# Vulnerabilities published in 2021


- [CVE-2021-22649](https://insights.sbomify.com/CVE-2021-22649/): Null dereference in Luxion KeyShot (high 7.8)
- [CVE-2021-22648](https://insights.sbomify.com/CVE-2021-22648/): Ovarro TBox Incorrect Permission Assignment for Critical Resource (high 8.8)
- [CVE-2021-22647](https://insights.sbomify.com/CVE-2021-22647/): Memory corruption in Luxion KeyShot (high 7.8)
- [CVE-2021-22646](https://insights.sbomify.com/CVE-2021-22646/): Ovarro TBox Code Injection (high 8.8)
- [CVE-2021-22645](https://insights.sbomify.com/CVE-2021-22645/): Code injection in Luxion KeyShot (high 7.8)
- [CVE-2021-22644](https://insights.sbomify.com/CVE-2021-22644/): Ovarro TBox Use of Hard-coded Cryptographic Key (high 7.5)
- [CVE-2021-22643](https://insights.sbomify.com/CVE-2021-22643/): Memory corruption in Luxion KeyShot (high 7.8)
- [CVE-2021-22642](https://insights.sbomify.com/CVE-2021-22642/): Ovarro TBox Uncontrolled Resource Consumption (high 7.5)
- [CVE-2021-22641](https://insights.sbomify.com/CVE-2021-22641/): Memory corruption in Tellus Lite V-Simulator and V-Server Lite (high 7.8)
- [CVE-2021-22640](https://insights.sbomify.com/CVE-2021-22640/): Ovarro TBox Insufficiently Protected Credentials (high 7.5)
- [CVE-2021-2264](https://insights.sbomify.com/CVE-2021-2264/): Other in VM VirtualBox (high 8.4)
- [CVE-2021-22639](https://insights.sbomify.com/CVE-2021-22639/): Memory corruption in Tellus Lite V-Simulator and V-Server Lite (high 7.8)
- [CVE-2021-22638](https://insights.sbomify.com/CVE-2021-22638/): Memory corruption in Fatek FvDesigner (high 7.8)
- [CVE-2021-22637](https://insights.sbomify.com/CVE-2021-22637/): Memory corruption in Tellus Lite V-Simulator and V-Server Lite (high 7.8)
- [CVE-2021-22636](https://insights.sbomify.com/CVE-2021-22636/): Texas Instruments TI-RTOS Integer Overflow or Wraparound (high 7.4)
- [CVE-2021-2263](https://insights.sbomify.com/CVE-2021-2263/): Other in Sourcing (high 8.1)
- [CVE-2021-2262](https://insights.sbomify.com/CVE-2021-2262/): Other in Purchasing (high 8.1)
- [CVE-2021-2261](https://insights.sbomify.com/CVE-2021-2261/): Other in Lease and Finance Management (high 8.1)
- [CVE-2021-22600](https://insights.sbomify.com/CVE-2021-22600/): Linux Kernel Privilege Escalation (medium 6.6, exploited in the wild)
- [CVE-2021-2260](https://insights.sbomify.com/CVE-2021-2260/): Other in Human Resources (high 8.1)
- [CVE-2021-2259](https://insights.sbomify.com/CVE-2021-2259/): Other in Payroll (high 8.1)
- [CVE-2021-2258](https://insights.sbomify.com/CVE-2021-2258/): Other in Projects (high 8.1)
- [CVE-2021-22573](https://insights.sbomify.com/CVE-2021-22573/): Incorrect signature verification on Google-oauth-java-client (high 8.7)
- [CVE-2021-22572](https://insights.sbomify.com/CVE-2021-22572/): Data-transfer-project information disclosure via tmp directory (medium 5.5)
- [CVE-2021-22571](https://insights.sbomify.com/CVE-2021-22571/): Information Leak in SA360-webquery-bigquery through read on /tmp (medium 5.5)
- [CVE-2021-22570](https://insights.sbomify.com/CVE-2021-22570/): Nullptr Dereference in Protobuf (medium 6.5)
- [CVE-2021-2257](https://insights.sbomify.com/CVE-2021-2257/): Information disclosure in Cloud Infrastructure (medium 4.1)
- [CVE-2021-22569](https://insights.sbomify.com/CVE-2021-22569/): Denial of Service of protobuf-java parsing procedure (high 7.5)
- [CVE-2021-22568](https://insights.sbomify.com/CVE-2021-22568/): Dart - Publishing to third-party package repositories may expose pub.dev credentials (high 8.8)
- [CVE-2021-22567](https://insights.sbomify.com/CVE-2021-22567/): Bidirectional Override in Dart SDK (medium 4.6)
- [CVE-2021-22566](https://insights.sbomify.com/CVE-2021-22566/): Incorrect mapping of Executable bits in Fuchsia Kernel (medium 5.1)
- [CVE-2021-22565](https://insights.sbomify.com/CVE-2021-22565/): Insufficient Granularity of Access Control in GAEN Notification Server (medium 6.5)
- [CVE-2021-22564](https://insights.sbomify.com/CVE-2021-22564/): Out of bounds Copy in Libjxl in large image groups (medium 4.5)
- [CVE-2021-22563](https://insights.sbomify.com/CVE-2021-22563/): Memory Overread in libjxl (medium 4.5)
- [CVE-2021-2256](https://insights.sbomify.com/CVE-2021-2256/): Other in Cloud Infrastructure (critical 10.0)
