# Vulnerabilities published in 2021


- [CVE-2021-21658](https://insights.sbomify.com/CVE-2021-21658/): XML external entity vulnerability in Jenkins Nuget Plugin (critical 9.1)
- [CVE-2021-21657](https://insights.sbomify.com/CVE-2021-21657/): XXE vulnerability in Jenkins Filesystem Trigger Plugin (high 8.8)
- [CVE-2021-21656](https://insights.sbomify.com/CVE-2021-21656/): XML external entity (XXE) attacks in Jenkins Xcode integration Plugin (high 7.1)
- [CVE-2021-21655](https://insights.sbomify.com/CVE-2021-21655/): Cross-Site Request Forgery in Jenkins P4 Plugin (high 7.1)
- [CVE-2021-21654](https://insights.sbomify.com/CVE-2021-21654/): Missing Authorization in Jenkins P4 plugin (medium 4.3)
- [CVE-2021-21653](https://insights.sbomify.com/CVE-2021-21653/): Missing Authorization in jenkins xray-connector (medium 4.3)
- [CVE-2021-21652](https://insights.sbomify.com/CVE-2021-21652/): CSRF vulnerability in Jenkins Xray - Test Management for Jira Plugin allows capturing credentials (high 7.1)
- [CVE-2021-21651](https://insights.sbomify.com/CVE-2021-21651/): Missing Authorization in Jenkins S3 publisher Plugin (medium 4.3)
- [CVE-2021-21650](https://insights.sbomify.com/CVE-2021-21650/): Missing Authorization in Jenkins S3 publisher Plugin (medium 4.3)
- [CVE-2021-21649](https://insights.sbomify.com/CVE-2021-21649/): Cross-site Scripting in Jenkins Dashboard View Plugin (medium 5.4)
- [CVE-2021-21648](https://insights.sbomify.com/CVE-2021-21648/): Cross-Site Request Forgery in Jenkins Credentials Plugin (medium 6.1)
- [CVE-2021-21647](https://insights.sbomify.com/CVE-2021-21647/): Missing permission check in Jenkins CloudBees CD Plugin allows scheduling builds (medium 4.3)
- [CVE-2021-21646](https://insights.sbomify.com/CVE-2021-21646/): Remote code execution vulnerability in Jenkins Templating Engine Plugin (high 8.8)
- [CVE-2021-21645](https://insights.sbomify.com/CVE-2021-21645/): Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs (medium 4.3)
- [CVE-2021-21644](https://insights.sbomify.com/CVE-2021-21644/): CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files (medium 5.4)
- [CVE-2021-21643](https://insights.sbomify.com/CVE-2021-21643/): Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs (medium 6.5)
- [CVE-2021-21642](https://insights.sbomify.com/CVE-2021-21642/): XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin (high 8.1)
- [CVE-2021-21641](https://insights.sbomify.com/CVE-2021-21641/): CSRF vulnerability in Jenkins promoted builds Plugin (medium 4.3)
- [CVE-2021-21640](https://insights.sbomify.com/CVE-2021-21640/): View name validation bypass in Jenkins (medium 4.3)
- [CVE-2021-2164](https://insights.sbomify.com/CVE-2021-2164/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-21639](https://insights.sbomify.com/CVE-2021-21639/): Lack of type validation in agent related REST API in Jenkins (medium 4.3)
- [CVE-2021-21638](https://insights.sbomify.com/CVE-2021-21638/): CSRF vulnerability in Jenkins Team Foundation Server Plugin allow capturing credentials (high 8.8)
- [CVE-2021-21637](https://insights.sbomify.com/CVE-2021-21637/): Missing permission check in Jenkins Team Foundation Server Plugin allow capturing credentials (medium 6.5)
- [CVE-2021-21636](https://insights.sbomify.com/CVE-2021-21636/): Missing permission check in Jenkins Team Foundation Server Plugin allows enumerating credentials IDs (medium 4.3)
