# Vulnerabilities published in 2021


- [GHSA-mf4f-j588-5xm8](https://insights.sbomify.com/GHSA-mf4f-j588-5xm8/): Apache Log4j Remote Code Execution (not scored)
- [GHSA-m836-gxwq-j2pm](https://insights.sbomify.com/GHSA-m836-gxwq-j2pm/): Improper Access Control in github.com/treeverse/lakefs (not scored)
- [GHSA-m6m5-pp4g-fcc8](https://insights.sbomify.com/GHSA-m6m5-pp4g-fcc8/): S3 storage write is not aborted on errors leading to unbounded memory usage (not scored)
- [GHSA-m6gx-rhvj-fh52](https://insights.sbomify.com/GHSA-m6gx-rhvj-fh52/): Denial of service in go-ethereum due to CVE-2020-28362 (not scored)
- [GHSA-m489-xr35-fjxr](https://insights.sbomify.com/GHSA-m489-xr35-fjxr/): Regular Expression Denial of Service in millisecond (not scored)
- [GHSA-jwh2-vrr9-vcp2](https://insights.sbomify.com/GHSA-jwh2-vrr9-vcp2/): mz-avro's incorrect use of `set_len` allows for un-initialized memory (not scored)
- [GHSA-jvg4-9rc2-wvcr](https://insights.sbomify.com/GHSA-jvg4-9rc2-wvcr/): Generation of fake documents via public GET-call (not scored)
- [GHSA-jqj4-r483-4gvr](https://insights.sbomify.com/GHSA-jqj4-r483-4gvr/): Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 (not scored)
- [GHSA-jq42-hfch-42f3](https://insights.sbomify.com/GHSA-jq42-hfch-42f3/): Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint (not scored)
- [GHSA-jpwx-ffjq-wr4w](https://insights.sbomify.com/GHSA-jpwx-ffjq-wr4w/): Content object state fetch functions open to SQL injection (not scored)
- [GHSA-jfmf-w293-8xr8](https://insights.sbomify.com/GHSA-jfmf-w293-8xr8/): Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8 (not scored)
- [GHSA-jcjx-c3j3-44pr](https://insights.sbomify.com/GHSA-jcjx-c3j3-44pr/): Insufficient Session Expiration in @cyyynthia/tokenize (not scored)
- [GHSA-jcgr-9698-82jx](https://insights.sbomify.com/GHSA-jcgr-9698-82jx/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build (not scored)
- [GHSA-j9wr-49vq-rm5g](https://insights.sbomify.com/GHSA-j9wr-49vq-rm5g/): Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 (not scored)
- [GHSA-j7c3-96rf-jrrp](https://insights.sbomify.com/GHSA-j7c3-96rf-jrrp/): Critical vulnerability in log4j may affect generated PEAR projects (not scored)
- [GHSA-j23j-q57m-63v3](https://insights.sbomify.com/GHSA-j23j-q57m-63v3/): Denial of service in DataCommunicator class in Vaadin 8 (not scored)
- [GHSA-hxwm-x553-x359](https://insights.sbomify.com/GHSA-hxwm-x553-x359/): Arbitrary Command Injection due to Improper Command Sanitization (not scored)
- [GHSA-hwvm-vfw8-93mw](https://insights.sbomify.com/GHSA-hwvm-vfw8-93mw/): Vulnerable dependency in XTDB connector (not scored)
- [GHSA-hw7r-qrhp-5pff](https://insights.sbomify.com/GHSA-hw7r-qrhp-5pff/): Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20 (not scored)
- [GHSA-hhw9-35p2-q2c5](https://insights.sbomify.com/GHSA-hhw9-35p2-q2c5/): Steam Socialite Provider v1 does not correctly validate openid server (not scored)
- [GHSA-hfwx-c7q6-g54c](https://insights.sbomify.com/GHSA-hfwx-c7q6-g54c/): Vulnerability allowing for reading internal HTTP resources (not scored)
- [GHSA-h96f-fc7c-9r55](https://insights.sbomify.com/GHSA-h96f-fc7c-9r55/): Regex denial of service vulnerability in codesample plugin (not scored)
- [GHSA-h588-76vg-prgj](https://insights.sbomify.com/GHSA-h588-76vg-prgj/): `DecimalArray` does not perform bound checks on accessing values and offsets (not scored)
- [GHSA-h45p-w933-jxh3](https://insights.sbomify.com/GHSA-h45p-w933-jxh3/): Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript (not scored)
