# Vulnerabilities published in 2021 - [CVE-2021-23044](https://insights.sbomify.com/CVE-2021-23044/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23043](https://insights.sbomify.com/CVE-2021-23043/): Path traversal in BIG-IP (medium 6.5) - [CVE-2021-23042](https://insights.sbomify.com/CVE-2021-23042/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23041](https://insights.sbomify.com/CVE-2021-23041/): Cross-site scripting in BIG-IP (medium 6.1) - [CVE-2021-23040](https://insights.sbomify.com/CVE-2021-23040/): SQL injection in BIG-IP AFM (high 8.8) - [CVE-2021-2304](https://insights.sbomify.com/CVE-2021-2304/): Other in MySQL Server (medium 5.5) - [CVE-2021-23039](https://insights.sbomify.com/CVE-2021-23039/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23038](https://insights.sbomify.com/CVE-2021-23038/): Cross-site scripting in BIG-IP (critical 9.0) - [CVE-2021-23037](https://insights.sbomify.com/CVE-2021-23037/): Cross-site scripting in BIG-IP (critical 9.6) - [CVE-2021-23036](https://insights.sbomify.com/CVE-2021-23036/): Denial of service in BIG-IP Advanced WAF and BIG-IP ASM (high 7.5) - [CVE-2021-23035](https://insights.sbomify.com/CVE-2021-23035/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23034](https://insights.sbomify.com/CVE-2021-23034/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23033](https://insights.sbomify.com/CVE-2021-23033/): Denial of service in BIG-IP Advanced WAF and BIG-IP ASM (high 7.5) - [CVE-2021-23032](https://insights.sbomify.com/CVE-2021-23032/): Denial of service in BIG-IP DNS (high 7.5) - [CVE-2021-23031](https://insights.sbomify.com/CVE-2021-23031/): Privilege escalation in BIG-IP Advanced WAF and BIG-IP ASM (critical 9.9) - [CVE-2021-23030](https://insights.sbomify.com/CVE-2021-23030/): Denial of service in BIG-IP Advanced WAF and BIG-IP ASM (high 7.5) - [CVE-2021-2303](https://insights.sbomify.com/CVE-2021-2303/): Other in OSS Support Tools (medium 4.9) - [CVE-2021-23029](https://insights.sbomify.com/CVE-2021-23029/): Server-side request forgery in BIG-IP Advanced WAF and BIG-IP ASM (high 8.8) - [CVE-2021-23028](https://insights.sbomify.com/CVE-2021-23028/): Denial of service in BIG-IP Advanced WAF and BIG-IP ASM (high 7.5) - [CVE-2021-23027](https://insights.sbomify.com/CVE-2021-23027/): Cross-site scripting in BIG-IP (medium 6.1) - [CVE-2021-23026](https://insights.sbomify.com/CVE-2021-23026/): Cross-site request forgery in BIG-IP & BIG-IQ (high 8.8) - [CVE-2021-23025](https://insights.sbomify.com/CVE-2021-23025/): Command injection in BIG-IP (high 8.8) - [CVE-2021-23024](https://insights.sbomify.com/CVE-2021-23024/): Command injection in BIG-IQ (high 7.2) - [CVE-2021-23023](https://insights.sbomify.com/CVE-2021-23023/): Other in Edge Client for Windows (high 7.8) - [CVE-2021-23022](https://insights.sbomify.com/CVE-2021-23022/): Misconfiguration in Edge Client for Windows (high 7.8) - [CVE-2021-23021](https://insights.sbomify.com/CVE-2021-23021/): Misconfiguration in Nginx Controller (medium 5.5) - [CVE-2021-23020](https://insights.sbomify.com/CVE-2021-23020/): Weak cryptography in Nginx Controller (medium 5.5) - [CVE-2021-2302](https://insights.sbomify.com/CVE-2021-2302/): Other in Platform Security for Java (critical 9.8) - [CVE-2021-23019](https://insights.sbomify.com/CVE-2021-23019/): Information disclosure in Nginx Controller (high 7.8) - [CVE-2021-23018](https://insights.sbomify.com/CVE-2021-23018/): Weak cryptography in Nginx Controller (high 7.4) - [CVE-2021-23017](https://insights.sbomify.com/CVE-2021-23017/): Memory corruption in Nginx Web Server, Nginx Plus (high 7.7) - [CVE-2021-23016](https://insights.sbomify.com/CVE-2021-23016/): Security feature bypass in BIG-IP APM (medium 5.3) - [CVE-2021-23015](https://insights.sbomify.com/CVE-2021-23015/): Security feature bypass in BIG-IP (high 7.2) - [CVE-2021-23014](https://insights.sbomify.com/CVE-2021-23014/): Missing authorization