium 6.1)
- [CVE-2021-25875](https://insights.sbomify.com/CVE-2021-25875/): Cross-site scripting in youphptube:youphptube (medium 6.1)
- [CVE-2021-25874](https://insights.sbomify.com/CVE-2021-25874/): SQL injection in youphptube:youphptube (high 7.5)
- [CVE-2021-25864](https://insights.sbomify.com/CVE-2021-25864/): Path Traversal in node-red-contrib-huemagic (high 7.5)
- [CVE-2021-25863](https://insights.sbomify.com/CVE-2021-25863/): Hardcoded credentials in open5gs:open5gs (high 8.8)
- [CVE-2021-25857](https://insights.sbomify.com/CVE-2021-25857/): Code injection in supermicro-cms project:supermicro-cms (high 7.2)
- [CVE-2021-25856](https://insights.sbomify.com/CVE-2021-25856/): Path traversal in supermicro-cms project:supermicro-cms (medium 4.9)
- [CVE-2021-25849](https://insights.sbomify.com/CVE-2021-25849/): Integer overflow in moxa:vport 06ec-2v26m firmware (high 7.5)
- [CVE-2021-25848](https://insights.sbomify.com/CVE-2021-25848/): Memory corruption in moxa:vport 06ec-2v26m firmware (critical 9.1)
- [CVE-2021-25847](https://insights.sbomify.com/CVE-2021-25847/): Information disclosure in moxa:vport 06ec-2v26m firmware (critical 9.1)
- [CVE-2021-25846](https://insights.sbomify.com/CVE-2021-25846/): Integer overflow in moxa:vport 06ec-2v26m firmware (high 7.5)
- [CVE-2021-25845](https://insights.sbomify.com/CVE-2021-25845/): Null dereference in moxa:vport 06ec-2v26m firmware (high 7.5)
- [CVE-2021-25839](https://insights.sbomify.com/CVE-2021-25839/): Weak cryptography in minthcm:minthcm (critical 9.8)
- [CVE-2021-25838](https://insights.sbomify.com/CVE-2021-25838/): Cross-site scripting in minthcm:minthcm (medium 6.1)
- [CVE-2021-25837](https://insights.sbomify.com/CVE-2021-25837/): Business logic in chainsafe:ethermint (high 7.5)
- [CVE-2021-25836](https://insights.sbomify.com/CVE-2021-25836/): Business logic in chainsafe:ethermint (high 7.5)
- [CVE-2021-25835](https://insights.sbomify.com/CVE-2021-25835/): Authentication bypass by capture-replay in github.com/cosmos/ethermint (high 7.5)
- [CVE-2021-25834](https://insights.sbomify.com/CVE-2021-25834/): Authentication bypass by capture-replay in github.com/cosmos/ethermint (high 7.5)
- [CVE-2021-25833](https://insights.sbomify.com/CVE-2021-25833/): 12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 (critical 9.8)
- [CVE-2021-25832](https://insights.sbomify.com/CVE-2021-25832/): Memory corruption in onlyoffice:document server (critical 9.8)
- [CVE-2021-25831](https://insights.sbomify.com/CVE-2021-25831/): Code injection in onlyoffice:document server (critical 9.8)
- [CVE-2021-25830](https://insights.sbomify.com/CVE-2021-25830/): Code injection in onlyoffice:document server (critical 9.8)
- [CVE-2021-25829](https://insights.sbomify.com/CVE-2021-25829/): Denial of service in onlyoffice:document server (high 7.5)
- [CVE-2021-25828](https://insights.sbomify.com/CVE-2021-25828/): Cross-site scripting in emby:emby (medium 6.1)
- [CVE-2021-25827](https://insights.sbomify.com/CVE-2021-25827/): Auth bypass in emby:emby (critical 9.8)
- [CVE-2021-25812](https://insights.sbomify.com/CVE-2021-25812/): Command injection in chinamobile:an lianbao wf-1 firmware (critical 9.8)
- [CVE-2021-25811](https://insights.sbomify.com/CVE-2021-25811/): Denial of service in mercusys:mercury x18g firmware (high 7.5)
- [CVE-2021-25810](https://insights.sbomify.com/CVE-2021-25810/): Cross-site scripting in mercusys:mercury x18g firmware (medium 6.1)
- [CVE-2021-25809](https://insights.sbomify.com/CVE-2021-25809/): Information disclosure in ucms project:ucms (medium 5.3)
- [CVE-2021-25808](https://insights.sbomify.com/CVE-2021-25808/): Code injection in bludit:bludit (high 7.8)
- [CVE-2021-25804](https://insights.sbomify.com/CVE-2021-25804/): Null dereference in videolan:vlc media player (high 7.5)
- [CVE-2021-25803](https://insights.sbomify.com/CVE-2021-25803/): Memory corruption in videolan:vlc media player (high 7.1)
- [CVE-2021-25802](https://insights.sbomify.com/CVE-2021-25802/): Memory corruption in videolan:vlc media player (high 7.1)
- [CVE-2021-25801](https://insights.sbomify.com/CVE-2021-25801/): Memory corruption in videolan:vlc media player (high 7.1)
