# Vulnerabilities published in 2021


- [CVE-2021-22951](https://insights.sbomify.com/CVE-2021-22951/): Password exposure in concrete5/core (high 7.5)
- [CVE-2021-22950](https://insights.sbomify.com/CVE-2021-22950/): Cross-site request forgery in https://github.com/concrete5/concrete5 (medium 6.5)
- [CVE-2021-2295](https://insights.sbomify.com/CVE-2021-2295/): Other in Concurrent Processing (high 8.1)
- [CVE-2021-22949](https://insights.sbomify.com/CVE-2021-22949/): Cross-site request forgery in https://github.com/concrete5/concrete5 (medium 5.4)
- [CVE-2021-22948](https://insights.sbomify.com/CVE-2021-22948/): Weak cryptography in https://github.com/revive-adserver/revive-adserver (high 7.1)
- [CVE-2021-22947](https://insights.sbomify.com/CVE-2021-22947/): Security feature bypass in https://github.com/curl/curl (medium 5.9)
- [CVE-2021-22946](https://insights.sbomify.com/CVE-2021-22946/): Security feature bypass in https://github.com/curl/curl (high 7.5)
- [CVE-2021-22945](https://insights.sbomify.com/CVE-2021-22945/): Use after free in https://github.com/curl/curl (critical 9.1)
- [CVE-2021-22944](https://insights.sbomify.com/CVE-2021-22944/): Privilege escalation in UniFi Protect application (high 8.0)
- [CVE-2021-22943](https://insights.sbomify.com/CVE-2021-22943/): Auth bypass in UniFi Protect application (critical 9.6)
- [CVE-2021-22942](https://insights.sbomify.com/CVE-2021-22942/): Open Redirect in ActionPack (medium 6.1)
- [CVE-2021-22941](https://insights.sbomify.com/CVE-2021-22941/): Citrix ShareFile Improper Access Control (critical 9.8, exploited in the wild)
- [CVE-2021-22940](https://insights.sbomify.com/CVE-2021-22940/): Use after free in Node (high 7.5)
- [CVE-2021-2294](https://insights.sbomify.com/CVE-2021-2294/): Other in WebLogic Server (medium 6.5)
- [CVE-2021-22939](https://insights.sbomify.com/CVE-2021-22939/): Security feature bypass in Node (medium 5.3)
- [CVE-2021-22938](https://insights.sbomify.com/CVE-2021-22938/): Command injection in Pulse Connect Secure (high 7.2)
- [CVE-2021-22937](https://insights.sbomify.com/CVE-2021-22937/): File upload in Pulse Connect Secure (high 7.2)
- [CVE-2021-22936](https://insights.sbomify.com/CVE-2021-22936/): Cross-site scripting in Pulse Connect Secure (medium 6.1)
- [CVE-2021-22935](https://insights.sbomify.com/CVE-2021-22935/): Command injection in Pulse Connect Secure (high 7.2)
- [CVE-2021-22934](https://insights.sbomify.com/CVE-2021-22934/): Memory corruption in Pulse Connect Secure (high 7.2)
- [CVE-2021-22933](https://insights.sbomify.com/CVE-2021-22933/): Path traversal in Pulse Connect Secure (medium 6.5)
- [CVE-2021-22932](https://insights.sbomify.com/CVE-2021-22932/): Security feature bypass in Citrix ShareFile Storage Zones Controller (high 7.5)
- [CVE-2021-22931](https://insights.sbomify.com/CVE-2021-22931/): Other in Node (critical 9.8)
- [CVE-2021-22930](https://insights.sbomify.com/CVE-2021-22930/): Use After Free in node.js (critical 9.8)
- [CVE-2021-2293](https://insights.sbomify.com/CVE-2021-2293/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-22929](https://insights.sbomify.com/CVE-2021-22929/): Information disclosure in https://github.com/brave/brave-core (medium 6.1)
- [CVE-2021-22928](https://insights.sbomify.com/CVE-2021-22928/): Privilege escalation in Citrix Virtual Apps and Desktops (high 7.8)
- [CVE-2021-22927](https://insights.sbomify.com/CVE-2021-22927/): Auth bypass in Citrix ADC, Citrix Gateway (high 8.1)
- [CVE-2021-22926](https://insights.sbomify.com/CVE-2021-22926/): Security feature bypass in https://github.com/curl/curl (high 7.5)
- [CVE-2021-22925](https://insights.sbomify.com/CVE-2021-22925/): Information disclosure in https://github.com/curl/curl (medium 5.3)
- [CVE-2021-22924](https://insights.sbomify.com/CVE-2021-22924/): Security feature bypass in https://github.com/curl/curl (low 3.7)
- [CVE-2021-22923](https://insights.sbomify.com/CVE-2021-22923/): Information disclosure in https://github.com/curl/curl (medium 5.3)
- [CVE-2021-22922](https://insights.sbomify.com/CVE-2021-22922/): Security feature bypass in https://github.com/curl/curl (medium 6.5)
- [CVE-2021-22921](https://insights.sbomify.com/CVE-2021-22921/): Incorrect Permission Assignment for Critical Resource in Node (high 7.8)
