# Vulnerabilities published in 2021


- [CVE-2021-25290](https://insights.sbomify.com/CVE-2021-25290/): Out-of-bounds Write in Pillow (high 7.5)
- [CVE-2021-25289](https://insights.sbomify.com/CVE-2021-25289/): Out of bounds write in Pillow (critical 9.8)
- [CVE-2021-25288](https://insights.sbomify.com/CVE-2021-25288/): Pillow Out-of-bounds Read vulnerability (critical 9.1)
- [CVE-2021-25287](https://insights.sbomify.com/CVE-2021-25287/): Out-of-bounds Read in Pillow (critical 9.1)
- [CVE-2021-25284](https://insights.sbomify.com/CVE-2021-25284/): SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod (medium 4.4)
- [CVE-2021-25283](https://insights.sbomify.com/CVE-2021-25283/): SaltStack Salt Server Side Template Injection (critical 9.8)
- [CVE-2021-25282](https://insights.sbomify.com/CVE-2021-25282/): SaltStack Salt Directory Traversal vulnerability (critical 9.1)
- [CVE-2021-25281](https://insights.sbomify.com/CVE-2021-25281/): SaltStack Salt Improper Authentication vulnerability (critical 9.8)
- [CVE-2021-25278](https://insights.sbomify.com/CVE-2021-25278/): Cross-site scripting in ftapi:ftapi (medium 4.8)
- [CVE-2021-25277](https://insights.sbomify.com/CVE-2021-25277/): Cross-site scripting in ftapi:ftapi (medium 6.1)
- [CVE-2021-25276](https://insights.sbomify.com/CVE-2021-25276/): Misconfiguration in solarwinds:serv-u (high 7.1)
- [CVE-2021-25275](https://insights.sbomify.com/CVE-2021-25275/): Hardcoded credentials in solarwinds:orion platform (high 7.8)
- [CVE-2021-25274](https://insights.sbomify.com/CVE-2021-25274/): Deserialization in solarwinds:orion platform (critical 9.8)
- [CVE-2021-25273](https://insights.sbomify.com/CVE-2021-25273/): Cross-site scripting in Sophos UTM (medium 4.8)
- [CVE-2021-25271](https://insights.sbomify.com/CVE-2021-25271/): Privilege escalation in HitmanPro (medium 6.0)
- [CVE-2021-25270](https://insights.sbomify.com/CVE-2021-25270/): Privilege escalation in HitmanPro.Alert (medium 6.7)
- [CVE-2021-25269](https://insights.sbomify.com/CVE-2021-25269/): Security feature bypass in Intercept X Advanced (medium 4.4)
- [CVE-2021-25268](https://insights.sbomify.com/CVE-2021-25268/): Cross-site scripting in Sophos Firewall (high 8.4)
- [CVE-2021-25267](https://insights.sbomify.com/CVE-2021-25267/): Cross-site scripting in Sophos Firewall (medium 6.8)
- [CVE-2021-25266](https://insights.sbomify.com/CVE-2021-25266/): Information disclosure in Intercept X for Mobile (Android) (low 3.9)
- [CVE-2021-25265](https://insights.sbomify.com/CVE-2021-25265/): Other in Sophos Connect Client (high 8.8)
- [CVE-2021-25264](https://insights.sbomify.com/CVE-2021-25264/): Privilege escalation in Intercept X for MacOS (medium 6.7)
- [CVE-2021-25263](https://insights.sbomify.com/CVE-2021-25263/): Privilege escalation in Yandex Browser (Desktop) (high 7.8)
- [CVE-2021-25262](https://insights.sbomify.com/CVE-2021-25262/): Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. (medium 6.9)
- [CVE-2021-25261](https://insights.sbomify.com/CVE-2021-25261/): Privilege escalation in Yandex Browser (Desktop) (high 7.8)
- [CVE-2021-25255](https://insights.sbomify.com/CVE-2021-25255/): Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. (high 8.3)
- [CVE-2021-25254](https://insights.sbomify.com/CVE-2021-25254/): Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. (high 8.2)
- [CVE-2021-25253](https://insights.sbomify.com/CVE-2021-25253/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-25252](https://insights.sbomify.com/CVE-2021-25252/): Denial of service in Trend Micro Virus Scan API (VSAPI) Engine (medium 5.5)
- [CVE-2021-25251](https://insights.sbomify.com/CVE-2021-25251/): Code injection in Trend Micro Security (Consumer) (high 7.2)
- [CVE-2021-25250](https://insights.sbomify.com/CVE-2021-25250/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-25249](https://insights.sbomify.com/CVE-2021-25249/): Memory corruption in Trend Micro Apex One (high 7.8)
- [CVE-2021-25248](https://insights.sbomify.com/CVE-2021-25248/): Information disclosure in Trend Micro Apex One (medium 5.5)
- [CVE-2021-25247](https://insights.sbomify.com/CVE-2021-25247/): Privilege escalation in Trend Micro HouseCall for Home Networks (high 7.8)
