# Vulnerabilities published in 2021


- [CVE-2021-25748](https://insights.sbomify.com/CVE-2021-25748/): Ingress-nginx `path` sanitization can be bypassed with newline character (high 7.6)
- [CVE-2021-25746](https://insights.sbomify.com/CVE-2021-25746/): Ingress-nginx directive injection via annotations (high 7.6)
- [CVE-2021-25745](https://insights.sbomify.com/CVE-2021-25745/): Ingress-nginx path can be pointed to service account token file (high 7.6)
- [CVE-2021-25743](https://insights.sbomify.com/CVE-2021-25743/): ANSI escape characters in kubectl output are not being filtered (low 3.0)
- [CVE-2021-25742](https://insights.sbomify.com/CVE-2021-25742/): Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces (high 7.6)
- [CVE-2021-25741](https://insights.sbomify.com/CVE-2021-25741/): Symlink Exchange Can Allow Host Filesystem Access (high 8.8)
- [CVE-2021-25740](https://insights.sbomify.com/CVE-2021-25740/): Holes in EndpointSlice Validation Enable Host Network Hijack (low 3.1)
- [CVE-2021-25738](https://insights.sbomify.com/CVE-2021-25738/): Code exec via yaml parsing (medium 6.7)
- [CVE-2021-25737](https://insights.sbomify.com/CVE-2021-25737/): Holes in EndpointSlice Validation Enable Host Network Hijack (low 2.7)
- [CVE-2021-25736](https://insights.sbomify.com/CVE-2021-25736/): Windows kube-proxy LoadBalancer contention (medium 5.8)
- [CVE-2021-25735](https://insights.sbomify.com/CVE-2021-25735/): Validating Admission Webhook does not observe some previous fields (medium 6.5)
- [CVE-2021-25701](https://insights.sbomify.com/CVE-2021-25701/): Denial of service in - PCoIP Software Client (medium 5.5)
- [CVE-2021-25699](https://insights.sbomify.com/CVE-2021-25699/): Privilege escalation in - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client (high 7.8)
- [CVE-2021-25698](https://insights.sbomify.com/CVE-2021-25698/): Privilege escalation in - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client (high 7.8)
- [CVE-2021-25695](https://insights.sbomify.com/CVE-2021-25695/): Privilege escalation in - PCoIP Agent for Windows (high 7.8)
- [CVE-2021-25694](https://insights.sbomify.com/CVE-2021-25694/): Other in teradici:pcoip graphics agent (high 7.8)
- [CVE-2021-25693](https://insights.sbomify.com/CVE-2021-25693/): Null dereference in teradici:pcoip agent (high 7.5)
- [CVE-2021-25692](https://insights.sbomify.com/CVE-2021-25692/): Information disclosure in Teradici PCoIP Connection Manager and Security Gateway (medium 4.6)
- [CVE-2021-25690](https://insights.sbomify.com/CVE-2021-25690/): Null dereference in - PCoIP Soft Client for Windows - PCoIP Soft Client for Linux - PCoIP Soft Client for OSX (high 7.5)
- [CVE-2021-25689](https://insights.sbomify.com/CVE-2021-25689/): Memory corruption in - PCoIP Soft Client for Windows - PCoIP Soft Client for Linux - PCoIP Soft Client for OSX (critical 9.8)
- [CVE-2021-25688](https://insights.sbomify.com/CVE-2021-25688/): Information disclosure in - PCoIP Standard Agent for Windows - PCoIP Standard Agent for Linux - PCoIP Graphics Agent for Windows - PCoIP Graphics Agent for Linux (medium 5.5)
- [CVE-2021-25684](https://insights.sbomify.com/CVE-2021-25684/): apport can be stalled by reading a FIFO (high 8.8)
- [CVE-2021-25683](https://insights.sbomify.com/CVE-2021-25683/): apport improperly parses /proc/pid/stat (high 8.8)
