# Vulnerabilities published in 2021


- [DRUPAL-CONTRIB-2021-042](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-042/): Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field. (not scored)
- [DRUPAL-CONTRIB-2021-041](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-041/): This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. (not scored)
- [DRUPAL-CONTRIB-2021-040](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-040/): This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. (not scored)
- [DRUPAL-CONTRIB-2021-039](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-039/): This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. (not scored)
- [DRUPAL-CONTRIB-2021-038](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-038/): This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. (not scored)
- [DRUPAL-CONTRIB-2021-037](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-037/): This module enables sites to define a domain from Domain Access that points directly to a group page. (not scored)
- [DRUPAL-CONTRIB-2021-036](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-036/): This module provides a solution to authenticate visitors using existing SAML providers. (not scored)
- [DRUPAL-CONTRIB-2021-035](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-035/): This module provides a powerful interface for managing a taxonomy vocabulary. (not scored)
- [DRUPAL-CONTRIB-2021-033](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-033/): This module enables you to extract the textual content of files for use on a website, e.g. (not scored)
- [DRUPAL-CONTRIB-2021-032](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-032/): This module provides a system for building an ecommerce solution in their Drupal site. (not scored)
- [DRUPAL-CONTRIB-2021-031](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-031/): The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. (not scored)
- [DRUPAL-CONTRIB-2021-030](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-030/): This module enables you to create an individual hash for each user. (not scored)
- [DRUPAL-CONTRIB-2021-026](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-026/): The Webform module uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. (not scored)
- [DRUPAL-CONTRIB-2021-025](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-025/): The *Admin Toolbar* (`admin_toolbar`) module extends the default toolbar provided by Drupal Core with various features facilitating day-to-d (not scored)
- [DRUPAL-CONTRIB-2021-024](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-024/): This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. (not scored)
- [DRUPAL-CONTRIB-2021-023](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-023/): This module provides a user interface that allows the implementation and use of *Form modes* without custom development. (not scored)
- [DRUPAL-CONTRIB-2021-022](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-022/): This module provides a revision UI for Block Content entities. (not scored)
- [DRUPAL-CONTRIB-2021-021](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-021/): This module provides a revision UI for Linky entities. (not scored)
- [DRUPAL-CONTRIB-2021-020](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-020/): The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. (not scored)
- [DRUPAL-CONTRIB-2021-019](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-019/): This project is related to Opigno LMS distribution. (not scored)
- [DRUPAL-CONTRIB-2021-018](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-018/): This project is related to Opigno LMS distribution. (not scored)
- [DRUPAL-CONTRIB-2021-017](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-017/): This module provides a revision UI to Block Content entities. (not scored)
- [DRUPAL-CONTRIB-2021-016](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-016/): This module provides a revision UI to Linky entities. (not scored)
- [DRUPAL-CONTRIB-2021-015](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-015/): Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, its 8.x-3.x branch is a start from scratch to evaluate (not scored)
- [DRUPAL-CONTRIB-2021-014](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-014/): This module allows users to authenticate against an Oauth 2.0 / OpenID Connect identity provider to login to your Drupal site. (not scored)
- [DRUPAL-CONTRIB-2021-013](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-013/): This module lets you craft and expose a GraphQL web service API. (not scored)
- [DRUPAL-CONTRIB-2021-009](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-009/): Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, it's 8.x-3.x branch is a start from scratch to evaluat (not scored)
- [DRUPAL-CONTRIB-2021-008](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-008/): This module enables you to add customizable facets on search pages, from core search or searches provided by Search API. (not scored)
