# Vulnerabilities published in 2021


- [CVE-2021-21364](https://insights.sbomify.com/CVE-2021-21364/): Generated Code Contains Local Information Disclosure Vulnerability (medium 5.3)
- [CVE-2021-21363](https://insights.sbomify.com/CVE-2021-21363/): Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory (medium 5.3)
- [CVE-2021-21362](https://insights.sbomify.com/CVE-2021-21362/): Bypassing readOnly policy by creating a temporary 'mc share upload' URL (high 7.7)
- [CVE-2021-21361](https://insights.sbomify.com/CVE-2021-21361/): Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin (medium 5.3)
- [CVE-2021-21360](https://insights.sbomify.com/CVE-2021-21360/): Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup (medium 5.3)
- [CVE-2021-2136](https://insights.sbomify.com/CVE-2021-2136/): Other in WebLogic Server (critical 9.8)
- [CVE-2021-21359](https://insights.sbomify.com/CVE-2021-21359/): Denial of Service in Page Error Handling (medium 5.9)
- [CVE-2021-21358](https://insights.sbomify.com/CVE-2021-21358/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form (medium 5.4)
- [CVE-2021-21357](https://insights.sbomify.com/CVE-2021-21357/): Broken Access Control in Form Framework (high 8.3)
- [CVE-2021-21355](https://insights.sbomify.com/CVE-2021-21355/): Unrestricted File Upload in Form Framework (high 8.6)
- [CVE-2021-21354](https://insights.sbomify.com/CVE-2021-21354/): Open redirect in pollbot (high 7.4)
- [CVE-2021-21353](https://insights.sbomify.com/CVE-2021-21353/): Remote code execution in pug (medium 6.8)
- [CVE-2021-21352](https://insights.sbomify.com/CVE-2021-21352/): Predictable tokens used for password resets (medium 6.8)
- [CVE-2021-21351](https://insights.sbomify.com/CVE-2021-21351/): XStream is vulnerable to an Arbitrary Code Execution attack (medium 5.4)
- [CVE-2021-21350](https://insights.sbomify.com/CVE-2021-21350/): XStream is vulnerable to an Arbitrary Code Execution attack (medium 5.3)
- [CVE-2021-2135](https://insights.sbomify.com/CVE-2021-2135/): Other in WebLogic Server (critical 9.8)
- [CVE-2021-21349](https://insights.sbomify.com/CVE-2021-21349/): A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host (medium 6.1)
- [CVE-2021-21348](https://insights.sbomify.com/CVE-2021-21348/): XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) (medium 5.3)
- [CVE-2021-21347](https://insights.sbomify.com/CVE-2021-21347/): XStream is vulnerable to an Arbitrary Code Execution attack (medium 6.1)
- [CVE-2021-21346](https://insights.sbomify.com/CVE-2021-21346/): XStream is vulnerable to an Arbitrary Code Execution attack (medium 6.1)
- [CVE-2021-21345](https://insights.sbomify.com/CVE-2021-21345/): XStream is vulnerable to a Remote Command Execution attack (medium 5.8)
- [CVE-2021-21344](https://insights.sbomify.com/CVE-2021-21344/): XStream is vulnerable to an Arbitrary Code Execution attack (medium 5.3)
- [CVE-2021-21343](https://insights.sbomify.com/CVE-2021-21343/): XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights (medium 5.3)
- [CVE-2021-21342](https://insights.sbomify.com/CVE-2021-21342/): A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host (medium 5.3)
- [CVE-2021-21341](https://insights.sbomify.com/CVE-2021-21341/): XStream can cause a Denial of Service (high 7.5)
- [CVE-2021-21340](https://insights.sbomify.com/CVE-2021-21340/): Cross-Site Scripting in Content Preview (medium 5.4)
- [CVE-2021-2134](https://insights.sbomify.com/CVE-2021-2134/): Denial of service in Enterprise Manager for Fusion Middleware (medium 6.5)
- [CVE-2021-21339](https://insights.sbomify.com/CVE-2021-21339/): Cleartext storage of session identifier (medium 5.9)
- [CVE-2021-21338](https://insights.sbomify.com/CVE-2021-21338/): Open Redirection in Login Handling (medium 4.7)
- [CVE-2021-21337](https://insights.sbomify.com/CVE-2021-21337/): URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService (medium 5.7)
- [CVE-2021-21336](https://insights.sbomify.com/CVE-2021-21336/): Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager (medium 6.5)
- [CVE-2021-21335](https://insights.sbomify.com/CVE-2021-21335/): Basic Authentication can be bypassed using a malformed username (medium 5.3)
