# Vulnerabilities published in 2021


- [CVE-2021-47830](https://insights.sbomify.com/CVE-2021-47830/): GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF (medium 5.1)
- [CVE-2021-47829](https://insights.sbomify.com/CVE-2021-47829/): DHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service Path (high 8.5)
- [CVE-2021-47828](https://insights.sbomify.com/CVE-2021-47828/): BOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service Path (high 8.5)
- [CVE-2021-47827](https://insights.sbomify.com/CVE-2021-47827/): WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (medium 4.6)
- [CVE-2021-47826](https://insights.sbomify.com/CVE-2021-47826/): Acer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path (high 8.5)
- [CVE-2021-47825](https://insights.sbomify.com/CVE-2021-47825/): Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe' Unquoted Service Path (high 8.5)
- [CVE-2021-47824](https://insights.sbomify.com/CVE-2021-47824/): iDailyDiary 4.30 - Denial of Service (PoC) (medium 4.6)
- [CVE-2021-47823](https://insights.sbomify.com/CVE-2021-47823/): ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path (high 8.5)
- [CVE-2021-47822](https://insights.sbomify.com/CVE-2021-47822/): DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path (high 8.5)
- [CVE-2021-47821](https://insights.sbomify.com/CVE-2021-47821/): RarmaRadio 2.72.8 - Denial of Service (medium 4.6)
- [CVE-2021-47820](https://insights.sbomify.com/CVE-2021-47820/): Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF) (medium 5.1)
- [CVE-2021-47819](https://insights.sbomify.com/CVE-2021-47819/): ProjeQtOr Project Management 9.1.4 - Remote Code Execution (critical 9.3)
- [CVE-2021-47818](https://insights.sbomify.com/CVE-2021-47818/): DupTerminator 1.4.5639.37199 - Denial of Service (medium 4.6)
- [CVE-2021-47817](https://insights.sbomify.com/CVE-2021-47817/): OpenEMR 5.0.2.1 - Remote Code Execution (medium 4.8)
- [CVE-2021-47816](https://insights.sbomify.com/CVE-2021-47816/): Thecus N4800Eco Nas Server Control Panel - Command Injection (medium 5.3)
- [CVE-2021-47815](https://insights.sbomify.com/CVE-2021-47815/): Nsauditor 3.2.3 - Denial of Service (PoC) (medium 6.7)
- [CVE-2021-47814](https://insights.sbomify.com/CVE-2021-47814/): NBMonitor 1.6.8 - Denial of Service (PoC) (medium 6.7)
- [CVE-2021-47813](https://insights.sbomify.com/CVE-2021-47813/): Backup Key Recovery 2.2.7 - Denial of Service (PoC) (medium 6.7)
- [CVE-2021-47812](https://insights.sbomify.com/CVE-2021-47812/): GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) (critical 9.3)
- [CVE-2021-47811](https://insights.sbomify.com/CVE-2021-47811/): Grocery crud 1.6.4 - 'order_by' SQL Injection (high 8.8)
- [CVE-2021-47810](https://insights.sbomify.com/CVE-2021-47810/): WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path (high 8.5)
- [CVE-2021-47809](https://insights.sbomify.com/CVE-2021-47809/): Disk Sorter Enterprise 13.6.12 - 'Disk Sorter Enterprise' Unquoted Service Path (high 8.5)
- [CVE-2021-47808](https://insights.sbomify.com/CVE-2021-47808/): Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting (medium 5.1)
- [CVE-2021-47807](https://insights.sbomify.com/CVE-2021-47807/): Sync Breeze 13.6.18 - 'Multiple' Unquoted Service Path (high 8.5)
- [CVE-2021-47806](https://insights.sbomify.com/CVE-2021-47806/): Dup Scout 13.5.28 - 'Multiple' Unquoted Service Path (high 8.5)
- [CVE-2021-47805](https://insights.sbomify.com/CVE-2021-47805/): Disk Savvy 13.6.14 - 'Multiple' Unquoted Service Path (high 8.5)
- [CVE-2021-47804](https://insights.sbomify.com/CVE-2021-47804/): Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path (high 8.5)
- [CVE-2021-47803](https://insights.sbomify.com/CVE-2021-47803/): iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service Path (high 8.5)
- [CVE-2021-47802](https://insights.sbomify.com/CVE-2021-47802/): Tenda D151 & D301 - Configuration Download (high 8.7)
- [CVE-2021-47801](https://insights.sbomify.com/CVE-2021-47801/): Vianeos OctoPUS 5 - 'login_user' SQLi (high 8.8)
- [CVE-2021-47800](https://insights.sbomify.com/CVE-2021-47800/): b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF) (medium 6.9)
- [CVE-2021-47799](https://insights.sbomify.com/CVE-2021-47799/): Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation (high 8.5)
- [CVE-2021-47798](https://insights.sbomify.com/CVE-2021-47798/): NoteBurner 2.35 - Denial Of Service (DoS) (PoC) (medium 6.7)