- [DRUPAL-CONTRIB-2021-007](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-007/): This module provides a new UI experience for node editing using the Gutenberg Editor library. (not scored)
- [DRUPAL-CONTRIB-2021-006](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-006/): The [SAML Authentication module](https://www.drupal.org/project/samlauth) allows users to authenticate against a SAML identity provider to l (not scored)
- [DRUPAL-CONTRIB-2021-005](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-005/): The [Fast Autocomplete module](https://www.drupal.org/project/fac) provides fast IMDB-like suggestions below a text input field. (not scored)
- [DRUPAL-CONTRIB-2021-004](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-004/): The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which sends a notification e (not scored)
- [DRUPAL-CONTRIB-2021-003](https://insights.sbomify.com/DRUPAL-CONTRIB-2021-003/): This module enables you to add groups to other groups in a tree structure where access can be inherited up or down the tree. (not scored)
- [CVE-2021-48020](https://insights.sbomify.com/CVE-2021-48020/): Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays (high 8.3)
- [CVE-2021-48019](https://insights.sbomify.com/CVE-2021-48019/): Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies (medium 6.3)
- [CVE-2021-48018](https://insights.sbomify.com/CVE-2021-48018/): Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator (high 8.3)
- [CVE-2021-48017](https://insights.sbomify.com/CVE-2021-48017/): OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi (high 8.7)
- [CVE-2021-48016](https://insights.sbomify.com/CVE-2021-48016/): DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php (critical 9.3)
- [CVE-2021-48015](https://insights.sbomify.com/CVE-2021-48015/): JeeWMS Path Traversal via showOrDownByurl.do (high 8.7)
- [CVE-2021-48014](https://insights.sbomify.com/CVE-2021-48014/): FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer (critical 9.3)
- [CVE-2021-48013](https://insights.sbomify.com/CVE-2021-48013/): Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload (high 8.7)
- [CVE-2021-48012](https://insights.sbomify.com/CVE-2021-48012/): fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML (high 8.8)
- [CVE-2021-48011](https://insights.sbomify.com/CVE-2021-48011/): Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments (high 8.7)
- [CVE-2021-48008](https://insights.sbomify.com/CVE-2021-48008/): Chanjet CRM SQL Injection via get_usedspace.php (high 8.7)
- [CVE-2021-48007](https://insights.sbomify.com/CVE-2021-48007/): PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket (high 7.1)
- [CVE-2021-48006](https://insights.sbomify.com/CVE-2021-48006/): PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity (medium 4.8)
- [CVE-2021-47987](https://insights.sbomify.com/CVE-2021-47987/): Parse Server - Arbitrary Code Execution via Malicious Version Tags (high 7.7)
- [CVE-2021-47986](https://insights.sbomify.com/CVE-2021-47986/): Parse Server - Unreviewed Code Execution via Malicious Version Tags (high 7.7)
- [CVE-2021-47985](https://insights.sbomify.com/CVE-2021-47985/): Brother SAPSprint 7.60 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2021-47984](https://insights.sbomify.com/CVE-2021-47984/): WordPress Plugin WP24 Domain Check 1.6.2 Stored XSS (medium 5.1)
- [CVE-2021-47983](https://insights.sbomify.com/CVE-2021-47983/): WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_code (medium 5.1)
- [CVE-2021-47982](https://insights.sbomify.com/CVE-2021-47982/): WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset (medium 5.1)
- [CVE-2021-47981](https://insights.sbomify.com/CVE-2021-47981/): Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form (medium 5.1)
- [CVE-2021-47980](https://insights.sbomify.com/CVE-2021-47980/): Fuel CMS 1.4.13 Blind SQL Injection via col Parameter (high 7.1)
- [CVE-2021-47979](https://insights.sbomify.com/CVE-2021-47979/): WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion (high 8.7)
- [CVE-2021-47978](https://insights.sbomify.com/CVE-2021-47978/): ProcessMaker 3.5.4 Local File Inclusion via Path Traversal (medium 6.9)
- [CVE-2021-47977](https://insights.sbomify.com/CVE-2021-47977/): WordPress Anti-Malware Security Bruteforce Firewall <= 4.20.72 Directory Traversal (high 8.7)
- [CVE-2021-47976](https://insights.sbomify.com/CVE-2021-47976/): TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload (high 8.7)
- [CVE-2021-47975](https://insights.sbomify.com/CVE-2021-47975/): WordPress Plugin WP Learn Manager 1.1.2 Stored XSS (medium 5.1)
- [CVE-2021-47974](https://insights.sbomify.com/CVE-2021-47974/): VX Search 13.5.28 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2021-47973](https://insights.sbomify.com/CVE-2021-47973/): Sticky Notes Widget 3.0.6 Denial of Service via Buffer Overflow (high 8.7)
- [CVE-2021-47972](https://insights.sbomify.com/CVE-2021-47972/): Sticky Notes & Color Widgets 1.4.2 Denial of Service (high 8.7)
- [CVE-2021-47971](https://insights.sbomify.com/CVE-2021-47971/): My Notes Safe 5.3 Denial of Service via Buffer Overflow (high 8.7)
