# Vulnerabilities published in 2021


- [CVE-2021-21458](https://insights.sbomify.com/CVE-2021-21458/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21457](https://insights.sbomify.com/CVE-2021-21457/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21456](https://insights.sbomify.com/CVE-2021-21456/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21455](https://insights.sbomify.com/CVE-2021-21455/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21454](https://insights.sbomify.com/CVE-2021-21454/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21453](https://insights.sbomify.com/CVE-2021-21453/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21452](https://insights.sbomify.com/CVE-2021-21452/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21451](https://insights.sbomify.com/CVE-2021-21451/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21450](https://insights.sbomify.com/CVE-2021-21450/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-2145](https://insights.sbomify.com/CVE-2021-2145/): Other in VM VirtualBox (high 7.5)
- [CVE-2021-21449](https://insights.sbomify.com/CVE-2021-21449/): Memory corruption in SAP 3D Visual Enterprise Viewer (medium 4.3)
- [CVE-2021-21448](https://insights.sbomify.com/CVE-2021-21448/): Information disclosure in SAP GUI FOR WINDOWS (medium 5.3)
- [CVE-2021-21447](https://insights.sbomify.com/CVE-2021-21447/): Cross-site scripting in SAP BusinessObjects Business Intelligence platform (Web Intelligence HTML interface) (medium 5.4)
- [CVE-2021-21446](https://insights.sbomify.com/CVE-2021-21446/): Denial of service in SAP NetWeaver AS ABAP (high 7.5)
- [CVE-2021-21445](https://insights.sbomify.com/CVE-2021-21445/): Other in SAP Commerce Cloud (medium 5.4)
- [CVE-2021-21444](https://insights.sbomify.com/CVE-2021-21444/): Security feature bypass in SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) (medium 5.4)
- [CVE-2021-21443](https://insights.sbomify.com/CVE-2021-21443/): Unautorized listing of the customer user emails (low 3.5)
- [CVE-2021-21442](https://insights.sbomify.com/CVE-2021-21442/): XSS vulnerability in Time Accounting (medium 4.5)
- [CVE-2021-21441](https://insights.sbomify.com/CVE-2021-21441/): XSS in the ticket overview screens (high 7.5)
- [CVE-2021-21440](https://insights.sbomify.com/CVE-2021-21440/): Support Bundle includes S/Mime and PGP keys (medium 5.2)
- [CVE-2021-2144](https://insights.sbomify.com/CVE-2021-2144/): Other in MySQL Server (high 7.2)
- [CVE-2021-21439](https://insights.sbomify.com/CVE-2021-21439/): Possible DoS attack using a special crafted URL in email body (medium 6.5)
- [CVE-2021-21438](https://insights.sbomify.com/CVE-2021-21438/): FAQ articles are shown to users without permission (low 3.5)
- [CVE-2021-21437](https://insights.sbomify.com/CVE-2021-21437/): Config Items are shown to users without permission (low 3.5)
- [CVE-2021-21436](https://insights.sbomify.com/CVE-2021-21436/): Agent is able to link customer's Config Items without permission (low 3.5)
- [CVE-2021-21435](https://insights.sbomify.com/CVE-2021-21435/): Information exposure in PDF export (medium 5.7)
- [CVE-2021-21434](https://insights.sbomify.com/CVE-2021-21434/): XSS in Survey Module (low 3.5)
- [CVE-2021-21433](https://insights.sbomify.com/CVE-2021-21433/): Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation (critical 9.9)
- [CVE-2021-21432](https://insights.sbomify.com/CVE-2021-21432/): Reject unauthorized access with GitHub PATs (high 7.5)
- [CVE-2021-21431](https://insights.sbomify.com/CVE-2021-21431/): Improper Input Validation in sopel-plugins.channelmgnt (high 7.6)
- [CVE-2021-21430](https://insights.sbomify.com/CVE-2021-21430/): Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code (medium 6.2)
- [CVE-2021-21429](https://insights.sbomify.com/CVE-2021-21429/): Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin (medium 4.0)
- [CVE-2021-21428](https://insights.sbomify.com/CVE-2021-21428/): Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator (critical 9.3)
- [CVE-2021-21427](https://insights.sbomify.com/CVE-2021-21427/): Backport for CVE-2021-21024 Blind SQLi from Magento 2 (critical 9.1)
- [CVE-2021-21426](https://insights.sbomify.com/CVE-2021-21426/): Fixes a bug in Zend Framework's Stream HTTP Wrapper (critical 9.8)