- [CVE-2021-25246](https://insights.sbomify.com/CVE-2021-25246/): Missing authorization in Trend Micro Apex One (medium 6.5)
- [CVE-2021-25245](https://insights.sbomify.com/CVE-2021-25245/): Missing authorization in Trend Micro Worry-Free Business Security (medium 5.3)
- [CVE-2021-25244](https://insights.sbomify.com/CVE-2021-25244/): Missing authorization in Trend Micro Worry-Free Business Security (medium 5.3)
- [CVE-2021-25243](https://insights.sbomify.com/CVE-2021-25243/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25242](https://insights.sbomify.com/CVE-2021-25242/): Information disclosure in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25241](https://insights.sbomify.com/CVE-2021-25241/): Server-side request forgery in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25240](https://insights.sbomify.com/CVE-2021-25240/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25239](https://insights.sbomify.com/CVE-2021-25239/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25238](https://insights.sbomify.com/CVE-2021-25238/): Information disclosure in Trend Micro OfficeScan (medium 5.3)
- [CVE-2021-25237](https://insights.sbomify.com/CVE-2021-25237/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25236](https://insights.sbomify.com/CVE-2021-25236/): Server-side request forgery in Trend Micro OfficeScan (medium 5.3)
- [CVE-2021-25235](https://insights.sbomify.com/CVE-2021-25235/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25234](https://insights.sbomify.com/CVE-2021-25234/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25233](https://insights.sbomify.com/CVE-2021-25233/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25232](https://insights.sbomify.com/CVE-2021-25232/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25231](https://insights.sbomify.com/CVE-2021-25231/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25230](https://insights.sbomify.com/CVE-2021-25230/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25229](https://insights.sbomify.com/CVE-2021-25229/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25228](https://insights.sbomify.com/CVE-2021-25228/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2021-25227](https://insights.sbomify.com/CVE-2021-25227/): Denial of service in Trend Micro Antivirus for Mac (low 3.3)
- [CVE-2021-25226](https://insights.sbomify.com/CVE-2021-25226/): Denial of service in Trend Micro ServerProtect for Linux (medium 5.5)
- [CVE-2021-25225](https://insights.sbomify.com/CVE-2021-25225/): Denial of service in Trend Micro ServerProtect for Linux (medium 5.5)
- [CVE-2021-25224](https://insights.sbomify.com/CVE-2021-25224/): Denial of service in Trend Micro ServerProtect for Linux (medium 5.5)
- [CVE-2021-25220](https://insights.sbomify.com/CVE-2021-25220/): DNS forwarders - cache poisoning vulnerability (medium 6.8)
- [CVE-2021-25219](https://insights.sbomify.com/CVE-2021-25219/): Lame cache can be abused to severely degrade resolver performance (medium 5.3)
- [CVE-2021-25218](https://insights.sbomify.com/CVE-2021-25218/): Denial of service in BIND9 (high 7.5)
- [CVE-2021-25217](https://insights.sbomify.com/CVE-2021-25217/): A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient (high 7.4)
- [CVE-2021-25216](https://insights.sbomify.com/CVE-2021-25216/): A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack (high 8.1)
- [CVE-2021-25215](https://insights.sbomify.com/CVE-2021-25215/): Denial of service in BIND9 (high 7.5)
- [CVE-2021-25214](https://insights.sbomify.com/CVE-2021-25214/): A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly (medium 6.5)
- [CVE-2021-25213](https://insights.sbomify.com/CVE-2021-25213/): SQL injection in travel management system project:travel management system (critical 9.8)
- [CVE-2021-25212](https://insights.sbomify.com/CVE-2021-25212/): SQL injection in alumni management system project:alumni management system (critical 9.8)
- [CVE-2021-25211](https://insights.sbomify.com/CVE-2021-25211/): File upload in online ordering system project:online ordering system (critical 9.8)
- [CVE-2021-25210](https://insights.sbomify.com/CVE-2021-25210/): File upload in alumni management system project:alumni management system (critical 9.8)