- [CVE-2021-21635](https://insights.sbomify.com/CVE-2021-21635/): Stored XSS vulnerability in Jenkins REST List Parameter Plugin (medium 5.4)
- [CVE-2021-21634](https://insights.sbomify.com/CVE-2021-21634/): Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin (medium 6.5)
- [CVE-2021-21633](https://insights.sbomify.com/CVE-2021-21633/): CSRF vulnerability and in Jenkins OWASP Dependency-Track Plugin allow capturing credentials (high 8.8)
- [CVE-2021-21632](https://insights.sbomify.com/CVE-2021-21632/): Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials (medium 6.5)
- [CVE-2021-21631](https://insights.sbomify.com/CVE-2021-21631/): Missing permission check in Jenkins Cloud Statistics Plugin (medium 4.3)
- [CVE-2021-21630](https://insights.sbomify.com/CVE-2021-21630/): Stored XSS vulnerability in Jenkins Extra Columns Plugin (medium 5.4)
- [CVE-2021-2163](https://insights.sbomify.com/CVE-2021-2163/): Other in Java SE JDK and JRE (medium 5.3)
- [CVE-2021-21629](https://insights.sbomify.com/CVE-2021-21629/): CSRF vulnerability in Jenkins Build With Parameters Plugin (high 8.8)
- [CVE-2021-21628](https://insights.sbomify.com/CVE-2021-21628/): Stored XSS vulnerability in Jenkins Build With Parameters Plugin (medium 5.4)
- [CVE-2021-21627](https://insights.sbomify.com/CVE-2021-21627/): CSRF vulnerability in Jenkins Libvirt Agents Plugin (high 8.8)
- [CVE-2021-21626](https://insights.sbomify.com/CVE-2021-21626/): Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents (medium 4.3)
- [CVE-2021-21625](https://insights.sbomify.com/CVE-2021-21625/): Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs (medium 4.3)
- [CVE-2021-21624](https://insights.sbomify.com/CVE-2021-21624/): Incorrect permission checks in Jenkins Role-based Authorization Strategy Plugin may allow accessing some items (medium 4.3)
- [CVE-2021-21623](https://insights.sbomify.com/CVE-2021-21623/): Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items (medium 6.5)
- [CVE-2021-21622](https://insights.sbomify.com/CVE-2021-21622/): Stored XSS vulnerability in Jenkins Artifact Repository Parameter Plugin (medium 5.4)
- [CVE-2021-21621](https://insights.sbomify.com/CVE-2021-21621/): Support bundles can include user session IDs in Jenkins Support Core Plugin (medium 5.3)
- [CVE-2021-21620](https://insights.sbomify.com/CVE-2021-21620/): Cross-Site Request Forgery in the Jenkins Claim plugin (medium 4.3)
- [CVE-2021-2162](https://insights.sbomify.com/CVE-2021-2162/): Other in MySQL Server (medium 4.3)
- [CVE-2021-21619](https://insights.sbomify.com/CVE-2021-21619/): XSS vulnerability in Jenkins Claim Plugin (medium 5.4)
- [CVE-2021-21618](https://insights.sbomify.com/CVE-2021-21618/): Stored XSS vulnerability in Jenkins Repository Connector Plugin (medium 5.4)
- [CVE-2021-21617](https://insights.sbomify.com/CVE-2021-21617/): CSRF vulnerability in Jenkins Configuration Slicing Plugin (high 8.8)
- [CVE-2021-21616](https://insights.sbomify.com/CVE-2021-21616/): Stored XSS vulnerability in Jenkins Active Choices Plugin (medium 4.6)
- [CVE-2021-21615](https://insights.sbomify.com/CVE-2021-21615/): Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins (medium 5.3)