- [CVE-2021-21425](https://insights.sbomify.com/CVE-2021-21425/): Unauthenticated Arbitrary YAML Write/Update leads to Code Execution (critical 9.3)
- [CVE-2021-21424](https://insights.sbomify.com/CVE-2021-21424/): Prevent user enumeration using Guard or the new Authenticator-based Security (medium 5.3)
- [CVE-2021-21423](https://insights.sbomify.com/CVE-2021-21423/): Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen (medium 6.8)
- [CVE-2021-21422](https://insights.sbomify.com/CVE-2021-21422/): XSS Vulnerability in mongo-express (high 8.1)
- [CVE-2021-21421](https://insights.sbomify.com/CVE-2021-21421/): ApiKey secret could be revelated on network issue (high 8.1)
- [CVE-2021-21420](https://insights.sbomify.com/CVE-2021-21420/): Vulnerability in Stripe for Visual Studio Code < 1.7.3 (high 7.5)
- [CVE-2021-2142](https://insights.sbomify.com/CVE-2021-2142/): Cross-site scripting in WebLogic Server (medium 6.1)
- [CVE-2021-21419](https://insights.sbomify.com/CVE-2021-21419/): Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet (medium 5.3)
- [CVE-2021-21418](https://insights.sbomify.com/CVE-2021-21418/): Potential XSS injection in the newsletter conditions field (medium 4.6)
- [CVE-2021-21417](https://insights.sbomify.com/CVE-2021-21417/): Use after free in fluidsynth (high 7.2)
- [CVE-2021-21416](https://insights.sbomify.com/CVE-2021-21416/): Potential sensitive information disclosed in error reports (low 3.7)
- [CVE-2021-21415](https://insights.sbomify.com/CVE-2021-21415/): Visual Studio Code Prisma Extension Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-21414](https://insights.sbomify.com/CVE-2021-21414/): Command injection vulnerability in @prisma/sdk in getPackedPackage function (high 7.7)
- [CVE-2021-21413](https://insights.sbomify.com/CVE-2021-21413/): Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate (high 8.0)
- [CVE-2021-21412](https://insights.sbomify.com/CVE-2021-21412/): [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values (medium 6.4)
- [CVE-2021-21411](https://insights.sbomify.com/CVE-2021-21411/): Incorrect authorization in OAuth2-Proxy (medium 5.5)
- [CVE-2021-21410](https://insights.sbomify.com/CVE-2021-21410/): Out-of-bounds read in the 6LoWPAN implementation (high 8.2)
- [CVE-2021-2141](https://insights.sbomify.com/CVE-2021-2141/): Other in FLEXCUBE Direct Banking (low 2.0)
- [CVE-2021-21409](https://insights.sbomify.com/CVE-2021-21409/): Possible request smuggling in HTTP/2 due missing validation of content-length (medium 5.9)
- [CVE-2021-21408](https://insights.sbomify.com/CVE-2021-21408/): Access to restricted PHP code by dynamic static class access in smarty (high 8.8)
- [CVE-2021-21407](https://insights.sbomify.com/CVE-2021-21407/): Portal : the CSRF token isn't validated (high 8.0)
- [CVE-2021-21406](https://insights.sbomify.com/CVE-2021-21406/): Command Injection vulnerability in the Setup Wizard (medium 5.8)
- [CVE-2021-21405](https://insights.sbomify.com/CVE-2021-21405/): BLS Signature "Malleability" (medium 5.9)
- [CVE-2021-21404](https://insights.sbomify.com/CVE-2021-21404/): Crash due to malformed relay protocol message (high 7.5)
- [CVE-2021-21403](https://insights.sbomify.com/CVE-2021-21403/): Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server (high 7.5)
- [CVE-2021-21402](https://insights.sbomify.com/CVE-2021-21402/): Unauthenticated Arbitrary File Access in Jellyfin (high 7.7)
- [CVE-2021-21401](https://insights.sbomify.com/CVE-2021-21401/): Invalid free() call in Nanopb (high 7.1)
- [CVE-2021-21400](https://insights.sbomify.com/CVE-2021-21400/): Entering code in App Lock modal sends input to conversation (high 7.1)
- [CVE-2021-2140](https://insights.sbomify.com/CVE-2021-2140/): Other in Financial Services Analytical Applications Infrastructure (medium 6.1)
- [CVE-2021-21399](https://insights.sbomify.com/CVE-2021-21399/): Unauthenticated SubSonic backend access in Ampache (critical 9.1)
- [CVE-2021-21398](https://insights.sbomify.com/CVE-2021-21398/): Possible XSS injection through DataColumn Grid class (medium 5.4)
- [CVE-2021-21396](https://insights.sbomify.com/CVE-2021-21396/): Bulk list client endpoint exposes too much metadata about a client (medium 6.5)
- [CVE-2021-21395](https://insights.sbomify.com/CVE-2021-21395/): Magneto-lts vulnerable to Cross-Site Request Forgery (medium 4.2)