- [CVE-2021-47797](https://insights.sbomify.com/CVE-2021-47797/): Leawo Prof. Media 11.0.0.1 - Denial of Service (DoS) (PoC) (medium 6.7)
- [CVE-2021-47796](https://insights.sbomify.com/CVE-2021-47796/): Denver SHO-110 IP Camera Unauthenticated Snapshot Access (high 8.7)
- [CVE-2021-47795](https://insights.sbomify.com/CVE-2021-47795/): GeoVision Geowebserver 5.3.3 - Local FIle Inclusion (high 8.7)
- [CVE-2021-47794](https://insights.sbomify.com/CVE-2021-47794/): ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated) (high 8.7)
- [CVE-2021-47793](https://insights.sbomify.com/CVE-2021-47793/): Telegram Desktop 2.9.2 - Denial of Service (PoC) (medium 4.6)
- [CVE-2021-47792](https://insights.sbomify.com/CVE-2021-47792/): Remote Mouse 4.002 - Unquoted Service Path (high 8.5)
- [CVE-2021-47791](https://insights.sbomify.com/CVE-2021-47791/): SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service (medium 4.6)
- [CVE-2021-47790](https://insights.sbomify.com/CVE-2021-47790/): Active WebCam 11.5 - Unquoted Service Path (high 8.5)
- [CVE-2021-47789](https://insights.sbomify.com/CVE-2021-47789/): Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial of Service (PoC) (medium 6.8)
- [CVE-2021-47788](https://insights.sbomify.com/CVE-2021-47788/): WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated) (high 8.7)
- [CVE-2021-47787](https://insights.sbomify.com/CVE-2021-47787/): TotalAV 5.15.69 - Unquoted Service Path (high 8.5)
- [CVE-2021-47786](https://insights.sbomify.com/CVE-2021-47786/): Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC) (medium 6.8)
- [CVE-2021-47785](https://insights.sbomify.com/CVE-2021-47785/): Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH) (high 7.0)
- [CVE-2021-47784](https://insights.sbomify.com/CVE-2021-47784/): Cyberfox Web Browser 52.9.1 - Denial of Service (PoC) (medium 6.7)
- [CVE-2021-47783](https://insights.sbomify.com/CVE-2021-47783/): Phpwcms 1.9.30 - Arbitrary File Upload (medium 5.3)
- [CVE-2021-47782](https://insights.sbomify.com/CVE-2021-47782/): Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection (high 7.1)
- [CVE-2021-47781](https://insights.sbomify.com/CVE-2021-47781/): Cmder Console Emulator 1.3.18 - 'Cmder.exe' Denial of Service (PoC) (medium 6.7)
- [CVE-2021-47780](https://insights.sbomify.com/CVE-2021-47780/): Macro Expert 4.7 - Unquoted Service Path (high 8.5)
- [CVE-2021-47779](https://insights.sbomify.com/CVE-2021-47779/): Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation (high 8.4)
- [CVE-2021-47778](https://insights.sbomify.com/CVE-2021-47778/): GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection (high 8.6)
- [CVE-2021-47777](https://insights.sbomify.com/CVE-2021-47777/): Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated) (high 8.8)
- [CVE-2021-47776](https://insights.sbomify.com/CVE-2021-47776/): Umbraco v8.14.1 - 'baseUrl' SSRF (medium 6.9)
- [CVE-2021-47775](https://insights.sbomify.com/CVE-2021-47775/): YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH) (high 8.4)
- [CVE-2021-47774](https://insights.sbomify.com/CVE-2021-47774/): Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH) (high 8.4)
- [CVE-2021-47773](https://insights.sbomify.com/CVE-2021-47773/): Dynojet Power Core 2.3.0 - Unquoted Service Path (high 8.5)
- [CVE-2021-47772](https://insights.sbomify.com/CVE-2021-47772/): 10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH) (high 8.4)
- [CVE-2021-47771](https://insights.sbomify.com/CVE-2021-47771/): RDP Manager 4.9.9.3 - Denial-of-Service (PoC) (medium 6.8)
- [CVE-2021-47770](https://insights.sbomify.com/CVE-2021-47770/): OpenPLC 3 - Remote Code Execution (high 8.6)
- [CVE-2021-47769](https://insights.sbomify.com/CVE-2021-47769/): Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS) (medium 5.1)
- [CVE-2021-47768](https://insights.sbomify.com/CVE-2021-47768/): ImportExportTools NG 10.0.4 - HTML Injection (medium 5.3)
- [CVE-2021-47767](https://insights.sbomify.com/CVE-2021-47767/): 10-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service Path (high 8.5)
- [CVE-2021-47766](https://insights.sbomify.com/CVE-2021-47766/): Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated) (high 7.1)
- [CVE-2021-47765](https://insights.sbomify.com/CVE-2021-47765/): AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC) (medium 6.7)
- [CVE-2021-47764](https://insights.sbomify.com/CVE-2021-47764/): AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC) (medium 6.7)
