# Vulnerabilities published in 2021


- [CVE-2021-47729](https://insights.sbomify.com/CVE-2021-47729/): Selea Targa IP Camera Stored Cross-Site Scripting via Files List (medium 5.1)
- [CVE-2021-47728](https://insights.sbomify.com/CVE-2021-47728/): Selea Targa IP Camera Remote Code Execution via Utils (critical 9.3)
- [CVE-2021-47727](https://insights.sbomify.com/CVE-2021-47727/): Selea Targa IP Camera Unauthenticated Stream Disclosure (high 8.7)
- [CVE-2021-47726](https://insights.sbomify.com/CVE-2021-47726/): NuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration Backup (high 8.7)
- [CVE-2021-47725](https://insights.sbomify.com/CVE-2021-47725/): STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files Parameter (medium 4.8)
- [CVE-2021-47724](https://insights.sbomify.com/CVE-2021-47724/): STVS ProVision Authenticated File Disclosure via archive.rb (high 7.1)
- [CVE-2021-47723](https://insights.sbomify.com/CVE-2021-47723/): STVS ProVision Cross-Site Request Forgery (Add Admin) (medium 6.9)
- [CVE-2021-47722](https://insights.sbomify.com/CVE-2021-47722/): Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery (medium 5.1)
- [CVE-2021-47721](https://insights.sbomify.com/CVE-2021-47721/): Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation (high 8.7)
- [CVE-2021-47720](https://insights.sbomify.com/CVE-2021-47720/): Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters (high 8.7)
- [CVE-2021-47719](https://insights.sbomify.com/CVE-2021-47719/): CNC_Ctrl DllUnregisterServer f5501 Access Violation (high 8.7)
- [CVE-2021-47718](https://insights.sbomify.com/CVE-2021-47718/): OpenBMCS Directory Listing Information Disclosure (high 8.7)
- [CVE-2021-47717](https://insights.sbomify.com/CVE-2021-47717/): IntelliChoice eFORCE Software Suite Username Enumeration (medium 6.9)
- [CVE-2021-47716](https://insights.sbomify.com/CVE-2021-47716/): Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints (medium 5.1)
- [CVE-2021-47715](https://insights.sbomify.com/CVE-2021-47715/): Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection (medium 6.9)
- [CVE-2021-47714](https://insights.sbomify.com/CVE-2021-47714/): Hasura GraphQL 1.3.3 Local File Read via SQL Injection (medium 6.9)
- [CVE-2021-47713](https://insights.sbomify.com/CVE-2021-47713/): Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query (high 8.7)
- [CVE-2021-47712](https://insights.sbomify.com/CVE-2021-47712/): Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability (medium 6.9)
- [CVE-2021-47711](https://insights.sbomify.com/CVE-2021-47711/): Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection (high 8.7)
- [CVE-2021-47710](https://insights.sbomify.com/CVE-2021-47710/): COMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credentials Disclosure (high 8.7)
- [CVE-2021-47709](https://insights.sbomify.com/CVE-2021-47709/): COMMAX Smart Home Ruvie CCTV Bridge DVR Service Config Write / DoS (high 8.7)
- [CVE-2021-47708](https://insights.sbomify.com/CVE-2021-47708/): COMMAX Smart Home IoT Control System SQL Injection Authentication Bypass (critical 9.3)
- [CVE-2021-47707](https://insights.sbomify.com/CVE-2021-47707/): COMMAX CVD-Axx DVR Weak Default Credentials Stream Disclosure (critical 9.3)
- [CVE-2021-47706](https://insights.sbomify.com/CVE-2021-47706/): COMMAX Biometric Access Control System Authentication Bypass (high 8.7)
- [CVE-2021-47705](https://insights.sbomify.com/CVE-2021-47705/): CNC_Ctrl DllUnregisterServer Access Violation (high 8.7)
- [CVE-2021-47704](https://insights.sbomify.com/CVE-2021-47704/): OpenBMCS SQL Injection via obix_test.php (high 8.7)
- [CVE-2021-47703](https://insights.sbomify.com/CVE-2021-47703/): OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php (medium 6.9)
- [CVE-2021-47702](https://insights.sbomify.com/CVE-2021-47702/): OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php (medium 5.3)
- [CVE-2021-47701](https://insights.sbomify.com/CVE-2021-47701/): OpenBMCS User Management Privilege Escalation (high 8.7)
- [CVE-2021-47700](https://insights.sbomify.com/CVE-2021-47700/): Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory (high 8.5)
- [CVE-2021-47699](https://insights.sbomify.com/CVE-2021-47699/): Nagios XI < 5.8.7 XSS in Audit Log via Send to NLS Form (medium 5.1)
- [CVE-2021-47698](https://insights.sbomify.com/CVE-2021-47698/): Nagios XI < 5.8.7 XSS in Core UI Views URL handling (medium 5.1)