- [CVE-2021-21394](https://insights.sbomify.com/CVE-2021-21394/): Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints (medium 5.3)
- [CVE-2021-21393](https://insights.sbomify.com/CVE-2021-21393/): Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints (medium 5.3)
- [CVE-2021-21392](https://insights.sbomify.com/CVE-2021-21392/): Open redirect via transitional IPv6 addresses on dual-stack networks (medium 6.3)
- [CVE-2021-21391](https://insights.sbomify.com/CVE-2021-21391/): Regular expression Denial of Service in multiple packages (medium 6.5)
- [CVE-2021-21390](https://insights.sbomify.com/CVE-2021-21390/): MITM modification of request bodies in MinIO (medium 6.5)
- [CVE-2021-21389](https://insights.sbomify.com/CVE-2021-21389/): BuddyPress privilege escalation via REST API (high 8.1)
- [CVE-2021-21388](https://insights.sbomify.com/CVE-2021-21388/): Command Injection Vulnerability in systeminformation (high 8.9)
- [CVE-2021-21387](https://insights.sbomify.com/CVE-2021-21387/): Partial secret key disclosure, improper safety number calculation, & inadequate encryption strength (high 8.1)
- [CVE-2021-21386](https://insights.sbomify.com/CVE-2021-21386/): Improper Neutralization of Argument Delimiters in a Decompiling Package Process (critical 9.3)
- [CVE-2021-21385](https://insights.sbomify.com/CVE-2021-21385/): Disabled hostname verification and accepting self-signed certificates (high 8.8)
- [CVE-2021-21384](https://insights.sbomify.com/CVE-2021-21384/): Null characters not escaped in shescape (medium 6.3)
- [CVE-2021-21383](https://insights.sbomify.com/CVE-2021-21383/): XSS in Wiki.js (high 7.6)
- [CVE-2021-21382](https://insights.sbomify.com/CVE-2021-21382/): Unsafe loopback forwarding interface in Restund (high 8.6)
- [CVE-2021-21381](https://insights.sbomify.com/CVE-2021-21381/): Sandbox escape via special tokens in .desktop file (high 7.1)
- [CVE-2021-21380](https://insights.sbomify.com/CVE-2021-21380/): Rating Script Service expose XWiki to SQL injection (high 7.7)
- [CVE-2021-2138](https://insights.sbomify.com/CVE-2021-2138/): Other in Oracle Cloud Infrastructure Data Science Notebook Sessions (medium 4.6)
- [CVE-2021-21379](https://insights.sbomify.com/CVE-2021-21379/): It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro (high 7.7)
- [CVE-2021-21378](https://insights.sbomify.com/CVE-2021-21378/): JWT authentication bypass with unknown issuer token (high 8.2)
- [CVE-2021-21377](https://insights.sbomify.com/CVE-2021-21377/): Open Redirect in OMERO.web (medium 4.8)
- [CVE-2021-21376](https://insights.sbomify.com/CVE-2021-21376/): Information Exposure in OMERO.web (medium 6.4)
- [CVE-2021-21375](https://insights.sbomify.com/CVE-2021-21375/): Crash in receiving updated SDP answer after initial SDP negotiation failed (medium 6.5)
- [CVE-2021-21374](https://insights.sbomify.com/CVE-2021-21374/): Nimble fails to validate certificates due to insecure httpClient defaults (high 8.1)
- [CVE-2021-21373](https://insights.sbomify.com/CVE-2021-21373/): Nimble falls back to insecure http url when fetching packages (high 7.5)
- [CVE-2021-21372](https://insights.sbomify.com/CVE-2021-21372/): Nimble arbitrary code execution for specially crafted package metadata (high 8.3)
- [CVE-2021-21371](https://insights.sbomify.com/CVE-2021-21371/): Execution of untrusted code through config file (medium 5.0)
- [CVE-2021-21370](https://insights.sbomify.com/CVE-2021-21370/): Cross-Site Scripting in Content Preview (CType menu) (medium 5.4)
- [CVE-2021-2137](https://insights.sbomify.com/CVE-2021-2137/): Other in Enterprise Manager Base Platform (high 8.8)
- [CVE-2021-21369](https://insights.sbomify.com/CVE-2021-21369/): Potential DoS in Besu HTTP JSON-RPC API (medium 6.5)
- [CVE-2021-21368](https://insights.sbomify.com/CVE-2021-21368/): Prototype poisoning (medium 6.7)
- [CVE-2021-21367](https://insights.sbomify.com/CVE-2021-21367/): Incorrect Authorization in switchboard-plug-bluetooth (medium 6.1)
- [CVE-2021-21366](https://insights.sbomify.com/CVE-2021-21366/): Misinterpretation of malicious XML input (medium 4.3)
- [CVE-2021-21365](https://insights.sbomify.com/CVE-2021-21365/): Cross-Site Scripting in Content Rendering (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/238/