- [CVE-2021-21334](https://insights.sbomify.com/CVE-2021-21334/): environment variable leak (medium 6.3)
- [CVE-2021-21333](https://insights.sbomify.com/CVE-2021-21333/): HTML injection in email and account expiry notifications (medium 6.1)
- [CVE-2021-21332](https://insights.sbomify.com/CVE-2021-21332/): Cross-site scripting (XSS) vulnerability in the password reset endpoint (medium 6.9)
- [CVE-2021-21331](https://insights.sbomify.com/CVE-2021-21331/): DataDog API Client contains a Local Information Disclosure Vulnerability (low 3.0)
- [CVE-2021-21330](https://insights.sbomify.com/CVE-2021-21330/): Open redirect vulnerability in aiohttp (low 3.1)
- [CVE-2021-21329](https://insights.sbomify.com/CVE-2021-21329/): Multi Factor Authentication Token Improperly Validated On User Login (high 8.7)
- [CVE-2021-21328](https://insights.sbomify.com/CVE-2021-21328/): Denial of Service (medium 5.3)
- [CVE-2021-21327](https://insights.sbomify.com/CVE-2021-21327/): Unsafe Reflection in getItemForItemtype() (medium 6.8)
- [CVE-2021-21326](https://insights.sbomify.com/CVE-2021-21326/): Horizontal Privilege Escalation (high 7.7)
- [CVE-2021-21325](https://insights.sbomify.com/CVE-2021-21325/): Stored XSS in budget type (medium 6.2)
- [CVE-2021-21324](https://insights.sbomify.com/CVE-2021-21324/): Insecure Direct Object Reference (IDOR) on "Solutions" (medium 6.8)
- [CVE-2021-21323](https://insights.sbomify.com/CVE-2021-21323/): Regression in DNS leakage from Tor windows (medium 4.3)
- [CVE-2021-21322](https://insights.sbomify.com/CVE-2021-21322/): Prefix escape (critical 10.0)
- [CVE-2021-21321](https://insights.sbomify.com/CVE-2021-21321/): Prefix escape (critical 10.0)
- [CVE-2021-21320](https://insights.sbomify.com/CVE-2021-21320/): User content sandbox can be confused into opening arbitrary documents (low 2.6)
- [CVE-2021-21319](https://insights.sbomify.com/CVE-2021-21319/): Several stored XSS (medium 6.8)
- [CVE-2021-21318](https://insights.sbomify.com/CVE-2021-21318/): Removing access may not effect published series (medium 5.4)
- [CVE-2021-21317](https://insights.sbomify.com/CVE-2021-21317/): Denial of Service in uap-core (medium 5.3)
- [CVE-2021-21316](https://insights.sbomify.com/CVE-2021-21316/): Arbitrary code execution in less-openui5 (medium 6.3)
- [CVE-2021-21315](https://insights.sbomify.com/CVE-2021-21315/): System Information Library for Node.JS Command Injection (high 7.1, exploited in the wild)
- [CVE-2021-21314](https://insights.sbomify.com/CVE-2021-21314/): XSS injection on ticket update (medium 5.4)
- [CVE-2021-21313](https://insights.sbomify.com/CVE-2021-21313/): XSS on tabs (medium 4.9)
- [CVE-2021-21312](https://insights.sbomify.com/CVE-2021-21312/): Stored XSS on documents (medium 5.4)
- [CVE-2021-21311](https://insights.sbomify.com/CVE-2021-21311/): Adminer Server-Side Request Forgery (high 7.2, exploited in the wild)
- [CVE-2021-21310](https://insights.sbomify.com/CVE-2021-21310/): Token verification bug in next-auth (medium 6.1)
- [CVE-2021-2131](https://insights.sbomify.com/CVE-2021-2131/): Other in VM VirtualBox (medium 6.0)
- [CVE-2021-21309](https://insights.sbomify.com/CVE-2021-21309/): Integer overflow on 32-bit systems (medium 5.4)
- [CVE-2021-21308](https://insights.sbomify.com/CVE-2021-21308/): Improper session management for soft logout (medium 6.1)
- [CVE-2021-21307](https://insights.sbomify.com/CVE-2021-21307/): Remote Code Exploit in Lucee Admin (high 8.6)
- [CVE-2021-21306](https://insights.sbomify.com/CVE-2021-21306/): Denial of Service in Marked (medium 5.3)
- [CVE-2021-21305](https://insights.sbomify.com/CVE-2021-21305/): Code Injection vulnerability in CarrierWave (high 7.4)
- [CVE-2021-21304](https://insights.sbomify.com/CVE-2021-21304/): Prototype Pollution in Dynamoose (high 7.2)
- [CVE-2021-21303](https://insights.sbomify.com/CVE-2021-21303/): Injection attack in Helm (medium 5.9)
- [CVE-2021-21302](https://insights.sbomify.com/CVE-2021-21302/): CSV Injection via csv export (medium 6.8)
- [CVE-2021-21301](https://insights.sbomify.com/CVE-2021-21301/): Video feed was captured while user has disabled video (low 2.6)