- [GHSA-gwj5-3vfq-q992](https://insights.sbomify.com/GHSA-gwj5-3vfq-q992/): Import loops in account imports, nats-server DoS (not scored)
- [GHSA-gqcf-83rq-gpfr](https://insights.sbomify.com/GHSA-gqcf-83rq-gpfr/): Any storage file can be downloaded from p.sh if full server path is known (not scored)
- [GHSA-gmq2-39ff-f5qg](https://insights.sbomify.com/GHSA-gmq2-39ff-f5qg/): A failed upgrade may lead to hung goroutines (not scored)
- [GHSA-gjrj-9rj4-pgwx](https://insights.sbomify.com/GHSA-gjrj-9rj4-pgwx/): DoS Vulnerability from Upstream Actix Web Issues (not scored)
- [GHSA-g98v-hv3f-hcfr](https://insights.sbomify.com/GHSA-g98v-hv3f-hcfr/): Potential unaligned read (not scored)
- [GHSA-g636-q5fc-4pr7](https://insights.sbomify.com/GHSA-g636-q5fc-4pr7/): accounts: Hash account number using Salt (not scored)
- [GHSA-g54h-m393-cpwq](https://insights.sbomify.com/GHSA-g54h-m393-cpwq/): devices resource list treated as a blacklist by default (not scored)
- [GHSA-g2qj-pmxm-9f8f](https://insights.sbomify.com/GHSA-g2qj-pmxm-9f8f/): User enumeration in authentication mechanisms (not scored)
- [GHSA-g2q5-5433-rhrf](https://insights.sbomify.com/GHSA-g2q5-5433-rhrf/): Embedded malware in rc (not scored)
- [GHSA-fxwm-rx68-p5vx](https://insights.sbomify.com/GHSA-fxwm-rx68-p5vx/): XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext (not scored)
- [GHSA-fxq4-r6mr-9x64](https://insights.sbomify.com/GHSA-fxq4-r6mr-9x64/): CSRF Vuln can expose user's QRcode (not scored)
- [GHSA-fr26-qjc8-mvjx](https://insights.sbomify.com/GHSA-fr26-qjc8-mvjx/): Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 (not scored)
- [GHSA-f6p7-8xfw-fjqq](https://insights.sbomify.com/GHSA-f6p7-8xfw-fjqq/): Authenticated Stored XSS in Administration (not scored)
- [GHSA-f3w5-v9xx-rp8p](https://insights.sbomify.com/GHSA-f3w5-v9xx-rp8p/): Signature verification failure in Tendermint (not scored)
- [GHSA-cvmj-47v9-35m9](https://insights.sbomify.com/GHSA-cvmj-47v9-35m9/): FUSE-Rust: Uninitalized memory read and leak caused by fuser crate (not scored)
- [GHSA-crh4-294p-vcfq](https://insights.sbomify.com/GHSA-crh4-294p-vcfq/): Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 (not scored)
- [GHSA-cfcv-q4qq-2ph4](https://insights.sbomify.com/GHSA-cfcv-q4qq-2ph4/): CKEditor 4 vulnerabilities in versions <4.16.1 (not scored)
- [GHSA-c6c4-7x48-4cqp](https://insights.sbomify.com/GHSA-c6c4-7x48-4cqp/): Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 (not scored)
- [GHSA-c66w-hq56-4q97](https://insights.sbomify.com/GHSA-c66w-hq56-4q97/): Network policy may be bypassed by some ICMP Echo Requests (not scored)
- [GHSA-c57f-4vp2-jqhm](https://insights.sbomify.com/GHSA-c57f-4vp2-jqhm/): Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 (not scored)
- [GHSA-9wx7-jrvc-28mm](https://insights.sbomify.com/GHSA-9wx7-jrvc-28mm/): Signature verification vulnerability in Stark Bank ecdsa libraries (not scored)
- [GHSA-9vxv-wpv4-f52p](https://insights.sbomify.com/GHSA-9vxv-wpv4-f52p/): Information leakage in Error Handler (not scored)
- [GHSA-9jp8-cwwx-p64q](https://insights.sbomify.com/GHSA-9jp8-cwwx-p64q/): XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext (not scored)
- [GHSA-9h6g-6mxg-vvp4](https://insights.sbomify.com/GHSA-9h6g-6mxg-vvp4/): Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 (not scored)
- [GHSA-94g7-hpv8-h9qm](https://insights.sbomify.com/GHSA-94g7-hpv8-h9qm/): Remote code injection in Log4j (not scored)
- [GHSA-8vfw-v2jv-9hwc](https://insights.sbomify.com/GHSA-8vfw-v2jv-9hwc/): Reflected cross-site scripting in development mode handler in Vaadin (not scored)
