# Vulnerabilities published in 2021


- [CVE-2021-45459](https://insights.sbomify.com/CVE-2021-45459/): Command Injection in node-windows (critical 9.8)
- [CVE-2021-45458](https://insights.sbomify.com/CVE-2021-45458/): Hardcoded credentials (high 7.5)
- [CVE-2021-45457](https://insights.sbomify.com/CVE-2021-45457/): Overly broad CORS configuration (high 7.5)
- [CVE-2021-45456](https://insights.sbomify.com/CVE-2021-45456/): Command injection (critical 9.8)
- [CVE-2021-45454](https://insights.sbomify.com/CVE-2021-45454/): Information disclosure in amperecomputing:ampere altra firmware (high 7.5)
- [CVE-2021-45452](https://insights.sbomify.com/CVE-2021-45452/): Directory-traversal in Django (medium 5.3)
- [CVE-2021-45451](https://insights.sbomify.com/CVE-2021-45451/): Weak cryptography in arm:mbed tls (high 7.5)
- [CVE-2021-45450](https://insights.sbomify.com/CVE-2021-45450/): Weak cryptography in fedoraproject:fedora (high 7.5)
- [CVE-2021-45449](https://insights.sbomify.com/CVE-2021-45449/): Information disclosure in docker:docker desktop (medium 5.5)
- [CVE-2021-45448](https://insights.sbomify.com/CVE-2021-45448/): Path traversal in Pentaho Business Analytics Server (high 7.1)
- [CVE-2021-45447](https://insights.sbomify.com/CVE-2021-45447/): Information disclosure in Pentaho Business Analytics Server (high 7.7)
- [CVE-2021-45446](https://insights.sbomify.com/CVE-2021-45446/): Pentaho Business Analytics Server - Exposure of Information Through Directory Listing (medium 5.0)
- [CVE-2021-45445](https://insights.sbomify.com/CVE-2021-45445/): Denial of service in unisys:clearpath mcp tcp\/ip networking services (high 7.5)
- [CVE-2021-45444](https://insights.sbomify.com/CVE-2021-45444/): Code injection in apple:mac os x (high 7.8)
- [CVE-2021-45442](https://insights.sbomify.com/CVE-2021-45442/): Path traversal in Trend Micro Worry-Free Business Security (high 7.1)
- [CVE-2021-45441](https://insights.sbomify.com/CVE-2021-45441/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-45440](https://insights.sbomify.com/CVE-2021-45440/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-45435](https://insights.sbomify.com/CVE-2021-45435/): SQL injection in oretnom23:simple cold storage management system (critical 9.8)
- [CVE-2021-45429](https://insights.sbomify.com/CVE-2021-45429/): Memory corruption in virustotal:yara (medium 5.5)
- [CVE-2021-45428](https://insights.sbomify.com/CVE-2021-45428/): File upload in telesquare:tlr-2005ksh firmware (critical 9.8)
- [CVE-2021-45427](https://insights.sbomify.com/CVE-2021-45427/): Path traversal in emerson:xweb300d evo firmware (critical 9.8)
- [CVE-2021-45425](https://insights.sbomify.com/CVE-2021-45425/): Cross-site scripting in safarimontage:safari montage (medium 6.1)
- [CVE-2021-45423](https://insights.sbomify.com/CVE-2021-45423/): Memory corruption in pev project:pev (critical 9.8)
- [CVE-2021-45422](https://insights.sbomify.com/CVE-2021-45422/): Cross-site scripting in reprisesoftware:reprise license manager (medium 6.1)
- [CVE-2021-45421](https://insights.sbomify.com/CVE-2021-45421/): Information disclosure in emerson:dixell xweb-500 firmware (high 7.5)
- [CVE-2021-45420](https://insights.sbomify.com/CVE-2021-45420/): Missing authorization in emerson:dixell xweb-500 firmware (critical 9.8)
- [CVE-2021-45419](https://insights.sbomify.com/CVE-2021-45419/): Other in starcharge:nova 360 cabinet firmware (high 8.8)
- [CVE-2021-45418](https://insights.sbomify.com/CVE-2021-45418/): Path traversal in starcharge:nova 360 cabinet firmware (high 8.8)
- [CVE-2021-45417](https://insights.sbomify.com/CVE-2021-45417/): Memory corruption in advanced intrusion detection environment project:advanced intrusion detection environment (high 7.8)
- [CVE-2021-45416](https://insights.sbomify.com/CVE-2021-45416/): RosarioSIS XSS Vulnerability (medium 6.1)
- [CVE-2021-45414](https://insights.sbomify.com/CVE-2021-45414/): Code injection in datarobot:datarobot (critical 9.8)
- [CVE-2021-45411](https://insights.sbomify.com/CVE-2021-45411/): File upload in printable staff id card creator system project:printable staff id card creator system (critical 9.8)