- [CVE-2021-22557](https://insights.sbomify.com/CVE-2021-22557/): Code execution in SLO Generator via YAML Payload (medium 5.3)
- [CVE-2021-22556](https://insights.sbomify.com/CVE-2021-22556/): Integer Overflow in Fuchsia Kernel (medium 5.3)
- [CVE-2021-22555](https://insights.sbomify.com/CVE-2021-22555/): Linux Kernel Heap Out-of-Bounds Write (high 8.3, exploited in the wild)
- [CVE-2021-22553](https://insights.sbomify.com/CVE-2021-22553/): Heap Memory exhaustion in Gerrit (medium 6.5)
- [CVE-2021-22552](https://insights.sbomify.com/CVE-2021-22552/): Memory overread secure enclave in Asylo 0.6.2 (medium 5.3)
- [CVE-2021-22550](https://insights.sbomify.com/CVE-2021-22550/): Enclave memory overwrite/overread vulnerability in Asylo UntrustedCacheMalloc::GetBuffer (medium 6.5)
- [CVE-2021-2255](https://insights.sbomify.com/CVE-2021-2255/): Other in Service Contracts (high 8.1)
- [CVE-2021-22549](https://insights.sbomify.com/CVE-2021-22549/): Arbitrary enclave memory overwrite vulnerability in Asylo TrustedPrimitives::UntrustedCall (medium 6.5)
- [CVE-2021-22548](https://insights.sbomify.com/CVE-2021-22548/): Arbitrary enclave memory overread vulnerability in Asylo TrustedPrimitives::UntrustedCall (medium 6.5)
- [CVE-2021-22547](https://insights.sbomify.com/CVE-2021-22547/): Buffer overrun in Google Cloud IoT Device SDK for Embedded C (medium 6.3)
- [CVE-2021-22545](https://insights.sbomify.com/CVE-2021-22545/): Use-after-free in BinDiff (high 7.5)
- [CVE-2021-22543](https://insights.sbomify.com/CVE-2021-22543/): Improper memory handling in Linux KVM (high 8.7)
- [CVE-2021-22540](https://insights.sbomify.com/CVE-2021-22540/): XSS in Dart SDK (medium 6.1)
- [CVE-2021-2254](https://insights.sbomify.com/CVE-2021-2254/): Other in Project Contracts (high 8.1)
- [CVE-2021-22539](https://insights.sbomify.com/CVE-2021-22539/): Code execution in VSCode-bazel via malicious Bazel config files (high 8.2)
- [CVE-2021-22538](https://insights.sbomify.com/CVE-2021-22538/): Privilege escalation in RBAC system (medium 6.3)
- [CVE-2021-22535](https://insights.sbomify.com/CVE-2021-22535/): Information disclosure in Directory and Resource Administrator (DRA) (medium 4.9)
- [CVE-2021-22533](https://insights.sbomify.com/CVE-2021-22533/): Possible Insertion of Sensitive Information into Log File Vulnerability (medium 6.5)
- [CVE-2021-22532](https://insights.sbomify.com/CVE-2021-22532/): Possible NLDAP Denial of Service attack Vulnerability (high 7.6)
- [CVE-2021-22531](https://insights.sbomify.com/CVE-2021-22531/): Cross-site scripting in NetIQ Access Manager (medium 6.1)
- [CVE-2021-22530](https://insights.sbomify.com/CVE-2021-22530/): Improper account management vulnerability in NetIQ Advance Authentication (high 8.2)
- [CVE-2021-2253](https://insights.sbomify.com/CVE-2021-2253/): Other in Advanced Supply Chain Planning (critical 9.1)
- [CVE-2021-22529](https://insights.sbomify.com/CVE-2021-22529/): Sensitive Data Exposure leaks potential information in NetIQ Advance Authentication (medium 6.3)
- [CVE-2021-22528](https://insights.sbomify.com/CVE-2021-22528/): Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 (high 8.0)
- [CVE-2021-22527](https://insights.sbomify.com/CVE-2021-22527/): Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 (medium 6.0)
- [CVE-2021-22526](https://insights.sbomify.com/CVE-2021-22526/): Open Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 (medium 4.9)
- [CVE-2021-22525](https://insights.sbomify.com/CVE-2021-22525/): Information disclosure in NetIQ Access Manager versions prior to 5.0.1 (medium 5.5)
- [CVE-2021-22524](https://insights.sbomify.com/CVE-2021-22524/): Denial of service vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 (medium 5.4)
- [CVE-2021-22523](https://insights.sbomify.com/CVE-2021-22523/): XML external entity in Verastream Host Integrator. (high 7.6)
- [CVE-2021-22522](https://insights.sbomify.com/CVE-2021-22522/): Cross-site scripting in Verastream Host Integrator. (high 7.1)
- [CVE-2021-22521](https://insights.sbomify.com/CVE-2021-22521/): Privilege escalation in ZENworks Configuration Management (medium 6.7)
- [CVE-2021-2252](https://insights.sbomify.com/CVE-2021-2252/): Other in Loans (high 8.1)