- [GHSA-8r4g-cg4m-x23c](https://insights.sbomify.com/GHSA-8r4g-cg4m-x23c/): Denial of Service in node-static (not scored)
- [GHSA-89v2-g37m-g3ff](https://insights.sbomify.com/GHSA-89v2-g37m-g3ff/): Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli (not scored)
- [GHSA-88rc-3p98-rgvx](https://insights.sbomify.com/GHSA-88rc-3p98-rgvx/): After order payment process manipulation in shopware/platform and shopware/core (not scored)
- [GHSA-84p7-fh9c-6g8h](https://insights.sbomify.com/GHSA-84p7-fh9c-6g8h/): Prototype Pollution in mixme (not scored)
- [GHSA-82mf-mmh7-hxp5](https://insights.sbomify.com/GHSA-82mf-mmh7-hxp5/): Directory traversal in development mode handler in Vaadin 14 and 15-17 (not scored)
- [GHSA-7xcv-wvr7-4h6p](https://insights.sbomify.com/GHSA-7xcv-wvr7-4h6p/): Malicious npm package: an0n-chat-lib (not scored)
- [GHSA-7vwg-39h8-8qp8](https://insights.sbomify.com/GHSA-7vwg-39h8-8qp8/): /user/sessions endpoint allows detecting valid accounts (not scored)
- [GHSA-7qfm-6m33-rgg9](https://insights.sbomify.com/GHSA-7qfm-6m33-rgg9/): XML External Entity Reference (not scored)
- [GHSA-7h5v-85w9-pq6c](https://insights.sbomify.com/GHSA-7h5v-85w9-pq6c/): Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint (not scored)
- [GHSA-7fjp-g4m7-fx23](https://insights.sbomify.com/GHSA-7fjp-g4m7-fx23/): User (Encrypted) Password Field Being Serialised (not scored)
- [GHSA-77vh-xpmg-72qh](https://insights.sbomify.com/GHSA-77vh-xpmg-72qh/): Clarify `mediaType` handling (not scored)
- [GHSA-773q-5334-5gf9](https://insights.sbomify.com/GHSA-773q-5334-5gf9/): Memory over-allocation in evm-core (not scored)
- [GHSA-76f4-fw33-6j2v](https://insights.sbomify.com/GHSA-76f4-fw33-6j2v/): Potential sensitive data exposure in applications using Vaadin 15 (not scored)
- [GHSA-73qr-pfmq-6rp8](https://insights.sbomify.com/GHSA-73qr-pfmq-6rp8/): Embedded malware in coa (not scored)
- [GHSA-6w87-g839-9wv7](https://insights.sbomify.com/GHSA-6w87-g839-9wv7/): Helm OCI credentials leaked into Argo CD logs (not scored)
- [GHSA-6rg3-8h8x-5xfv](https://insights.sbomify.com/GHSA-6rg3-8h8x-5xfv/): Unchecked hostname resolution could allow access to local network resources by users outside the local network (not scored)
- [GHSA-6hgr-2g6q-3rmc](https://insights.sbomify.com/GHSA-6hgr-2g6q-3rmc/): Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 (not scored)
- [GHSA-6cj2-92m5-7mvp](https://insights.sbomify.com/GHSA-6cj2-92m5-7mvp/): Improperly Controlled Modification of Object Prototype Attributes (not scored)
- [GHSA-6c73-2v8x-qpvm](https://insights.sbomify.com/GHSA-6c73-2v8x-qpvm/): Argo Server TLS requests could be forged by attacker with network access (not scored)
- [GHSA-65p7-pjj8-ggmr](https://insights.sbomify.com/GHSA-65p7-pjj8-ggmr/): Member account takeover (not scored)
- [GHSA-63rq-p8fp-524q](https://insights.sbomify.com/GHSA-63rq-p8fp-524q/): Potential API key leak (not scored)
- [GHSA-5vm8-hhgr-jcjp](https://insights.sbomify.com/GHSA-5vm8-hhgr-jcjp/): Cross-site scripting vulnerability in TinyMCE (not scored)
- [GHSA-5j5w-g665-5m35](https://insights.sbomify.com/GHSA-5j5w-g665-5m35/): Ambiguous OCI manifest parsing (not scored)
- [GHSA-5684-g483-2249](https://insights.sbomify.com/GHSA-5684-g483-2249/): Signature Validation Bypass (not scored)
- [GHSA-5629-8855-gf4g](https://insights.sbomify.com/GHSA-5629-8855-gf4g/): Authentication Bypass by CSRF Weakness (not scored)
- [GHSA-4wv4-mgfq-598v](https://insights.sbomify.com/GHSA-4wv4-mgfq-598v/): Code injection in nobelprizeparser (not scored)
- [GHSA-4whq-r978-2x68](https://insights.sbomify.com/GHSA-4whq-r978-2x68/): Arbitrary code execution in ExifTool (not scored)