- [CVE-2021-25682](https://insights.sbomify.com/CVE-2021-25682/): apport improperly parses /proc/pid/status (high 8.8)
- [CVE-2021-25681](https://insights.sbomify.com/CVE-2021-25681/): Other in adtran:personal phone manager (high 7.5)
- [CVE-2021-25680](https://insights.sbomify.com/CVE-2021-25680/): Cross-site scripting in adtran:personal phone manager (medium 6.1)
- [CVE-2021-25679](https://insights.sbomify.com/CVE-2021-25679/): Cross-site scripting in adtran:personal phone manager (medium 5.4)
- [CVE-2021-25678](https://insights.sbomify.com/CVE-2021-25678/): Memory corruption in Solid Edge SE2020 (high 7.8)
- [CVE-2021-25677](https://insights.sbomify.com/CVE-2021-25677/): Weak cryptography in APOGEE PXC Compact (BACnet) (medium 5.3)
- [CVE-2021-25676](https://insights.sbomify.com/CVE-2021-25676/): Denial of service in RUGGEDCOM RM1224 (high 7.5)
- [CVE-2021-25675](https://insights.sbomify.com/CVE-2021-25675/): Denial of service in SIMATIC S7-PLCSIM V5.4 (medium 5.5)
- [CVE-2021-25674](https://insights.sbomify.com/CVE-2021-25674/): Null dereference in SIMATIC S7-PLCSIM V5.4 (medium 5.5)
- [CVE-2021-25673](https://insights.sbomify.com/CVE-2021-25673/): Denial of service in SIMATIC S7-PLCSIM V5.4 (medium 5.5)
- [CVE-2021-25672](https://insights.sbomify.com/CVE-2021-25672/): Missing authorization in Mendix Forgot Password Appstore module (high 8.8)
- [CVE-2021-25671](https://insights.sbomify.com/CVE-2021-25671/): Denial of service in RWG1.M12 (medium 4.3)
- [CVE-2021-25670](https://insights.sbomify.com/CVE-2021-25670/): Memory corruption in Tecnomatix RobotExpert (high 7.8)
- [CVE-2021-25669](https://insights.sbomify.com/CVE-2021-25669/): Memory corruption in SCALANCE X200-4P IRT (critical 9.8)
- [CVE-2021-25668](https://insights.sbomify.com/CVE-2021-25668/): Memory corruption in SCALANCE X200-4P IRT (critical 9.8)
- [CVE-2021-25667](https://insights.sbomify.com/CVE-2021-25667/): Memory corruption in RUGGEDCOM RM1224 (medium 6.5)
- [CVE-2021-25666](https://insights.sbomify.com/CVE-2021-25666/): Denial of service in SCALANCE W780 and W740 (IEEE 802.11n) family (medium 4.3)
- [CVE-2021-25665](https://insights.sbomify.com/CVE-2021-25665/): Memory corruption in Simcenter STAR-CCM+ Viewer (high 7.8)
- [CVE-2021-25664](https://insights.sbomify.com/CVE-2021-25664/): Denial of service in Capital Embedded AR Classic 431-422 (high 8.7)
- [CVE-2021-25663](https://insights.sbomify.com/CVE-2021-25663/): Denial of service in Capital Embedded AR Classic 431-422 (high 8.7)
- [CVE-2021-25662](https://insights.sbomify.com/CVE-2021-25662/): Denial of service in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (high 7.5)
- [CVE-2021-25661](https://insights.sbomify.com/CVE-2021-25661/): Memory corruption in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (high 7.5)
- [CVE-2021-25660](https://insights.sbomify.com/CVE-2021-25660/): Memory corruption in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (high 7.5)
- [CVE-2021-25659](https://insights.sbomify.com/CVE-2021-25659/): Denial of service in Automation License Manager 5 (high 7.5)
- [CVE-2021-25657](https://insights.sbomify.com/CVE-2021-25657/): Avaya IP Office Privilege Escalation Vulnerability (high 7.8)