- [CVE-2021-22920](https://insights.sbomify.com/CVE-2021-22920/): Auth bypass in Citrix ADC, Citrix Gateway (medium 6.5)
- [CVE-2021-2292](https://insights.sbomify.com/CVE-2021-2292/): Other in Document Management and Collaboration (high 8.1)
- [CVE-2021-22919](https://insights.sbomify.com/CVE-2021-22919/): Denial of service in Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP (high 7.5)
- [CVE-2021-22918](https://insights.sbomify.com/CVE-2021-22918/): Out-of-Bounds Read in Node.js (medium 5.3)
- [CVE-2021-22917](https://insights.sbomify.com/CVE-2021-22917/): Information disclosure in https://github.com/brave/brave-core (medium 6.5)
- [CVE-2021-22916](https://insights.sbomify.com/CVE-2021-22916/): Information disclosure in https://github.com/brave/brave-core (medium 5.9)
- [CVE-2021-22915](https://insights.sbomify.com/CVE-2021-22915/): Security feature bypass in Nextcloud Server (critical 9.8)
- [CVE-2021-22914](https://insights.sbomify.com/CVE-2021-22914/): Information disclosure in Citrix Cloud Connector (high 7.5)
- [CVE-2021-22913](https://insights.sbomify.com/CVE-2021-22913/): Information disclosure in Nextcloud Deck (medium 6.5)
- [CVE-2021-22912](https://insights.sbomify.com/CVE-2021-22912/): Information disclosure in Nextcloud iOS app (it.twsweb.Nextcloud) (medium 6.5)
- [CVE-2021-22911](https://insights.sbomify.com/CVE-2021-22911/): SQL injection in Rocket.Chat server (critical 9.8)
- [CVE-2021-22910](https://insights.sbomify.com/CVE-2021-22910/): SQL injection in Rocket.Chat server (critical 9.8)
- [CVE-2021-2291](https://insights.sbomify.com/CVE-2021-2291/): Information disclosure in VM VirtualBox (medium 4.7)
- [CVE-2021-22909](https://insights.sbomify.com/CVE-2021-22909/): Weak cryptography in EdgeMAX EdgeRouter (high 7.5)
- [CVE-2021-22908](https://insights.sbomify.com/CVE-2021-22908/): Memory corruption in Pulse Connect Secure (high 8.8)
- [CVE-2021-22907](https://insights.sbomify.com/CVE-2021-22907/): Privilege escalation in Citrix Workspace App for Windows (high 7.8)
- [CVE-2021-22906](https://insights.sbomify.com/CVE-2021-22906/): Missing authorization in Nextcloud End-to-End Encryption (medium 6.5)
- [CVE-2021-22905](https://insights.sbomify.com/CVE-2021-22905/): Information disclosure in Nextcloud Android App (com.nextcloud.client) (medium 6.5)
- [CVE-2021-22904](https://insights.sbomify.com/CVE-2021-22904/): Possible DoS Vulnerability in Action Controller Token Authentication (high 7.5)
- [CVE-2021-22903](https://insights.sbomify.com/CVE-2021-22903/): Possible Open Redirect Vulnerability in Action Pack (medium 6.1)
- [CVE-2021-22902](https://insights.sbomify.com/CVE-2021-22902/): Denial of Service in Action Dispatch (high 7.5)
- [CVE-2021-22901](https://insights.sbomify.com/CVE-2021-22901/): Use after free in https://github.com/curl/curl (high 8.1)
- [CVE-2021-22900](https://insights.sbomify.com/CVE-2021-22900/): Ivanti Pulse Connect Secure Unrestricted File Upload (high 7.2, exploited in the wild)
- [CVE-2021-2290](https://insights.sbomify.com/CVE-2021-2290/): Other in Engineering (high 8.1)
- [CVE-2021-22899](https://insights.sbomify.com/CVE-2021-22899/): Ivanti Pulse Connect Secure Command Injection (high 8.8, exploited in the wild)
- [CVE-2021-22898](https://insights.sbomify.com/CVE-2021-22898/): Information disclosure in https://github.com/curl/curl (low 3.1)
- [CVE-2021-22897](https://insights.sbomify.com/CVE-2021-22897/): Race condition in https://github.com/curl/curl (medium 5.3)
- [CVE-2021-22896](https://insights.sbomify.com/CVE-2021-22896/): Missing authorization in Nextcloud Mail (medium 4.3)
- [CVE-2021-22895](https://insights.sbomify.com/CVE-2021-22895/): Security feature bypass in Nextcloud Desktop Client (medium 5.9)
- [CVE-2021-22894](https://insights.sbomify.com/CVE-2021-22894/): Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2021-22893](https://insights.sbomify.com/CVE-2021-22893/): Ivanti Pulse Connect Secure Use-After-Free (critical 10.0, exploited in the wild)
- [CVE-2021-22892](https://insights.sbomify.com/CVE-2021-22892/): Information disclosure in Rocket.Chat server (high 7.5)
- [CVE-2021-22891](https://insights.sbomify.com/CVE-2021-22891/): Missing authorization in Citrix ShareFile Storage Zones Controller (critical 9.8)