- [CVE-2021-47697](https://insights.sbomify.com/CVE-2021-47697/): Nagios XI < 5.8.0 XSS via Views URL Handling (medium 5.1)
- [CVE-2021-47696](https://insights.sbomify.com/CVE-2021-47696/): Nagios XI < 5.8.0 XSS via BPI Config ID Handling (medium 5.1)
- [CVE-2021-47695](https://insights.sbomify.com/CVE-2021-47695/): Nagios XI < 5.8.0 XSS via My Tools Page (medium 5.1)
- [CVE-2021-47694](https://insights.sbomify.com/CVE-2021-47694/): Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command (medium 5.1)
- [CVE-2021-47693](https://insights.sbomify.com/CVE-2021-47693/): Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text (high 8.7)
- [CVE-2021-47691](https://insights.sbomify.com/CVE-2021-47691/): Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services Page (medium 5.1)
- [CVE-2021-47690](https://insights.sbomify.com/CVE-2021-47690/): Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay Modals (medium 5.1)
- [CVE-2021-47689](https://insights.sbomify.com/CVE-2021-47689/): Nagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates Pages (medium 5.1)
- [CVE-2021-47688](https://insights.sbomify.com/CVE-2021-47688/): Security feature bypass in WhiteBeam (medium 5.7)
- [CVE-2021-47671](https://insights.sbomify.com/CVE-2021-47671/): can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path (low 3.3)
- [CVE-2021-47670](https://insights.sbomify.com/CVE-2021-47670/): can: peak_usb: fix use after free bugs (high 8.8)
- [CVE-2021-47669](https://insights.sbomify.com/CVE-2021-47669/): can: vxcan: vxcan_xmit: fix use after free bug (high 7.8)
- [CVE-2021-47668](https://insights.sbomify.com/CVE-2021-47668/): can: dev: can_restart: fix use after free bug (high 8.8)
- [CVE-2021-47667](https://insights.sbomify.com/CVE-2021-47667/): Command injection in ZendTo (critical 10.0)
- [CVE-2021-47664](https://insights.sbomify.com/CVE-2021-47664/): Enumeration of valid user names (medium 5.3)
- [CVE-2021-47663](https://insights.sbomify.com/CVE-2021-47663/): Improper session handling (high 8.1)
- [CVE-2021-47662](https://insights.sbomify.com/CVE-2021-47662/): Unauthenticated remote shutdown of the cobot (high 7.5)
- [CVE-2021-47660](https://insights.sbomify.com/CVE-2021-47660/): fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' (medium 5.5)
- [CVE-2021-47659](https://insights.sbomify.com/CVE-2021-47659/): drm/plane: Move range check for format_count earlier (medium 5.5)
- [CVE-2021-47658](https://insights.sbomify.com/CVE-2021-47658/): drm/amd/pm: fix a potential gpu_metrics_table memory leak (medium 5.5)
- [CVE-2021-47657](https://insights.sbomify.com/CVE-2021-47657/): drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() (medium 5.5)
- [CVE-2021-47656](https://insights.sbomify.com/CVE-2021-47656/): jffs2: fix use-after-free in jffs2_clear_xattr_subsystem (high 7.8)
- [CVE-2021-47655](https://insights.sbomify.com/CVE-2021-47655/): media: venus: vdec: fixed possible memory leak issue (medium 5.5)
- [CVE-2021-47654](https://insights.sbomify.com/CVE-2021-47654/): samples/landlock: Fix path_list memory leak (medium 5.5)
- [CVE-2021-47653](https://insights.sbomify.com/CVE-2021-47653/): media: davinci: vpif: fix use-after-free on driver unbind (high 7.8)
- [CVE-2021-47652](https://insights.sbomify.com/CVE-2021-47652/): video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() (medium 5.5)
- [CVE-2021-47651](https://insights.sbomify.com/CVE-2021-47651/): soc: qcom: rpmpd: Check for null return of devm_kcalloc (medium 5.5)
- [CVE-2021-47650](https://insights.sbomify.com/CVE-2021-47650/): ASoC: soc-compress: prevent the potentially use of null pointer (medium 5.5)
- [CVE-2021-47649](https://insights.sbomify.com/CVE-2021-47649/): udmabuf: validate ubuf->pagecount (medium 5.5)
- [CVE-2021-47648](https://insights.sbomify.com/CVE-2021-47648/): gpu: host1x: Fix a memory leak in 'host1x_remove()' (medium 5.5)
- [CVE-2021-47647](https://insights.sbomify.com/CVE-2021-47647/): clk: qcom: ipq8074: fix PCI-E clock oops (medium 5.5)
- [CVE-2021-47646](https://insights.sbomify.com/CVE-2021-47646/): Revert "Revert "block, bfq: honor already-setup queue merges"" (high 7.8)
- [CVE-2021-47645](https://insights.sbomify.com/CVE-2021-47645/): media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com (medium 5.5)
- [CVE-2021-47644](https://insights.sbomify.com/CVE-2021-47644/): media: staging: media: zoran: move videodev alloc (medium 5.5)
- [CVE-2021-47643](https://insights.sbomify.com/CVE-2021-47643/): media: ir_toy: free before error exiting (medium 5.5)