- [CVE-2021-25656](https://insights.sbomify.com/CVE-2021-25656/): Avaya Aura Experience Portal XSS vulnerabilities (medium 5.3)
- [CVE-2021-25655](https://insights.sbomify.com/CVE-2021-25655/): URL redirection to untrusted site possible in Avaya Aura Experience Portal (medium 4.4)
- [CVE-2021-25654](https://insights.sbomify.com/CVE-2021-25654/): Avaya Aura Device Services Arbitrary Code Execution Vulnerability (medium 6.2)
- [CVE-2021-25653](https://insights.sbomify.com/CVE-2021-25653/): Avaya Aura Appliance Virtualization Platform Utilities Privilege Escalation Vulnerability (high 8.0)
- [CVE-2021-25652](https://insights.sbomify.com/CVE-2021-25652/): Avaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure Vulnerability (medium 4.9)
- [CVE-2021-25651](https://insights.sbomify.com/CVE-2021-25651/): Avaya Aura Utility Services Privilege Escalation Vulnerability (high 8.0)
- [CVE-2021-25650](https://insights.sbomify.com/CVE-2021-25650/): Avaya Aura Utility Services Privilege Escalation Vulnerability (high 7.7)
- [CVE-2021-25649](https://insights.sbomify.com/CVE-2021-25649/): Avaya Utility Services Sensitive Information Disclosure Vulnerability (medium 4.9)
- [CVE-2021-25648](https://insights.sbomify.com/CVE-2021-25648/): Auth bypass in testes-codigo:testes de codigo (critical 9.8)
- [CVE-2021-25647](https://insights.sbomify.com/CVE-2021-25647/): Cross-site scripting in testes-codigo:testes de codigo (medium 5.4)
- [CVE-2021-25646](https://insights.sbomify.com/CVE-2021-25646/): Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. (high 8.8)
- [CVE-2021-25645](https://insights.sbomify.com/CVE-2021-25645/): Information disclosure in couchbase:couchbase server (medium 4.4)
- [CVE-2021-25644](https://insights.sbomify.com/CVE-2021-25644/): Information disclosure in couchbase:couchbase server (high 7.5)
- [CVE-2021-25643](https://insights.sbomify.com/CVE-2021-25643/): Information disclosure in couchbase:couchbase server (medium 4.9)
- [CVE-2021-25642](https://insights.sbomify.com/CVE-2021-25642/): Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler (high 8.8)
- [CVE-2021-25641](https://insights.sbomify.com/CVE-2021-25641/): Dubbo Zookeeper does not check serialization id (critical 9.8)
- [CVE-2021-25640](https://insights.sbomify.com/CVE-2021-25640/): Open Redirect or SSRF vulnerability usage of parseURL (medium 6.1)
- [CVE-2021-25636](https://insights.sbomify.com/CVE-2021-25636/): Incorrect trust validation of signature with ambiguous KeyInfo children (high 7.5)
- [CVE-2021-25635](https://insights.sbomify.com/CVE-2021-25635/): Content Manipulation with Certificate Validation Attack (medium 5.2)
- [CVE-2021-25634](https://insights.sbomify.com/CVE-2021-25634/): Timestamp Manipulation with Signature Wrapping (high 7.5)
- [CVE-2021-25633](https://insights.sbomify.com/CVE-2021-25633/): Content Manipulation with Double Certificate Attack (high 7.5)
- [CVE-2021-25631](https://insights.sbomify.com/CVE-2021-25631/): denylist of executable filename extensions possible to bypass under windows (high 8.8)
- [CVE-2021-25630](https://insights.sbomify.com/CVE-2021-25630/): Privilege escalation in Collabora Online (high 7.8)
- [CVE-2021-25527](https://insights.sbomify.com/CVE-2021-25527/): Missing authorization in Samsung Pay (low 3.8)
- [CVE-2021-25526](https://insights.sbomify.com/CVE-2021-25526/): Privilege escalation in Samsung Blockchain Wallet (medium 4.0)