- [CVE-2021-25209](https://insights.sbomify.com/CVE-2021-25209/): SQL injection in theme park ticketing system project:theme park ticketing system (critical 9.8)
- [CVE-2021-25208](https://insights.sbomify.com/CVE-2021-25208/): File upload in travel management system project:travel management system (critical 9.8)
- [CVE-2021-25207](https://insights.sbomify.com/CVE-2021-25207/): File upload in e-commerce website project:e-commerce website (critical 9.8)
- [CVE-2021-25206](https://insights.sbomify.com/CVE-2021-25206/): File upload in responsive ordering system project:responsive ordering system (critical 9.8)
- [CVE-2021-25205](https://insights.sbomify.com/CVE-2021-25205/): SQL injection in e-commerce website project:e-commerce website (critical 9.8)
- [CVE-2021-25204](https://insights.sbomify.com/CVE-2021-25204/): Cross-site scripting in e-commerce website project:e-commerce website (medium 5.4)
- [CVE-2021-25203](https://insights.sbomify.com/CVE-2021-25203/): File upload in victor cms project:victor cms (critical 9.8)
- [CVE-2021-25202](https://insights.sbomify.com/CVE-2021-25202/): SQL injection in sales and inventory system project:sales and inventory system (critical 9.8)
- [CVE-2021-25201](https://insights.sbomify.com/CVE-2021-25201/): SQL injection in learning management system project:learning management system (high 7.5)
- [CVE-2021-25200](https://insights.sbomify.com/CVE-2021-25200/): File upload in learning management system project:learning management system (critical 9.8)
- [CVE-2021-25197](https://insights.sbomify.com/CVE-2021-25197/): Cross-site scripting in content management system project:content management system (medium 6.1)
- [CVE-2021-25195](https://insights.sbomify.com/CVE-2021-25195/): Windows PKU2U Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-25179](https://insights.sbomify.com/CVE-2021-25179/): Cross-site scripting in solarwinds:serv-u file server (medium 6.1)
- [CVE-2021-25178](https://insights.sbomify.com/CVE-2021-25178/): Memory corruption in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-25177](https://insights.sbomify.com/CVE-2021-25177/): Memory corruption in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-25176](https://insights.sbomify.com/CVE-2021-25176/): Null dereference in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-25175](https://insights.sbomify.com/CVE-2021-25175/): Denial of service in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-25174](https://insights.sbomify.com/CVE-2021-25174/): Memory corruption in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-25173](https://insights.sbomify.com/CVE-2021-25173/): Denial of service in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-25172](https://insights.sbomify.com/CVE-2021-25172/): Command injection in HPE Apollo 70 System (high 7.8)
- [CVE-2021-25171](https://insights.sbomify.com/CVE-2021-25171/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-25170](https://insights.sbomify.com/CVE-2021-25170/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-25169](https://insights.sbomify.com/CVE-2021-25169/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-25168](https://insights.sbomify.com/CVE-2021-25168/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-25167](https://insights.sbomify.com/CVE-2021-25167/): Command injection in Aruba AirWave Management Platform (high 8.8)
- [CVE-2021-25166](https://insights.sbomify.com/CVE-2021-25166/): Command injection in Aruba AirWave Management Platform (high 8.8)
- [CVE-2021-25165](https://insights.sbomify.com/CVE-2021-25165/): XML external entity in Aruba AirWave Management Platform (high 8.1)
- [CVE-2021-25164](https://insights.sbomify.com/CVE-2021-25164/): XML external entity in Aruba AirWave Management Platform (medium 6.5)
- [CVE-2021-25163](https://insights.sbomify.com/CVE-2021-25163/): XML external entity in Aruba AirWave Management Platform (high 8.1)
- [CVE-2021-25162](https://insights.sbomify.com/CVE-2021-25162/): Command injection in Aruba Instant Access Points (high 8.1)
- [CVE-2021-25161](https://insights.sbomify.com/CVE-2021-25161/): Cross-site scripting in Aruba Instant Access Points (medium 6.1)
- [CVE-2021-25160](https://insights.sbomify.com/CVE-2021-25160/): Other in Aruba Instant Access Points (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/205/