in BIG-IP ASM/Advanced WAF (high 8.8) - [CVE-2021-23013](https://insights.sbomify.com/CVE-2021-23013/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23012](https://insights.sbomify.com/CVE-2021-23012/): Command injection in BIG-IP (high 8.2) - [CVE-2021-23011](https://insights.sbomify.com/CVE-2021-23011/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23010](https://insights.sbomify.com/CVE-2021-23010/): Denial of service in BIG-IP ASM/Advanced WAF (high 7.5) - [CVE-2021-2301](https://insights.sbomify.com/CVE-2021-2301/): Information disclosure in MySQL Server (low 2.7) - [CVE-2021-23009](https://insights.sbomify.com/CVE-2021-23009/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23008](https://insights.sbomify.com/CVE-2021-23008/): Auth bypass in BIG-IP APM (critical 9.8) - [CVE-2021-23007](https://insights.sbomify.com/CVE-2021-23007/): Denial of service in BIG-IP (medium 5.3) - [CVE-2021-23006](https://insights.sbomify.com/CVE-2021-23006/): Cross-site scripting in BIG-IQ (medium 6.1) - [CVE-2021-23005](https://insights.sbomify.com/CVE-2021-23005/): Weak cryptography in BIG-IQ (critical 9.1) - [CVE-2021-23004](https://insights.sbomify.com/CVE-2021-23004/): Security feature bypass in BIG-IP (high 7.5) - [CVE-2021-23003](https://insights.sbomify.com/CVE-2021-23003/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-23002](https://insights.sbomify.com/CVE-2021-23002/): Information disclosure in BIG-IP APM and Edge Client (medium 4.5) - [CVE-2021-23001](https://insights.sbomify.com/CVE-2021-23001/): File upload in BIG-IP Advanced WAF and BIG-IP ASM (medium 4.3) - [CVE-2021-23000](https://insights.sbomify.com/CVE-2021-23000/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-2300](https://insights.sbomify.com/CVE-2021-2300/): Denial of service in MySQL Server (medium 4.9) - [CVE-2021-22999](https://insights.sbomify.com/CVE-2021-22999/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-22998](https://insights.sbomify.com/CVE-2021-22998/): Security feature bypass in BIG-IP (medium 5.3) - [CVE-2021-22997](https://insights.sbomify.com/CVE-2021-22997/): Missing authorization in BIG-IQ (high 7.5) - [CVE-2021-22996](https://insights.sbomify.com/CVE-2021-22996/): Denial of service in BIG-IQ (high 7.5) - [CVE-2021-22995](https://insights.sbomify.com/CVE-2021-22995/): Auth bypass in BIG-IQ (high 7.5) - [CVE-2021-22994](https://insights.sbomify.com/CVE-2021-22994/): Cross-site scripting in BIG-IP (medium 6.1) - [CVE-2021-22993](https://insights.sbomify.com/CVE-2021-22993/): Cross-site scripting in BIG-IP Advanced WAF and BIG-IP ASM (high 8.8) - [CVE-2021-22992](https://insights.sbomify.com/CVE-2021-22992/): Memory corruption in BIG-IP Advanced WAF and BIG-IP ASM (critical 9.8) - [CVE-2021-22991](https://insights.sbomify.com/CVE-2021-22991/): F5 BIG-IP Traffic Management Microkernel Buffer Overflow (critical 9.8, exploited in the wild) - [CVE-2021-22990](https://insights.sbomify.com/CVE-2021-22990/): Command injection in BIG-IP Advanced WAF or BIG-IP ASM (high 7.2) - [CVE-2021-2299](https://insights.sbomify.com/CVE-2021-2299/): Denial of service in MySQL Server (medium 4.9) - [CVE-2021-22989](https://insights.sbomify.com/CVE-2021-22989/): Command injection in BIG-IP Advanced WAF or BIG-IP ASM in Appliance Mode (critical 9.1) - [CVE-2021-22988](https://insights.sbomify.com/CVE-2021-22988/): Command injection in BIG-IP (high 8.8) - [CVE-2021-22987](https://insights.sbomify.com/CVE-2021-22987/): Command injection in BIG-IP Appliance Mode (critical 9.9) - [CVE-2021-22986](https://insights.sbomify.com/CVE-2021-22986/): F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution (critical 9.8, exploited in the wild) - [CVE-2021-22985](https://insights.sbomify.com/CVE-2021-22985/): Denial of service in BIG-IP APM (high 7.5) - [CVE-2021-22984](https://insights.sbomify.com/CVE-2021-22984/): Open redirect in BIG-IP Advanced WAF & BIG-IP ASM (medium 