- [CVE-2021-25791](https://insights.sbomify.com/CVE-2021-25791/): Cross-site scripting in online doctor appointment system php full source code project:online doctor appointment system php full source code (medium 5.4)
- [CVE-2021-25790](https://insights.sbomify.com/CVE-2021-25790/): Cross-site scripting in house rental and property listing php project:house rental and property listing php (medium 5.4)
- [CVE-2021-25786](https://insights.sbomify.com/CVE-2021-25786/): Use after free in qpdf project:qpdf (medium 5.3)
- [CVE-2021-25785](https://insights.sbomify.com/CVE-2021-25785/): Cross-site scripting in taogogo:taocms (medium 4.8)
- [CVE-2021-25784](https://insights.sbomify.com/CVE-2021-25784/): SQL injection in taogogo:taocms (high 7.2)
- [CVE-2021-25783](https://insights.sbomify.com/CVE-2021-25783/): SQL injection in taogogo:taocms (high 7.2)
- [CVE-2021-25780](https://insights.sbomify.com/CVE-2021-25780/): File upload in janobe:baby care system (high 7.2)
- [CVE-2021-25779](https://insights.sbomify.com/CVE-2021-25779/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2021-25778](https://insights.sbomify.com/CVE-2021-25778/): Missing authorization in jetbrains:teamcity (medium 5.3)
- [CVE-2021-25777](https://insights.sbomify.com/CVE-2021-25777/): Missing authorization in jetbrains:teamcity (medium 5.3)
- [CVE-2021-25776](https://insights.sbomify.com/CVE-2021-25776/): Information disclosure in jetbrains:teamcity (high 7.5)
- [CVE-2021-25775](https://insights.sbomify.com/CVE-2021-25775/): Missing authorization in jetbrains:teamcity (low 3.8)
- [CVE-2021-25774](https://insights.sbomify.com/CVE-2021-25774/): Missing authorization in jetbrains:teamcity (medium 4.3)
- [CVE-2021-25773](https://insights.sbomify.com/CVE-2021-25773/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2021-25772](https://insights.sbomify.com/CVE-2021-25772/): Denial of service in jetbrains:teamcity (medium 5.3)
- [CVE-2021-25771](https://insights.sbomify.com/CVE-2021-25771/): Information disclosure in jetbrains:youtrack (medium 4.3)
- [CVE-2021-25770](https://insights.sbomify.com/CVE-2021-25770/): Code injection in jetbrains:youtrack (critical 9.8)
- [CVE-2021-25769](https://insights.sbomify.com/CVE-2021-25769/): Missing authorization in jetbrains:youtrack (high 7.5)
- [CVE-2021-25768](https://insights.sbomify.com/CVE-2021-25768/): Missing authorization in jetbrains:youtrack (medium 5.3)
- [CVE-2021-25767](https://insights.sbomify.com/CVE-2021-25767/): Information disclosure in jetbrains:youtrack (medium 5.3)
- [CVE-2021-25766](https://insights.sbomify.com/CVE-2021-25766/): Missing authorization in jetbrains:youtrack (medium 5.3)
- [CVE-2021-25765](https://insights.sbomify.com/CVE-2021-25765/): Cross-site request forgery in jetbrains:youtrack (high 8.8)
- [CVE-2021-25764](https://insights.sbomify.com/CVE-2021-25764/): Information disclosure in jetbrains:phpstorm (medium 5.3)
- [CVE-2021-25763](https://insights.sbomify.com/CVE-2021-25763/): Weak cryptography in jetbrains:ktor (medium 5.3)
- [CVE-2021-25762](https://insights.sbomify.com/CVE-2021-25762/): Other in jetbrains:ktor (medium 5.3)
- [CVE-2021-25761](https://insights.sbomify.com/CVE-2021-25761/): Weak cryptography in jetbrains:ktor (medium 5.3)
- [CVE-2021-25760](https://insights.sbomify.com/CVE-2021-25760/): Information disclosure in jetbrains:hub (medium 5.3)
- [CVE-2021-25759](https://insights.sbomify.com/CVE-2021-25759/): Missing authorization in jetbrains:hub (medium 6.5)
- [CVE-2021-25758](https://insights.sbomify.com/CVE-2021-25758/): Deserialization in jetbrains:intellij idea (high 7.8)
- [CVE-2021-25757](https://insights.sbomify.com/CVE-2021-25757/): Open redirect in jetbrains:hub (medium 6.1)
- [CVE-2021-25756](https://insights.sbomify.com/CVE-2021-25756/): Weak cryptography in jetbrains:intellij idea (medium 5.3)
- [CVE-2021-25755](https://insights.sbomify.com/CVE-2021-25755/): Weak cryptography in jetbrains:code with me (low 2.5)
- [CVE-2021-25749](https://insights.sbomify.com/CVE-2021-25749/): runAsNonRoot logic bypass for Windows containers (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/201/