# Vulnerabilities published in 2021


- [CVE-2021-45225](https://insights.sbomify.com/CVE-2021-45225/): Cross-site scripting in coins-global:coins construction cloud (medium 6.1)
- [CVE-2021-45224](https://insights.sbomify.com/CVE-2021-45224/): Cross-site scripting in coins-global:coins construction cloud (medium 6.1)
- [CVE-2021-45223](https://insights.sbomify.com/CVE-2021-45223/): Denial of service in coins-global:coins construction cloud (medium 6.5)
- [CVE-2021-45222](https://insights.sbomify.com/CVE-2021-45222/): Privilege escalation in coins-global:coins construction cloud (high 8.8)
- [CVE-2021-45117](https://insights.sbomify.com/CVE-2021-45117/): Null dereference in opcfoundation:ua-nodeset (medium 6.5)
- [CVE-2021-45116](https://insights.sbomify.com/CVE-2021-45116/): Information disclosure in Django (high 7.5)
- [CVE-2021-45115](https://insights.sbomify.com/CVE-2021-45115/): Denial-of-service in Django (high 7.5)
- [CVE-2021-45111](https://insights.sbomify.com/CVE-2021-45111/): Missing authorization in Odoo Community (high 7.1)
- [CVE-2021-45106](https://insights.sbomify.com/CVE-2021-45106/): Hardcoded credentials in SICAM TOOLBOX II (medium 6.5)
- [CVE-2021-45105](https://insights.sbomify.com/CVE-2021-45105/): Apache Log4j2 does not always protect from infinite recursion in lookup evaluation (medium 5.9)
- [CVE-2021-45104](https://insights.sbomify.com/CVE-2021-45104/): Information disclosure in wisc:htcondor (high 7.4)
- [CVE-2021-45103](https://insights.sbomify.com/CVE-2021-45103/): Information disclosure in wisc:htcondor (high 8.1)
- [CVE-2021-45102](https://insights.sbomify.com/CVE-2021-45102/): Privilege escalation in wisc:htcondor (high 8.8)
- [CVE-2021-45101](https://insights.sbomify.com/CVE-2021-45101/): Information disclosure in wisc:htcondor (high 8.1)
- [CVE-2021-45100](https://insights.sbomify.com/CVE-2021-45100/): Information disclosure in ksmbd project:ksmbd (high 7.5)
- [CVE-2021-45099](https://insights.sbomify.com/CVE-2021-45099/): Other in ssh \& web terminal project:ssh \& web terminal (high 8.8)
- [CVE-2021-45098](https://insights.sbomify.com/CVE-2021-45098/): Security feature bypass in debian:debian linux (high 7.5)
- [CVE-2021-45097](https://insights.sbomify.com/CVE-2021-45097/): Information disclosure in knime:knime server (low 2.9)
- [CVE-2021-45096](https://insights.sbomify.com/CVE-2021-45096/): XML external entity in knime:knime analytics platform (medium 4.7)
- [CVE-2021-45095](https://insights.sbomify.com/CVE-2021-45095/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2021-45094](https://insights.sbomify.com/CVE-2021-45094/): Cross-site scripting in okta:imprivata privileged access management (medium 5.4)
- [CVE-2021-45092](https://insights.sbomify.com/CVE-2021-45092/): Cross-site scripting in cybelesoft:thinfinity virtualui (critical 9.8)
- [CVE-2021-45091](https://insights.sbomify.com/CVE-2021-45091/): Missing authorization in stormshield:endpoint security (medium 4.3)
- [CVE-2021-45090](https://insights.sbomify.com/CVE-2021-45090/): Other in stormshield:endpoint security (critical 9.8)
- [CVE-2021-45089](https://insights.sbomify.com/CVE-2021-45089/): Missing authorization in stormshield:endpoint security (medium 5.2)
- [CVE-2021-45088](https://insights.sbomify.com/CVE-2021-45088/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-45087](https://insights.sbomify.com/CVE-2021-45087/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-45086](https://insights.sbomify.com/CVE-2021-45086/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-45085](https://insights.sbomify.com/CVE-2021-45085/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-45083](https://insights.sbomify.com/CVE-2021-45083/): Incorrect Default Permissions in Cobbler (high 7.1)
- [CVE-2021-45082](https://insights.sbomify.com/CVE-2021-45082/): Command Injection in Cobbler (high 7.8)
- [CVE-2021-45081](https://insights.sbomify.com/CVE-2021-45081/): Weak cryptography in cobbler project:cobbler (medium 5.9)
- [CVE-2021-45079](https://insights.sbomify.com/CVE-2021-45079/): Auth bypass in canonical:ubuntu linux (critical 9.1)