- [CVE-2021-22519](https://insights.sbomify.com/CVE-2021-22519/): Other in SiteScope (critical 9.8)
- [CVE-2021-22518](https://insights.sbomify.com/CVE-2021-22518/): Sensitive Information logging in NetIQ Identity Manager Driver (medium 5.8)
- [CVE-2021-22517](https://insights.sbomify.com/CVE-2021-22517/): Privilege escalation in Data Protector (high 8.8)
- [CVE-2021-22516](https://insights.sbomify.com/CVE-2021-22516/): Information disclosure in Secure API Manager (SAPIM). (high 7.5)
- [CVE-2021-22515](https://insights.sbomify.com/CVE-2021-22515/): Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication Server (medium 4.8)
- [CVE-2021-22514](https://insights.sbomify.com/CVE-2021-22514/): Other in Application Performance Management (APM) (critical 9.8)
- [CVE-2021-22513](https://insights.sbomify.com/CVE-2021-22513/): Missing permission checks in Micro Focus Application Automation Tools Plugin (medium 6.5)
- [CVE-2021-22512](https://insights.sbomify.com/CVE-2021-22512/): CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin (medium 6.5)
- [CVE-2021-22511](https://insights.sbomify.com/CVE-2021-22511/): SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin (medium 6.5)
- [CVE-2021-22510](https://insights.sbomify.com/CVE-2021-22510/): Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin (medium 6.1)
- [CVE-2021-2251](https://insights.sbomify.com/CVE-2021-2251/): Other in CRM Technical Foundation (high 8.1)
- [CVE-2021-22509](https://insights.sbomify.com/CVE-2021-22509/): Handling of sensitive data in process memory in NetIQ Advance Authentication (high 8.1)
- [CVE-2021-22508](https://insights.sbomify.com/CVE-2021-22508/): Potential SQL injection in OpenText Operations Bridge Reporter (high 7.2)
- [CVE-2021-22507](https://insights.sbomify.com/CVE-2021-22507/): Auth bypass in Operations Bridge Manager (critical 9.8)
- [CVE-2021-22506](https://insights.sbomify.com/CVE-2021-22506/): Micro Focus Access Manager Information Leakage (high 7.5, exploited in the wild)
- [CVE-2021-22505](https://insights.sbomify.com/CVE-2021-22505/): Privilege escalation in Operations Agent (critical 9.8)
- [CVE-2021-22504](https://insights.sbomify.com/CVE-2021-22504/): Other in Operations Bridge Manager. (critical 9.8)
- [CVE-2021-22503](https://insights.sbomify.com/CVE-2021-22503/): Improper Neutralization of Input During Web Page Generation Vulnerability (medium 5.4)
- [CVE-2021-22502](https://insights.sbomify.com/CVE-2021-22502/): Micro Focus Operation Bridge Report (OBR) Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-22501](https://insights.sbomify.com/CVE-2021-22501/): XML external entity in Operations Bridge Manager (medium 5.3)
- [CVE-2021-22500](https://insights.sbomify.com/CVE-2021-22500/): Cross-site request forgery in Application Performance Management (medium 6.5)
- [CVE-2021-2250](https://insights.sbomify.com/CVE-2021-2250/): Other in VM VirtualBox (high 8.2)
- [CVE-2021-22499](https://insights.sbomify.com/CVE-2021-22499/): Cross-site scripting in Application Performance Management. (medium 4.8)
- [CVE-2021-22498](https://insights.sbomify.com/CVE-2021-22498/): XML external entity in Application Lifecycle Management ( Previously known as Quality Center ). (high 8.1)
- [CVE-2021-22497](https://insights.sbomify.com/CVE-2021-22497/): Advanced Authentication Improper Session Management (low 3.8)
- [CVE-2021-22496](https://insights.sbomify.com/CVE-2021-22496/): Auth bypass in Access Manager (high 7.5)
- [CVE-2021-22495](https://insights.sbomify.com/CVE-2021-22495/): Memory corruption in google:android (medium 5.5)
- [CVE-2021-22494](https://insights.sbomify.com/CVE-2021-22494/): Security feature bypass in google:android (medium 5.5)
- [CVE-2021-22492](https://insights.sbomify.com/CVE-2021-22492/): Memory corruption in google:android (high 8.8)
- [CVE-2021-22491](https://insights.sbomify.com/CVE-2021-22491/): Other in EMUI (high 7.5)
- [CVE-2021-22490](https://insights.sbomify.com/CVE-2021-22490/): Auth bypass in EMUI (medium 5.3)
- [CVE-2021-2249](https://insights.sbomify.com/CVE-2021-2249/): Other in Landed Cost Management (high 8.1)
- [CVE-2021-22489](https://insights.sbomify.com/CVE-2021-22489/): Denial of service in EMUI (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/227/