- [CVE-2021-45408](https://insights.sbomify.com/CVE-2021-45408/): Open redirect in seeddms:seeddms (medium 6.1)
- [CVE-2021-45406](https://insights.sbomify.com/CVE-2021-45406/): SQL injection in salonerp project:salonerp (high 8.8)
- [CVE-2021-45402](https://insights.sbomify.com/CVE-2021-45402/): Information disclosure in linux:linux kernel (medium 5.5)
- [CVE-2021-45401](https://insights.sbomify.com/CVE-2021-45401/): Command injection in tendacn:ac10u firmware (critical 9.8)
- [CVE-2021-45394](https://insights.sbomify.com/CVE-2021-45394/): Cross-site Scripting in HTML2PDF (high 8.8)
- [CVE-2021-45392](https://insights.sbomify.com/CVE-2021-45392/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2021-45391](https://insights.sbomify.com/CVE-2021-45391/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2021-45389](https://insights.sbomify.com/CVE-2021-45389/): Auth bypass in starwind:command center (critical 9.8)
- [CVE-2021-45387](https://insights.sbomify.com/CVE-2021-45387/): Denial of service in broadcom:tcpreplay (medium 5.5)
- [CVE-2021-45386](https://insights.sbomify.com/CVE-2021-45386/): Denial of service in broadcom:tcpreplay (medium 5.5)
- [CVE-2021-45385](https://insights.sbomify.com/CVE-2021-45385/): Null dereference in rockcarry:ffjpeg (medium 6.5)
- [CVE-2021-45382](https://insights.sbomify.com/CVE-2021-45382/): D-Link Multiple Routers Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-45380](https://insights.sbomify.com/CVE-2021-45380/): Cross-site scripting in appcms:appcms (medium 6.1)
- [CVE-2021-45379](https://insights.sbomify.com/CVE-2021-45379/): Auth bypass in glewlwyd project:glewlwyd (high 8.8)
- [CVE-2021-45364](https://insights.sbomify.com/CVE-2021-45364/): Code injection in statamic:statamic (critical 9.8)
- [CVE-2021-45357](https://insights.sbomify.com/CVE-2021-45357/): Cross-site scripting in piwigo:piwigo (medium 6.1)
- [CVE-2021-45348](https://insights.sbomify.com/CVE-2021-45348/): Path traversal in attendance management system project:attendance management system (high 7.5)
- [CVE-2021-45347](https://insights.sbomify.com/CVE-2021-45347/): Auth bypass in zzcms:zzcms (high 7.5)
- [CVE-2021-45346](https://insights.sbomify.com/CVE-2021-45346/): Information disclosure in netapp:ontap select deploy administration utility (medium 4.3)
- [CVE-2021-45345](https://insights.sbomify.com/CVE-2021-45345/): Memory corruption in webcamserver project:webcamserver (high 7.5)
- [CVE-2021-45343](https://insights.sbomify.com/CVE-2021-45343/): Null dereference in debian:debian linux (medium 5.5)
- [CVE-2021-45342](https://insights.sbomify.com/CVE-2021-45342/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-45341](https://insights.sbomify.com/CVE-2021-45341/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2021-45340](https://insights.sbomify.com/CVE-2021-45340/): Null dereference in libsixel:libsixel (medium 6.5)
- [CVE-2021-45339](https://insights.sbomify.com/CVE-2021-45339/): Privilege escalation in avast:antivirus (high 7.8)
- [CVE-2021-45338](https://insights.sbomify.com/CVE-2021-45338/): Privilege escalation in avast:antivirus (high 7.8)
- [CVE-2021-45337](https://insights.sbomify.com/CVE-2021-45337/): Privilege escalation in avast:antivirus (high 8.8)
- [CVE-2021-45336](https://insights.sbomify.com/CVE-2021-45336/): Privilege escalation in avast:antivirus (high 8.8)
- [CVE-2021-45335](https://insights.sbomify.com/CVE-2021-45335/): Misconfiguration in avast:antivirus (high 8.8)
- [CVE-2021-45334](https://insights.sbomify.com/CVE-2021-45334/): SQL injection in online thesis archiving system project:online thesis archiving system (critical 9.8)
- [CVE-2021-45331](https://insights.sbomify.com/CVE-2021-45331/): Reuse of one time passwords allowed in Gitea (critical 9.8)
- [CVE-2021-45330](https://insights.sbomify.com/CVE-2021-45330/): Improper Privilege Management in Gitea (critical 9.8)
- [CVE-2021-45329](https://insights.sbomify.com/CVE-2021-45329/): Cross-site Scripting in Gitea (medium 6.1)
- [CVE-2021-45328](https://insights.sbomify.com/CVE-2021-45328/): Open redirect in Gitea (medium 6.1)