- [CVE-2021-45078](https://insights.sbomify.com/CVE-2021-45078/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-45077](https://insights.sbomify.com/CVE-2021-45077/): Information disclosure in Netgear Nighthawk R6700 (high 7.5)
- [CVE-2021-45074](https://insights.sbomify.com/CVE-2021-45074/): Missing authorization in JFrog Artifactory (medium 4.3)
- [CVE-2021-45071](https://insights.sbomify.com/CVE-2021-45071/): Cross-site scripting in Odoo Community (medium 5.3)
- [CVE-2021-45068](https://insights.sbomify.com/CVE-2021-45068/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45067](https://insights.sbomify.com/CVE-2021-45067/): Adobe Acrobat Reader Memory Corruption could lead to Information Disclosure (medium 5.5)
- [CVE-2021-45064](https://insights.sbomify.com/CVE-2021-45064/): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45063](https://insights.sbomify.com/CVE-2021-45063/): Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-45062](https://insights.sbomify.com/CVE-2021-45062/): Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45061](https://insights.sbomify.com/CVE-2021-45061/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45060](https://insights.sbomify.com/CVE-2021-45060/): Adobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45059](https://insights.sbomify.com/CVE-2021-45059/): Adobe InDesign JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-45058](https://insights.sbomify.com/CVE-2021-45058/): Adobe InDesign JPEG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45057](https://insights.sbomify.com/CVE-2021-45057/): Adobe InDesign JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45056](https://insights.sbomify.com/CVE-2021-45056/): Adobe InCopy JPEG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45055](https://insights.sbomify.com/CVE-2021-45055/): Adobe InCopy TIF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45054](https://insights.sbomify.com/CVE-2021-45054/): Adobe InCopy JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-45053](https://insights.sbomify.com/CVE-2021-45053/): Adobe InCopy JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-45052](https://insights.sbomify.com/CVE-2021-45052/): Adobe Bridge TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-45051](https://insights.sbomify.com/CVE-2021-45051/): Adobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-45046](https://insights.sbomify.com/CVE-2021-45046/): Apache Log4j2 Deserialization of Untrusted Data (critical 9.0, exploited in the wild)
- [CVE-2021-45043](https://insights.sbomify.com/CVE-2021-45043/): Path traversal in hd-network real-time monitoring system project:hd-network real-time monitoring system (high 7.5)
- [CVE-2021-45042](https://insights.sbomify.com/CVE-2021-45042/): Denial of service in hashicorp:vault (medium 4.9)
- [CVE-2021-45041](https://insights.sbomify.com/CVE-2021-45041/): SQL injection in salesagility:suitecrm (high 8.8)
- [CVE-2021-45040](https://insights.sbomify.com/CVE-2021-45040/): File upload in spatie:laravel media library (critical 9.8)
- [CVE-2021-45039](https://insights.sbomify.com/CVE-2021-45039/): Memory corruption in uniview:camera firmware (critical 9.8)
- [CVE-2021-45038](https://insights.sbomify.com/CVE-2021-45038/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2021-45036](https://insights.sbomify.com/CVE-2021-45036/): Velneo vClient improper authentication (high 8.7)
- [CVE-2021-45035](https://insights.sbomify.com/CVE-2021-45035/): Velneo vClient Improper authentication (medium 6.3)
- [CVE-2021-45034](https://insights.sbomify.com/CVE-2021-45034/): Information disclosure in CP-8000 MASTER MODULE WITH I/O -25/+70°C (high 7.5)
- [CVE-2021-45033](https://insights.sbomify.com/CVE-2021-45033/): Hardcoded credentials in CP-8000 MASTER MODULE WITH I/O -25/+70°C (high 8.8)
- [CVE-2021-45031](https://insights.sbomify.com/CVE-2021-45031/): Weak Authentication in Login Function of USC+ (high 7.7)
- [CVE-2021-45029](https://insights.sbomify.com/CVE-2021-45029/): Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection (critical 9.8)