- [CVE-2021-47763](https://insights.sbomify.com/CVE-2021-47763/): Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection (high 8.8)
- [CVE-2021-47762](https://insights.sbomify.com/CVE-2021-47762/): HTTPDebuggerPro 9.11 - Unquoted Service Path (high 8.5)
- [CVE-2021-47761](https://insights.sbomify.com/CVE-2021-47761/): MilleGPG5 5.7.2 Luglio 2021 (x64) - Local Privilege Escalation (high 8.5)
- [CVE-2021-47759](https://insights.sbomify.com/CVE-2021-47759/): MTPutty 1.0.1.21 - SSH Password Disclosure (medium 6.8)
- [CVE-2021-47758](https://insights.sbomify.com/CVE-2021-47758/): Chikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated) (high 8.7)
- [CVE-2021-47757](https://insights.sbomify.com/CVE-2021-47757/): Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated) (high 8.7)
- [CVE-2021-47756](https://insights.sbomify.com/CVE-2021-47756/): Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) (high 8.4)
- [CVE-2021-47755](https://insights.sbomify.com/CVE-2021-47755/): Oliver Library Server v5 - Arbitrary File Download (high 8.7)
- [CVE-2021-47754](https://insights.sbomify.com/CVE-2021-47754/): Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF) (medium 6.9)
- [CVE-2021-47753](https://insights.sbomify.com/CVE-2021-47753/): phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated) (critical 9.3)
- [CVE-2021-47752](https://insights.sbomify.com/CVE-2021-47752/): AWebServer GhostBuilding 18 - Denial of Service (DoS) (high 8.7)
- [CVE-2021-47751](https://insights.sbomify.com/CVE-2021-47751/): CuteEditor for PHP 6.6 - Directory Traversal (medium 5.3)
- [CVE-2021-47750](https://insights.sbomify.com/CVE-2021-47750/): YouPHPTube <= 7.8 - Cross-Site Scripting (medium 5.1)
- [CVE-2021-47749](https://insights.sbomify.com/CVE-2021-47749/): YouPHPTube <= 7.8 - Directory Traversal (high 8.7)
- [CVE-2021-47748](https://insights.sbomify.com/CVE-2021-47748/): Hasura GraphQL 1.3.3 - Remote Code Execution (critical 9.3)
- [CVE-2021-47747](https://insights.sbomify.com/CVE-2021-47747/): meterN 1.2.3 Authenticated Remote Code Execution via Admin Scripts (high 8.6)
- [CVE-2021-47746](https://insights.sbomify.com/CVE-2021-47746/): NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write (high 8.6)
- [CVE-2021-47745](https://insights.sbomify.com/CVE-2021-47745/): Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection via Firmware Upgrade (high 8.6)
- [CVE-2021-47744](https://insights.sbomify.com/CVE-2021-47744/): Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root (critical 9.3)
- [CVE-2021-47743](https://insights.sbomify.com/CVE-2021-47743/): COMMAX Biometric Access Control System 1.0.0 Reflected XSS via Cookie Parameters (medium 5.1)
- [CVE-2021-47742](https://insights.sbomify.com/CVE-2021-47742/): Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions (high 8.5)
- [CVE-2021-47741](https://insights.sbomify.com/CVE-2021-47741/): ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint (high 8.7)
- [CVE-2021-47740](https://insights.sbomify.com/CVE-2021-47740/): KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability (medium 6.9)
- [CVE-2021-47739](https://insights.sbomify.com/CVE-2021-47739/): Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service Path (high 8.5)
- [CVE-2021-47738](https://insights.sbomify.com/CVE-2021-47738/): CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging (medium 5.1)
- [CVE-2021-47737](https://insights.sbomify.com/CVE-2021-47737/): CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard (medium 5.1)
- [CVE-2021-47736](https://insights.sbomify.com/CVE-2021-47736/): CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing (high 8.6)
- [CVE-2021-47735](https://insights.sbomify.com/CVE-2021-47735/): CMSimple 5.4 Authenticated Remote Code Execution via Template Editing (high 8.6)
- [CVE-2021-47734](https://insights.sbomify.com/CVE-2021-47734/): CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution (high 8.6)
- [CVE-2021-47733](https://insights.sbomify.com/CVE-2021-47733/): CMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding (medium 5.1)
- [CVE-2021-47732](https://insights.sbomify.com/CVE-2021-47732/): CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input (medium 5.1)
- [CVE-2021-47731](https://insights.sbomify.com/CVE-2021-47731/): Selea Targa IP Camera Developer Backdoor Configuration Overwrite (critical 9.3)
- [CVE-2021-47730](https://insights.sbomify.com/CVE-2021-47730/): Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/44/