- [CVE-2021-45327](https://insights.sbomify.com/CVE-2021-45327/): Capture-replay in Gitea (critical 9.8)
- [CVE-2021-45326](https://insights.sbomify.com/CVE-2021-45326/): Cross Site Request Forgery in Gitea (high 8.8)
- [CVE-2021-45325](https://insights.sbomify.com/CVE-2021-45325/): Gitea displaying raw OpenID error in UI (high 7.5)
- [CVE-2021-45310](https://insights.sbomify.com/CVE-2021-45310/): Information disclosure in sangoma:switchvox (medium 5.3)
- [CVE-2021-45297](https://insights.sbomify.com/CVE-2021-45297/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-45293](https://insights.sbomify.com/CVE-2021-45293/): Memory corruption in fedoraproject:fedora (medium 5.5)
- [CVE-2021-45292](https://insights.sbomify.com/CVE-2021-45292/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-45291](https://insights.sbomify.com/CVE-2021-45291/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-45290](https://insights.sbomify.com/CVE-2021-45290/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2021-45289](https://insights.sbomify.com/CVE-2021-45289/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-45288](https://insights.sbomify.com/CVE-2021-45288/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-45286](https://insights.sbomify.com/CVE-2021-45286/): Path traversal in zzcms:zzcms (medium 5.3)
- [CVE-2021-45281](https://insights.sbomify.com/CVE-2021-45281/): Cross-site scripting in quickbox:quickbox (medium 6.1)
- [CVE-2021-45268](https://insights.sbomify.com/CVE-2021-45268/): Cross-site request forgery in backdropcms:backdrop (high 8.8)
- [CVE-2021-45267](https://insights.sbomify.com/CVE-2021-45267/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-45266](https://insights.sbomify.com/CVE-2021-45266/): Null dereference in gpac:gpac (high 7.5)
- [CVE-2021-45263](https://insights.sbomify.com/CVE-2021-45263/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-45262](https://insights.sbomify.com/CVE-2021-45262/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-45261](https://insights.sbomify.com/CVE-2021-45261/): Memory corruption in gnu:patch (medium 5.5)
- [CVE-2021-45260](https://insights.sbomify.com/CVE-2021-45260/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-45259](https://insights.sbomify.com/CVE-2021-45259/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-45258](https://insights.sbomify.com/CVE-2021-45258/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-45257](https://insights.sbomify.com/CVE-2021-45257/): Denial of service in nasm:netwide assembler (medium 5.5)
- [CVE-2021-45256](https://insights.sbomify.com/CVE-2021-45256/): Null dereference in nasm:netwide assembler (medium 5.5)
- [CVE-2021-45255](https://insights.sbomify.com/CVE-2021-45255/): SQL injection in video sharing website project:video sharing website (critical 9.8)
- [CVE-2021-45253](https://insights.sbomify.com/CVE-2021-45253/): SQL injection in simple cold storage management system project:simple cold storage managment system (critical 9.8)
- [CVE-2021-45252](https://insights.sbomify.com/CVE-2021-45252/): SQL injection in oretnom23:simple forum\/discussion system (critical 9.8)
- [CVE-2021-45232](https://insights.sbomify.com/CVE-2021-45232/): security vulnerability on unauthorized access. (critical 9.8)
- [CVE-2021-45231](https://insights.sbomify.com/CVE-2021-45231/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-45230](https://insights.sbomify.com/CVE-2021-45230/): Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver (medium 6.5)
- [CVE-2021-45229](https://insights.sbomify.com/CVE-2021-45229/): Apache Airflow: Reflected XSS via Origin Query Argument in URL (medium 6.1)
- [CVE-2021-45228](https://insights.sbomify.com/CVE-2021-45228/): Cross-site scripting in coins-global:coins construction cloud (medium 5.4)
- [CVE-2021-45227](https://insights.sbomify.com/CVE-2021-45227/): Cross-site scripting in coins-global:coins construction cloud (medium 5.4)
- [CVE-2021-45226](https://insights.sbomify.com/CVE-2021-45226/): Other in coins-global:coins construction cloud (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/63/