- [CVE-2021-21614](https://insights.sbomify.com/CVE-2021-21614/): Credentials stored in plain text by Jenkins Bumblebee HP ALM Plugin (medium 5.5)
- [CVE-2021-21613](https://insights.sbomify.com/CVE-2021-21613/): XSS vulnerability in Jenkins TICS Plugin (medium 6.1)
- [CVE-2021-21612](https://insights.sbomify.com/CVE-2021-21612/): Credentials stored in plain text by Jenkins TraceTronic ECU-TEST Plugin (medium 5.5)
- [CVE-2021-21611](https://insights.sbomify.com/CVE-2021-21611/): Stored XSS vulnerability in Jenkins on new item page (medium 5.4)
- [CVE-2021-21610](https://insights.sbomify.com/CVE-2021-21610/): Reflected XSS vulnerability in Jenkins markup formatter preview (medium 6.1)
- [CVE-2021-2161](https://insights.sbomify.com/CVE-2021-2161/): Other in Java SE JDK and JRE (medium 5.9)
- [CVE-2021-21609](https://insights.sbomify.com/CVE-2021-21609/): Missing permission check for paths with specific prefix in Jenkins (medium 5.3)
- [CVE-2021-21608](https://insights.sbomify.com/CVE-2021-21608/): Stored XSS vulnerability in Jenkins button labels (medium 5.4)
- [CVE-2021-21607](https://insights.sbomify.com/CVE-2021-21607/): Excessive memory allocation in graph URLs leads to denial of service in Jenkins (medium 6.5)
- [CVE-2021-21606](https://insights.sbomify.com/CVE-2021-21606/): Arbitrary file existence check in file fingerprints in Jenkins (medium 4.3)
- [CVE-2021-21605](https://insights.sbomify.com/CVE-2021-21605/): Path traversal vulnerability in Jenkins agent names (high 8.0)
- [CVE-2021-21604](https://insights.sbomify.com/CVE-2021-21604/): Improper handling of REST API XML deserialization errors in Jenkins (high 8.0)
- [CVE-2021-21603](https://insights.sbomify.com/CVE-2021-21603/): XSS vulnerability in Jenkins notification bar (medium 5.4)
- [CVE-2021-21602](https://insights.sbomify.com/CVE-2021-21602/): Arbitrary file read vulnerability in workspace browsers in Jenkins (medium 6.5)
- [CVE-2021-21601](https://insights.sbomify.com/CVE-2021-21601/): Information disclosure in Data Protection Search (high 8.8)
- [CVE-2021-21600](https://insights.sbomify.com/CVE-2021-21600/): Denial of service in NetWorker (medium 6.5)
- [CVE-2021-2160](https://insights.sbomify.com/CVE-2021-2160/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-21599](https://insights.sbomify.com/CVE-2021-21599/): Command injection in PowerScale OneFS (medium 6.0)
- [CVE-2021-21598](https://insights.sbomify.com/CVE-2021-21598/): Information disclosure in Wyse ThinOS (low 3.9)
- [CVE-2021-21597](https://insights.sbomify.com/CVE-2021-21597/): Information disclosure in Wyse ThinOS (high 7.2)
- [CVE-2021-21596](https://insights.sbomify.com/CVE-2021-21596/): Information disclosure in Dell OpenManage Enterprise (critical 9.6)
- [CVE-2021-21595](https://insights.sbomify.com/CVE-2021-21595/): Command injection in PowerScale OneFS (medium 6.0)
- [CVE-2021-21594](https://insights.sbomify.com/CVE-2021-21594/): Information disclosure in PowerScale OneFS (high 8.2)
- [CVE-2021-21592](https://insights.sbomify.com/CVE-2021-21592/): Information disclosure in PowerScale OneFS (low 3.1)
- [CVE-2021-21591](https://insights.sbomify.com/CVE-2021-21591/): Information disclosure in Unity (medium 6.4)
- [CVE-2021-21590](https://insights.sbomify.com/CVE-2021-21590/): Information disclosure in Unity (medium 6.4)
- [CVE-2021-2159](https://insights.sbomify.com/CVE-2021-2159/): Other in PeopleSoft Enterprise CS Campus Community (low 3.5)