- [CVE-2021-47642](https://insights.sbomify.com/CVE-2021-47642/): video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow (high 7.8)
- [CVE-2021-47641](https://insights.sbomify.com/CVE-2021-47641/): video: fbdev: cirrusfb: check pixclock to avoid divide by zero (medium 5.5)
- [CVE-2021-47640](https://insights.sbomify.com/CVE-2021-47640/): powerpc/kasan: Fix early region not updated correctly (high 7.8)
- [CVE-2021-47639](https://insights.sbomify.com/CVE-2021-47639/): KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU (high 7.8)
- [CVE-2021-47638](https://insights.sbomify.com/CVE-2021-47638/): ubifs: rename_whiteout: Fix double free for whiteout_ui->data (high 7.8)
- [CVE-2021-47637](https://insights.sbomify.com/CVE-2021-47637/): ubifs: Fix deadlock in concurrent rename whiteout and inode writeback (medium 5.5)
- [CVE-2021-47636](https://insights.sbomify.com/CVE-2021-47636/): ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() (high 7.1)
- [CVE-2021-47635](https://insights.sbomify.com/CVE-2021-47635/): ubifs: Fix to add refcount once page is set private (high 7.8)
- [CVE-2021-47634](https://insights.sbomify.com/CVE-2021-47634/): ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (high 7.8)
- [CVE-2021-47633](https://insights.sbomify.com/CVE-2021-47633/): ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 (high 7.1)
- [CVE-2021-47632](https://insights.sbomify.com/CVE-2021-47632/): powerpc/set_memory: Avoid spinlock recursion in change_page_attr() (medium 5.5)
- [CVE-2021-47631](https://insights.sbomify.com/CVE-2021-47631/): ARM: davinci: da850-evm: Avoid NULL pointer dereference (medium 5.5)
- [CVE-2021-47624](https://insights.sbomify.com/CVE-2021-47624/): net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (high 7.1)
- [CVE-2021-47623](https://insights.sbomify.com/CVE-2021-47623/): powerpc/fixmap: Fix VM debug warning on unmap (medium 5.5)
- [CVE-2021-47622](https://insights.sbomify.com/CVE-2021-47622/): scsi: ufs: Fix a deadlock in the error handler (medium 5.5)
- [CVE-2021-47621](https://insights.sbomify.com/CVE-2021-47621/): ClassGraph XML External Entity Reference (high 7.5)
- [CVE-2021-47620](https://insights.sbomify.com/CVE-2021-47620/): Bluetooth: refactor malicious adv data check (high 8.1)
- [CVE-2021-47619](https://insights.sbomify.com/CVE-2021-47619/): i40e: Fix queues reservation for XDP (medium 5.5)
- [CVE-2021-47618](https://insights.sbomify.com/CVE-2021-47618/): ARM: 9170/1: fix panic when kasan and kprobe are enabled (medium 5.5)
- [CVE-2021-47617](https://insights.sbomify.com/CVE-2021-47617/): PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (medium 5.5)
- [CVE-2021-47616](https://insights.sbomify.com/CVE-2021-47616/): RDMA: Fix use-after-free in rxe_queue_cleanup (high 7.8)
- [CVE-2021-47614](https://insights.sbomify.com/CVE-2021-47614/): RDMA/irdma: Fix a user-after-free in add_pble_prm (high 7.8)
- [CVE-2021-47613](https://insights.sbomify.com/CVE-2021-47613/): i2c: virtio: fix completion handling (high 7.8)
- [CVE-2021-47612](https://insights.sbomify.com/CVE-2021-47612/): nfc: fix segfault in nfc_genl_dump_devices_done (medium 5.5)
- [CVE-2021-47611](https://insights.sbomify.com/CVE-2021-47611/): mac80211: validate extended element ID is present (high 8.1)
- [CVE-2021-47610](https://insights.sbomify.com/CVE-2021-47610/): drm/msm: Fix null ptr access msm_ioctl_gem_submit() (medium 5.5)
- [CVE-2021-47609](https://insights.sbomify.com/CVE-2021-47609/): firmware: arm_scpi: Fix string overflow in SCPI genpd driver (high 7.8)
- [CVE-2021-47608](https://insights.sbomify.com/CVE-2021-47608/): bpf: Fix kernel address leakage in atomic fetch (medium 5.5)
- [CVE-2021-47607](https://insights.sbomify.com/CVE-2021-47607/): bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg (medium 5.5)
- [CVE-2021-47606](https://insights.sbomify.com/CVE-2021-47606/): net: netlink: af_netlink: Prevent empty skb by adding a check on len. (medium 5.5)
- [CVE-2021-47605](https://insights.sbomify.com/CVE-2021-47605/): vduse: fix memory corruption in vduse_dev_ioctl() (high 7.8)
- [CVE-2021-47604](https://insights.sbomify.com/CVE-2021-47604/): vduse: check that offset is within bounds in get_config() (high 7.1)
- [CVE-2021-47603](https://insights.sbomify.com/CVE-2021-47603/): audit: improve robustness of the audit queue handling (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/45/