- [GHSA-4ph2-8337-hm62](https://insights.sbomify.com/GHSA-4ph2-8337-hm62/): Key Caching behavior in the DynamoDB Encryption Client. (not scored)
- [GHSA-4mg9-vhxq-vm7j](https://insights.sbomify.com/GHSA-4mg9-vhxq-vm7j/): SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database (not scored)
- [GHSA-4g53-vp7q-gfjv](https://insights.sbomify.com/GHSA-4g53-vp7q-gfjv/): constructEvent does not verify header (not scored)
- [GHSA-433w-mm6h-rv9p](https://insights.sbomify.com/GHSA-433w-mm6h-rv9p/): Auth bypass in SAML provider (not scored)
- [GHSA-3wxm-m9m4-cprj](https://insights.sbomify.com/GHSA-3wxm-m9m4-cprj/): Import of incorrectly embargoed keys could cause early publication (not scored)
- [GHSA-3w6p-8f82-gw8r](https://insights.sbomify.com/GHSA-3w6p-8f82-gw8r/): Using JMSAppender in log4j configuration may lead to deserialization of untrusted data (not scored)
- [GHSA-3pcr-4982-548m](https://insights.sbomify.com/GHSA-3pcr-4982-548m/): Exposure of .env if project root is configured as web root in shopware/production (not scored)
- [GHSA-3jch-9qgp-4844](https://insights.sbomify.com/GHSA-3jch-9qgp-4844/): Generated code can read and write out of bounds in safe code (not scored)
- [GHSA-3h5r-928v-mxhh](https://insights.sbomify.com/GHSA-3h5r-928v-mxhh/): Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 (not scored)
- [GHSA-36mj-6r7r-mqhf](https://insights.sbomify.com/GHSA-36mj-6r7r-mqhf/): User can obtain JWT token even if account is disabled (not scored)
- [GHSA-32wx-4gxx-h48f](https://insights.sbomify.com/GHSA-32wx-4gxx-h48f/): Users can edit the tags of any discussion (not scored)
- [GHSA-2rh5-jvgx-pgw3](https://insights.sbomify.com/GHSA-2rh5-jvgx-pgw3/): Any storage file can be downloaded from p.sh if full server path is known (not scored)
- [GHSA-2g8g-63j4-9w3r](https://insights.sbomify.com/GHSA-2g8g-63j4-9w3r/): RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend (not scored)
- [GHSA-2frx-j9hj-6c65](https://insights.sbomify.com/GHSA-2frx-j9hj-6c65/): User enumeration in authentication mechanisms (not scored)
- [GHSA-2c83-wfv3-q25f](https://insights.sbomify.com/GHSA-2c83-wfv3-q25f/): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown (not scored)
- [GHSA-243q-g9j3-qf6r](https://insights.sbomify.com/GHSA-243q-g9j3-qf6r/): non-admin users can create integration role with administrator role (not scored)
- [DRUPAL-CORE-2021-011](https://insights.sbomify.com/DRUPAL-CORE-2021-011/): The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. (not scored)
- [DRUPAL-CORE-2021-005](https://insights.sbomify.com/DRUPAL-CORE-2021-005/): The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. (not scored)
- [DRUPAL-CORE-2021-001](https://insights.sbomify.com/DRUPAL-CORE-2021-001/): The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. (not scored)
- [DRUPAL-CONTRIB-2021-047](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-047/): This modules enables users to login via email address. (not scored)
- [DRUPAL-CONTRIB-2021-045](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-045/): Access Bypass: This module enables you to build forms and surveys in Drupal. (not scored)
- [DRUPAL-CONTRIB-2021-044](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-044/): This module enables users to authenticate through their Microsoft Azure AD account. (not scored)
- [DRUPAL-CONTRIB-2021-043](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-043/): This module enables aklump/loft\_data\_grids to be used as a Drupal module. (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/41/