- [CVE-2021-21589](https://insights.sbomify.com/CVE-2021-21589/): Privilege escalation in Unity (medium 5.7)
- [CVE-2021-21588](https://insights.sbomify.com/CVE-2021-21588/): Cross-site request forgery in PowerFlex (medium 6.5)
- [CVE-2021-21587](https://insights.sbomify.com/CVE-2021-21587/): Information disclosure in Wyse Management Suite (medium 5.3)
- [CVE-2021-21586](https://insights.sbomify.com/CVE-2021-21586/): Path traversal in Wyse Management Suite (high 8.1)
- [CVE-2021-21585](https://insights.sbomify.com/CVE-2021-21585/): Command injection in Dell OpenManage Enterprise (critical 9.1)
- [CVE-2021-21584](https://insights.sbomify.com/CVE-2021-21584/): Information disclosure in Dell OpenManage Enterprise (high 7.7)
- [CVE-2021-21581](https://insights.sbomify.com/CVE-2021-21581/): Cross-site scripting in Integrated Dell Remote Access Controller (iDRAC) (medium 6.5)
- [CVE-2021-21580](https://insights.sbomify.com/CVE-2021-21580/): Other in Integrated Dell Remote Access Controller (iDRAC) (medium 4.3)
- [CVE-2021-2158](https://insights.sbomify.com/CVE-2021-2158/): Other in Hyperion Financial Management (low 3.9)
- [CVE-2021-21579](https://insights.sbomify.com/CVE-2021-21579/): Open redirect in Integrated Dell Remote Access Controller (iDRAC) (medium 6.1)
- [CVE-2021-21578](https://insights.sbomify.com/CVE-2021-21578/): Open redirect in Integrated Dell Remote Access Controller (iDRAC) (medium 6.1)
- [CVE-2021-21577](https://insights.sbomify.com/CVE-2021-21577/): Cross-site scripting in Integrated Dell Remote Access Controller (iDRAC) (medium 6.1)
- [CVE-2021-21576](https://insights.sbomify.com/CVE-2021-21576/): Cross-site scripting in Integrated Dell Remote Access Controller (iDRAC) (medium 6.1)
- [CVE-2021-21575](https://insights.sbomify.com/CVE-2021-21575/): Weak cryptography in BSAFE Micro Edition Suite (medium 5.9)
- [CVE-2021-21574](https://insights.sbomify.com/CVE-2021-21574/): Memory corruption in BIOSConnect (high 7.2)
- [CVE-2021-21573](https://insights.sbomify.com/CVE-2021-21573/): Memory corruption in BIOSConnect (high 7.2)
- [CVE-2021-21572](https://insights.sbomify.com/CVE-2021-21572/): Memory corruption in BIOSConnect (high 7.2)
- [CVE-2021-21571](https://insights.sbomify.com/CVE-2021-21571/): Security feature bypass in UEFI BIOS https stack (medium 5.9)
- [CVE-2021-21570](https://insights.sbomify.com/CVE-2021-21570/): Information disclosure in NetWorker (medium 6.8)
- [CVE-2021-2157](https://insights.sbomify.com/CVE-2021-2157/): Information disclosure in TopLink (high 7.5)
- [CVE-2021-21569](https://insights.sbomify.com/CVE-2021-21569/): Path traversal in NetWorker (medium 6.8)
- [CVE-2021-21568](https://insights.sbomify.com/CVE-2021-21568/): Other in PowerScale OneFS (medium 4.3)
- [CVE-2021-21567](https://insights.sbomify.com/CVE-2021-21567/): Privilege escalation in PowerScale OneFS (high 7.8)
- [CVE-2021-21565](https://insights.sbomify.com/CVE-2021-21565/): Denial of service in PowerScale OneFS (medium 5.3)
- [CVE-2021-21564](https://insights.sbomify.com/CVE-2021-21564/): Auth bypass in Dell OpenManage Enterprise (critical 9.8)
- [CVE-2021-21563](https://insights.sbomify.com/CVE-2021-21563/): Denial of service in PowerScale OneFS (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/236/