- [CVE-2021-25525](https://insights.sbomify.com/CVE-2021-25525/): Security feature bypass in Samsung Pay (low 2.0)
- [CVE-2021-25524](https://insights.sbomify.com/CVE-2021-25524/): Information disclosure in Contacts (medium 4.0)
- [CVE-2021-25523](https://insights.sbomify.com/CVE-2021-25523/): Information disclosure in SamsungDialer (medium 4.0)
- [CVE-2021-25522](https://insights.sbomify.com/CVE-2021-25522/): Information disclosure in Samsung Capture (medium 5.3)
- [CVE-2021-25521](https://insights.sbomify.com/CVE-2021-25521/): Missing authorization in Samsung Internet (medium 4.0)
- [CVE-2021-25520](https://insights.sbomify.com/CVE-2021-25520/): Cross-site scripting in Samsung Internet (medium 5.9)
- [CVE-2021-25519](https://insights.sbomify.com/CVE-2021-25519/): Missing authorization in Samsung Mobile Devices (medium 4.0)
- [CVE-2021-25518](https://insights.sbomify.com/CVE-2021-25518/): Memory corruption in Samsung Mobile Devices (medium 6.4)
- [CVE-2021-25517](https://insights.sbomify.com/CVE-2021-25517/): Other in Samsung Mobile Devices (high 7.7)
- [CVE-2021-25516](https://insights.sbomify.com/CVE-2021-25516/): Information disclosure in Samsung Mobile Devices (medium 6.4)
- [CVE-2021-25515](https://insights.sbomify.com/CVE-2021-25515/): Information disclosure in Samsung Mobile Devices (medium 4.0)
- [CVE-2021-25514](https://insights.sbomify.com/CVE-2021-25514/): Information disclosure in Samsung Mobile Devices (low 3.3)
- [CVE-2021-25513](https://insights.sbomify.com/CVE-2021-25513/): Privilege escalation in Samsung Mobile Devices (low 2.4)
- [CVE-2021-25512](https://insights.sbomify.com/CVE-2021-25512/): Other in Samsung Mobile Devices (medium 6.1)
- [CVE-2021-25511](https://insights.sbomify.com/CVE-2021-25511/): Path traversal in Samsung Mobile Devices (medium 6.3)
- [CVE-2021-25510](https://insights.sbomify.com/CVE-2021-25510/): Other in Samsung Mobile Devices (medium 5.3)
- [CVE-2021-25509](https://insights.sbomify.com/CVE-2021-25509/): Other in Samsung Flow (medium 5.9)
- [CVE-2021-25508](https://insights.sbomify.com/CVE-2021-25508/): Privilege escalation in SmartThings (medium 5.3)
- [CVE-2021-25507](https://insights.sbomify.com/CVE-2021-25507/): Missing authorization in Samsung Flow (medium 5.7)
- [CVE-2021-25506](https://insights.sbomify.com/CVE-2021-25506/): Missing authorization in Samsung Health (medium 4.0)
- [CVE-2021-25505](https://insights.sbomify.com/CVE-2021-25505/): Auth bypass in Samsung Pass (low 3.3)
- [CVE-2021-25504](https://insights.sbomify.com/CVE-2021-25504/): Information disclosure in Group Sharing (medium 4.0)
- [CVE-2021-25503](https://insights.sbomify.com/CVE-2021-25503/): Other in Samsung Mobile Devices (medium 5.0)
- [CVE-2021-25502](https://insights.sbomify.com/CVE-2021-25502/): Information disclosure in Samsung Mobile Devices (high 7.9)
- [CVE-2021-25501](https://insights.sbomify.com/CVE-2021-25501/): Missing authorization in Samsung Mobile Devices (medium 5.7)
- [CVE-2021-25500](https://insights.sbomify.com/CVE-2021-25500/): Memory corruption in Samsung Mobile Devices (high 7.2)
- [CVE-2021-25499](https://insights.sbomify.com/CVE-2021-25499/): Missing authorization in Galaxy Store (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/202/