- [CVE-2021-22890](https://insights.sbomify.com/CVE-2021-22890/): Security feature bypass in https://github.com/curl/curl (medium 4.3)
- [CVE-2021-2289](https://insights.sbomify.com/CVE-2021-2289/): Other in Product Hub (high 8.1)
- [CVE-2021-22889](https://insights.sbomify.com/CVE-2021-22889/): Cross-site scripting in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2021-22888](https://insights.sbomify.com/CVE-2021-22888/): Cross-site scripting in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2021-22887](https://insights.sbomify.com/CVE-2021-22887/): Supply chain in PSA5000, PSA7000 (low 2.3)
- [CVE-2021-22886](https://insights.sbomify.com/CVE-2021-22886/): Cross-site scripting in Rocket.Chat (medium 6.1)
- [CVE-2021-22885](https://insights.sbomify.com/CVE-2021-22885/): Action Pack contains Information Disclosure / Unintended Method Execution vulnerability (high 7.5)
- [CVE-2021-22884](https://insights.sbomify.com/CVE-2021-22884/): Node.js bad (high 7.5)
- [CVE-2021-22883](https://insights.sbomify.com/CVE-2021-22883/): Denial of service in Node (high 7.5)
- [CVE-2021-22882](https://insights.sbomify.com/CVE-2021-22882/): Denial of service in UniFi Protect (high 7.5)
- [CVE-2021-22881](https://insights.sbomify.com/CVE-2021-22881/): Actionpack Open Redirect Vulnerability (medium 6.1)
- [CVE-2021-22880](https://insights.sbomify.com/CVE-2021-22880/): Active Record subject to Regular Expression Denial-of-Service (ReDoS) (high 7.5)
- [CVE-2021-2288](https://insights.sbomify.com/CVE-2021-2288/): Other in Bills of Material (high 8.1)
- [CVE-2021-22879](https://insights.sbomify.com/CVE-2021-22879/): Code injection in Nextcloud Desktop Client (high 8.8)
- [CVE-2021-22878](https://insights.sbomify.com/CVE-2021-22878/): Cross-site scripting in Nextcloud Server (medium 4.8)
- [CVE-2021-22877](https://insights.sbomify.com/CVE-2021-22877/): Missing authorization in Nextcloud Server (medium 6.5)
- [CVE-2021-22876](https://insights.sbomify.com/CVE-2021-22876/): Information disclosure in https://github.com/curl/curl (medium 5.3)
- [CVE-2021-22875](https://insights.sbomify.com/CVE-2021-22875/): Cross-site scripting in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2021-22874](https://insights.sbomify.com/CVE-2021-22874/): Cross-site scripting in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2021-22873](https://insights.sbomify.com/CVE-2021-22873/): Open redirect in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2021-22872](https://insights.sbomify.com/CVE-2021-22872/): Cross-site scripting in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2021-22871](https://insights.sbomify.com/CVE-2021-22871/): Cross-site scripting in https://github.com/revive-adserver/revive-adserver (medium 4.8)
- [CVE-2021-22870](https://insights.sbomify.com/CVE-2021-22870/): Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access (medium 6.5)
- [CVE-2021-2287](https://insights.sbomify.com/CVE-2021-2287/): Information disclosure in VM VirtualBox (high 7.1)
- [CVE-2021-22869](https://insights.sbomify.com/CVE-2021-22869/): Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group (critical 9.8)
- [CVE-2021-22868](https://insights.sbomify.com/CVE-2021-22868/): Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server (medium 4.3)
- [CVE-2021-22867](https://insights.sbomify.com/CVE-2021-22867/): Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server (medium 6.5)
- [CVE-2021-22866](https://insights.sbomify.com/CVE-2021-22866/): Other in GitHub Enterprise Server (high 8.8)
- [CVE-2021-22865](https://insights.sbomify.com/CVE-2021-22865/): Improper access control in GitHub Enterprise Server leading to unauthorized read access to private repository metadata (medium 6.5)
- [CVE-2021-22864](https://insights.sbomify.com/CVE-2021-22864/): Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server (high 8.8)
- [CVE-2021-22863](https://insights.sbomify.com/CVE-2021-22863/): Missing authorization in GitHub Enterprise Server (high 8.1)
- [CVE-2021-22862](https://insights.sbomify.com/CVE-2021-22862/): Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks (medium 6.5)
- [CVE-2021-22861](https://insights.sbomify.com/CVE-2021-22861/): Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/224/