- [CVE-2021-21300](https://insights.sbomify.com/CVE-2021-21300/): malicious repositories can execute remote code while cloning (high 8.0)
- [CVE-2021-2130](https://insights.sbomify.com/CVE-2021-2130/): Denial of service in VM VirtualBox (medium 4.4)
- [CVE-2021-21299](https://insights.sbomify.com/CVE-2021-21299/): Multiple Transfer-Encoding headers misinterprets request payload (medium 4.8)
- [CVE-2021-21298](https://insights.sbomify.com/CVE-2021-21298/): Path traversal in Node-Red (low 3.5)
- [CVE-2021-21297](https://insights.sbomify.com/CVE-2021-21297/): Prototype Pollution in Node-Red (high 7.7)
- [CVE-2021-21296](https://insights.sbomify.com/CVE-2021-21296/): Denial-of-service in Fleet (low 2.7)
- [CVE-2021-21295](https://insights.sbomify.com/CVE-2021-21295/): Possible request smuggling in HTTP/2 due missing validation (medium 5.9)
- [CVE-2021-21294](https://insights.sbomify.com/CVE-2021-21294/): Unbounded connection acceptance in http4s-blaze-server (high 7.5)
- [CVE-2021-21293](https://insights.sbomify.com/CVE-2021-21293/): Unbounded connection acceptance leads to file handle exhaustion (high 7.5)
- [CVE-2021-21292](https://insights.sbomify.com/CVE-2021-21292/): Unquoted Windows binary path in Traccar (medium 5.5)
- [CVE-2021-21291](https://insights.sbomify.com/CVE-2021-21291/): Subdomain checking of whitelisted domains could allow unintended redirects (medium 4.7)
- [CVE-2021-21290](https://insights.sbomify.com/CVE-2021-21290/): Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files (medium 6.2)
- [CVE-2021-2129](https://insights.sbomify.com/CVE-2021-2129/): Other in VM VirtualBox (high 7.9)
- [CVE-2021-21289](https://insights.sbomify.com/CVE-2021-21289/): Command Injection Vulnerability in Mechanize (high 7.4)
- [CVE-2021-21288](https://insights.sbomify.com/CVE-2021-21288/): Server-side request forgery in CarrierWave (medium 4.3)
- [CVE-2021-21287](https://insights.sbomify.com/CVE-2021-21287/): Server-Side Request Forgery in MinIO Browser API (high 7.7)
- [CVE-2021-21286](https://insights.sbomify.com/CVE-2021-21286/): Authorization Bypass in AVideo Platform (high 7.7)
- [CVE-2021-21285](https://insights.sbomify.com/CVE-2021-21285/): Docker daemon crash during image pull of malicious image (medium 6.5)
- [CVE-2021-21284](https://insights.sbomify.com/CVE-2021-21284/): privilege escalation in Moby (medium 6.8)
- [CVE-2021-21283](https://insights.sbomify.com/CVE-2021-21283/): XSS in Flarum Sticky extension. (medium 5.4)
- [CVE-2021-21282](https://insights.sbomify.com/CVE-2021-21282/): Buffer overflow in RPL source routing header processing (high 8.6)
- [CVE-2021-21281](https://insights.sbomify.com/CVE-2021-21281/): Buffer overflow due to unvalidated TCP data offset (high 7.0)
- [CVE-2021-21280](https://insights.sbomify.com/CVE-2021-21280/): Out-of-bounds write when processing 6LoWPAN extension headers (high 8.6)
- [CVE-2021-2128](https://insights.sbomify.com/CVE-2021-2128/): Information disclosure in VM VirtualBox (medium 6.5)
- [CVE-2021-21279](https://insights.sbomify.com/CVE-2021-21279/): Infinite loop in IPv6 neighbor solicitation processing (high 7.5)
- [CVE-2021-21278](https://insights.sbomify.com/CVE-2021-21278/): Risk of code injection in RSSHub (high 8.6)
- [CVE-2021-21277](https://insights.sbomify.com/CVE-2021-21277/): Angular Expressions - Remote Code Execution (high 8.5)
- [CVE-2021-21276](https://insights.sbomify.com/CVE-2021-21276/): Privilege escalation in Polr (critical 9.3)
- [CVE-2021-21275](https://insights.sbomify.com/CVE-2021-21275/): CSRF in MediaWiki Report extension (medium 5.3)
- [CVE-2021-21274](https://insights.sbomify.com/CVE-2021-21274/): Denial of service attack via .well-known lookups (medium 4.3)
- [CVE-2021-21273](https://insights.sbomify.com/CVE-2021-21273/): Open redirects on some federation and push requests (low 3.1)
- [CVE-2021-21272](https://insights.sbomify.com/CVE-2021-21272/): zip slip in ORAS (high 7.7)
- [CVE-2021-21271](https://insights.sbomify.com/CVE-2021-21271/): Denial of service in TenderMint Core (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/239/