- [CVE-2021-45027](https://insights.sbomify.com/CVE-2021-45027/): Path traversal in softlinkint:oliver v5 library (high 7.5)
- [CVE-2021-45026](https://insights.sbomify.com/CVE-2021-45026/): Cross-site scripting in rocketsoftware:ags-zena (medium 6.1)
- [CVE-2021-45025](https://insights.sbomify.com/CVE-2021-45025/): Information disclosure in rocketsoftware:ags-zena (high 7.5)
- [CVE-2021-45024](https://insights.sbomify.com/CVE-2021-45024/): XML external entity in rocketsoftware:ags-zena (critical 9.8)
- [CVE-2021-45018](https://insights.sbomify.com/CVE-2021-45018/): Cross-site scripting in catfish-cms:catfish cms (medium 6.1)
- [CVE-2021-45017](https://insights.sbomify.com/CVE-2021-45017/): Cross-site request forgery in catfish-cms:catfish cms (high 8.8)
- [CVE-2021-45015](https://insights.sbomify.com/CVE-2021-45015/): Path traversal in taogogo:taocms (critical 9.1)
- [CVE-2021-45014](https://insights.sbomify.com/CVE-2021-45014/): SQL injection in taogogo:taocms (critical 9.8)
- [CVE-2021-45010](https://insights.sbomify.com/CVE-2021-45010/): Path traversal in prasathmani:tiny file manager (high 8.8)
- [CVE-2021-45008](https://insights.sbomify.com/CVE-2021-45008/): Privilege escalation in plesk:plesk (high 8.8)
- [CVE-2021-45007](https://insights.sbomify.com/CVE-2021-45007/): Cross-site request forgery in plesk:plesk (medium 6.5)
- [CVE-2021-45005](https://insights.sbomify.com/CVE-2021-45005/): Memory corruption in artifex:mujs (critical 9.8)
- [CVE-2021-45003](https://insights.sbomify.com/CVE-2021-45003/): File upload in nikhil-bhalerao:laundry booking management system (critical 9.8)
- [CVE-2021-44994](https://insights.sbomify.com/CVE-2021-44994/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2021-44993](https://insights.sbomify.com/CVE-2021-44993/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2021-44992](https://insights.sbomify.com/CVE-2021-44992/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2021-44988](https://insights.sbomify.com/CVE-2021-44988/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2021-44983](https://insights.sbomify.com/CVE-2021-44983/): Path traversal in taogogo:taocms (medium 4.9)
- [CVE-2021-44981](https://insights.sbomify.com/CVE-2021-44981/): Command injection in quickbox:quickbox (high 8.8)
- [CVE-2021-44978](https://insights.sbomify.com/CVE-2021-44978/): Code injection in idreamsoft:icms (critical 9.8)
- [CVE-2021-44977](https://insights.sbomify.com/CVE-2021-44977/): Path traversal in idreamsoft:icms (high 7.5)
- [CVE-2021-44975](https://insights.sbomify.com/CVE-2021-44975/): Memory corruption in radare:radare2 (medium 5.5)
- [CVE-2021-44974](https://insights.sbomify.com/CVE-2021-44974/): Null dereference in radare:radare2 (medium 5.5)
- [CVE-2021-44971](https://insights.sbomify.com/CVE-2021-44971/): Auth bypass in tenda:ac15 firmware (critical 9.8)
- [CVE-2021-44970](https://insights.sbomify.com/CVE-2021-44970/): Cross-site scripting in 1234n:minicms (medium 5.4)
- [CVE-2021-44969](https://insights.sbomify.com/CVE-2021-44969/): Cross-site scripting in taogogo:taocms (medium 4.8)
- [CVE-2021-44968](https://insights.sbomify.com/CVE-2021-44968/): Use after free in iobit:advanced systemcare (high 7.8)
- [CVE-2021-44967](https://insights.sbomify.com/CVE-2021-44967/): File upload in limesurvey:limesurvey (high 8.8)
- [CVE-2021-44966](https://insights.sbomify.com/CVE-2021-44966/): SQL injection in phpgurukul:employee record management system (critical 9.8)
- [CVE-2021-44965](https://insights.sbomify.com/CVE-2021-44965/): Path traversal in phpgurukul:employee record management system (high 7.5)
- [CVE-2021-44964](https://insights.sbomify.com/CVE-2021-44964/): Use after free in lua:lua (medium 6.3)
- [CVE-2021-44962](https://insights.sbomify.com/CVE-2021-44962/): Memory corruption in slic3r:libslic3r (medium 5.5)
- [CVE-2021-44961](https://insights.sbomify.com/CVE-2021-44961/): Denial of service in slic3r:libslic3r (medium 5.5)
- [CVE-2021-44960](https://insights.sbomify.com/CVE-2021-44960/): Null dereference in svgpp:svgpp (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/64/