6.1) - [CVE-2021-22983](https://insights.sbomify.com/CVE-2021-22983/): Cross-site scripting in BIG-IP AFM (medium 5.4) - [CVE-2021-22982](https://insights.sbomify.com/CVE-2021-22982/): Memory corruption in BIG-IP DNS and GTM (high 7.2) - [CVE-2021-22981](https://insights.sbomify.com/CVE-2021-22981/): Weak cryptography in BIG-IP (medium 4.8) - [CVE-2021-22980](https://insights.sbomify.com/CVE-2021-22980/): Other in Edge Client (high 7.8) - [CVE-2021-2298](https://insights.sbomify.com/CVE-2021-2298/): Denial of service in MySQL Server (medium 6.5) - [CVE-2021-22979](https://insights.sbomify.com/CVE-2021-22979/): Cross-site scripting in BIG-IP (medium 6.1) - [CVE-2021-22978](https://insights.sbomify.com/CVE-2021-22978/): Cross-site scripting in BIG-IP (high 8.3) - [CVE-2021-22977](https://insights.sbomify.com/CVE-2021-22977/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-22976](https://insights.sbomify.com/CVE-2021-22976/): Denial of service in BIG-IP Advanced WAF & BIG-IP ASM (high 7.5) - [CVE-2021-22975](https://insights.sbomify.com/CVE-2021-22975/): Denial of service in BIG-IP (high 7.5) - [CVE-2021-22974](https://insights.sbomify.com/CVE-2021-22974/): Race condition in BIG-IP, BIG-IQ (high 7.5) - [CVE-2021-22973](https://insights.sbomify.com/CVE-2021-22973/): Memory corruption in BIG-IP (high 7.5) - [CVE-2021-22970](https://insights.sbomify.com/CVE-2021-22970/): Server-Side Request Forgery in Concrete CMS (high 7.5) - [CVE-2021-2297](https://insights.sbomify.com/CVE-2021-2297/): Information disclosure in VM VirtualBox (medium 5.3) - [CVE-2021-22969](https://insights.sbomify.com/CVE-2021-22969/): Server-Side Request Forgery in Concrete CMS (medium 5.3) - [CVE-2021-22968](https://insights.sbomify.com/CVE-2021-22968/): Improper file handling in concrete5/core (high 7.2) - [CVE-2021-22967](https://insights.sbomify.com/CVE-2021-22967/): Exposure of sensitive information in concrete5/core (high 7.5) - [CVE-2021-22966](https://insights.sbomify.com/CVE-2021-22966/): Improper Privilege Management in Concrete CMS (high 8.8) - [CVE-2021-22965](https://insights.sbomify.com/CVE-2021-22965/): Denial of service in Pulse Connect Secure (high 7.5) - [CVE-2021-22964](https://insights.sbomify.com/CVE-2021-22964/): DOS and Open Redirect with user input (high 8.8) - [CVE-2021-22963](https://insights.sbomify.com/CVE-2021-22963/): URL Redirection to Untrusted Site ('Open Redirect') in fastify-static (medium 6.1) - [CVE-2021-22962](https://insights.sbomify.com/CVE-2021-22962/): Information disclosure in Avalanche (high 7.3) - [CVE-2021-22961](https://insights.sbomify.com/CVE-2021-22961/): Code injection in GlassWire (critical 9.8) - [CVE-2021-22960](https://insights.sbomify.com/CVE-2021-22960/): Other in Node (medium 6.5) - [CVE-2021-2296](https://insights.sbomify.com/CVE-2021-2296/): Information disclosure in VM VirtualBox (medium 5.3) - [CVE-2021-22959](https://insights.sbomify.com/CVE-2021-22959/): Other in Node (medium 6.5) - [CVE-2021-22958](https://insights.sbomify.com/CVE-2021-22958/): Server-Side Request Forgery vulnerability in concrete5 (critical 9.8) - [CVE-2021-22957](https://insights.sbomify.com/CVE-2021-22957/): Misconfiguration in UniFi Protect application (high 8.8) - [CVE-2021-22956](https://insights.sbomify.com/CVE-2021-22956/): Denial of service in Citrix ADC, Citrix Gateway, Citrix SDWAN (high 7.5) - [CVE-2021-22955](https://insights.sbomify.com/CVE-2021-22955/): Denial of service in Citrix ADC, Citrix Gateway (high 7.5) - [CVE-2021-22954](https://insights.sbomify.com/CVE-2021-22954/): Cross Site Request Forgery in concrete5/concrete5 (high 8.8) - [CVE-2021-22953](https://insights.sbomify.com/CVE-2021-22953/): Cross-site request forgery in https://github.com/concrete5/concrete5 (medium 5.4) - [CVE-2021-22952](https://insights.sbomify.com/CVE-2021-22952/): Code injection in UniFi Talk application (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2021/page/223/