- [CVE-2021-47970](https://insights.sbomify.com/CVE-2021-47970/): Macaron Notes 5.5 Denial of Service via Buffer Overflow (high 8.7)
- [CVE-2021-47969](https://insights.sbomify.com/CVE-2021-47969/): Color Notes 1.4 Denial of Service via Long Character String (high 8.7)
- [CVE-2021-47968](https://insights.sbomify.com/CVE-2021-47968/): Podcast Generator 3.1 Persistent Cross-Site Scripting via long_description (medium 5.1)
- [CVE-2021-47967](https://insights.sbomify.com/CVE-2021-47967/): PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters (medium 5.1)
- [CVE-2021-47966](https://insights.sbomify.com/CVE-2021-47966/): PHP Timeclock 1.04 SQL Injection via login.php (high 8.8)
- [CVE-2021-47965](https://insights.sbomify.com/CVE-2021-47965/): WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload (critical 9.3)
- [CVE-2021-47964](https://insights.sbomify.com/CVE-2021-47964/): Schlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager (high 8.7)
- [CVE-2021-47963](https://insights.sbomify.com/CVE-2021-47963/): Anote 1.0 Persistent Cross-Site Scripting Leading to Code Execution (medium 5.1)
- [CVE-2021-47962](https://insights.sbomify.com/CVE-2021-47962/): Savsoft Quiz 5.0 Persistent Cross-Site Scripting via User Settings (medium 5.1)
- [CVE-2021-47961](https://insights.sbomify.com/CVE-2021-47961/): Information disclosure in Synology SSL VPN Client (high 8.1)
- [CVE-2021-47960](https://insights.sbomify.com/CVE-2021-47960/): Information disclosure in Synology SSL VPN Client (medium 6.5)
- [CVE-2021-47959](https://insights.sbomify.com/CVE-2021-47959/): WordPress Plugin WPGraphQL 1.3.5 Denial of Service (high 8.7)
- [CVE-2021-47958](https://insights.sbomify.com/CVE-2021-47958/): CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload (medium 5.3)
- [CVE-2021-47957](https://insights.sbomify.com/CVE-2021-47957/): WordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msg (medium 5.1)
- [CVE-2021-47956](https://insights.sbomify.com/CVE-2021-47956/): EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname (high 8.8)
- [CVE-2021-47955](https://insights.sbomify.com/CVE-2021-47955/): CouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload (medium 5.1)
- [CVE-2021-47954](https://insights.sbomify.com/CVE-2021-47954/): LayerBB 1.1.4 SQL Injection via search_query Parameter (high 8.8)
- [CVE-2021-47953](https://insights.sbomify.com/CVE-2021-47953/): OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password (medium 5.3)
- [CVE-2021-47952](https://insights.sbomify.com/CVE-2021-47952/): python jsonpickle 2.0.0 Remote Code Execution via py/repr (critical 9.3)
- [CVE-2021-47951](https://insights.sbomify.com/CVE-2021-47951/): WordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URL (medium 5.1)
- [CVE-2021-47950](https://insights.sbomify.com/CVE-2021-47950/): Advanced Guestbook 2.4.4 Persistent XSS via Smilies (medium 5.1)
- [CVE-2021-47949](https://insights.sbomify.com/CVE-2021-47949/): CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack (high 8.7)
- [CVE-2021-47948](https://insights.sbomify.com/CVE-2021-47948/): WordPress GetPaid Plugin 2.4.6 HTML Injection via Help Text (medium 5.1)
- [CVE-2021-47947](https://insights.sbomify.com/CVE-2021-47947/): Projectsend r1295 Stored Cross-Site Scripting via files-edit.php (medium 5.1)
- [CVE-2021-47946](https://insights.sbomify.com/CVE-2021-47946/): OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery (medium 6.9)
- [CVE-2021-47945](https://insights.sbomify.com/CVE-2021-47945/): Argus Surveillance DVR 4.0 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2021-47944](https://insights.sbomify.com/CVE-2021-47944/): memono Notepad 4.2 Denial of Service via Buffer Overflow (high 8.7)
- [CVE-2021-47943](https://insights.sbomify.com/CVE-2021-47943/): TextPattern CMS 4.8.7 Remote Code Execution via File Upload (high 8.7)
- [CVE-2021-47942](https://insights.sbomify.com/CVE-2021-47942/): Home Assistant Community Store 1.10.0 Path Traversal Account Takeover (high 8.7)
- [CVE-2021-47941](https://insights.sbomify.com/CVE-2021-47941/): WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params (high 8.8)
- [CVE-2021-47940](https://insights.sbomify.com/CVE-2021-47940/): WordPress Download From Files 1.48 Arbitrary File Upload (critical 9.3)
- [CVE-2021-47939](https://insights.sbomify.com/CVE-2021-47939/): Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation (high 8.7)
- [CVE-2021-47938](https://insights.sbomify.com/CVE-2021-47938/): ImpressCMS 1.4.2 Remote Code Execution via Autotasks (high 8.7)
- [CVE-2021-47937](https://insights.sbomify.com/CVE-2021-47937/): e107 CMS 2.3.0 Authenticated Remote Code Execution via Theme Upload (high 8.7)
- [CVE-2021-47936](https://insights.sbomify.com/CVE-2021-47936/): OpenCATS 0.9.4 Remote Code Execution via Resume Upload (critical 9.3)
- [CVE-2021-47935](https://insights.sbomify.com/CVE-2021-47935/): Sentry 8.2.0 Remote Code Execution via Pickle Deserialization (high 8.7)
- [CVE-2021-47934](https://insights.sbomify.com/CVE-2021-47934/): MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/42/