# Vulnerabilities published in 2021


- [CVE-2021-44957](https://insights.sbomify.com/CVE-2021-44957/): Memory corruption in rockcarry:ffjpeg (medium 6.5)
- [CVE-2021-44956](https://insights.sbomify.com/CVE-2021-44956/): Memory corruption in rockcarry:ffjpeg (medium 6.5)
- [CVE-2021-44954](https://insights.sbomify.com/CVE-2021-44954/): Privilege escalation in qvis:dvr firmware (high 7.8)
- [CVE-2021-44949](https://insights.sbomify.com/CVE-2021-44949/): Missing authorization in glfusion:glfusion (critical 9.8)
- [CVE-2021-44942](https://insights.sbomify.com/CVE-2021-44942/): Cross-site request forgery in glfusion:glfusion (medium 4.3)
- [CVE-2021-44937](https://insights.sbomify.com/CVE-2021-44937/): Business logic in glfusion:glfusion (medium 5.3)
- [CVE-2021-44935](https://insights.sbomify.com/CVE-2021-44935/): Auth bypass in glfusion:glfusion (critical 9.1)
- [CVE-2021-44927](https://insights.sbomify.com/CVE-2021-44927/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44926](https://insights.sbomify.com/CVE-2021-44926/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44925](https://insights.sbomify.com/CVE-2021-44925/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44924](https://insights.sbomify.com/CVE-2021-44924/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-44923](https://insights.sbomify.com/CVE-2021-44923/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44922](https://insights.sbomify.com/CVE-2021-44922/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44921](https://insights.sbomify.com/CVE-2021-44921/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44920](https://insights.sbomify.com/CVE-2021-44920/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-44919](https://insights.sbomify.com/CVE-2021-44919/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44918](https://insights.sbomify.com/CVE-2021-44918/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-44917](https://insights.sbomify.com/CVE-2021-44917/): Denial of service in gnuplot:gnuplot (medium 5.5)
- [CVE-2021-44916](https://insights.sbomify.com/CVE-2021-44916/): Cross-site scripting in opmantek:open-audit (medium 6.1)
- [CVE-2021-44915](https://insights.sbomify.com/CVE-2021-44915/): SQL injection in taogogo:taocms (high 7.2)
- [CVE-2021-44912](https://insights.sbomify.com/CVE-2021-44912/): File upload in xpressengine:xpressengine (medium 5.4)
- [CVE-2021-44911](https://insights.sbomify.com/CVE-2021-44911/): File upload in xpressengine:xpressengine (medium 5.4)
- [CVE-2021-44908](https://insights.sbomify.com/CVE-2021-44908/): Prototype Pollution in Sails.js (critical 9.8)
- [CVE-2021-44906](https://insights.sbomify.com/CVE-2021-44906/): Prototype Pollution in minimist (critical 9.8)
- [CVE-2021-44905](https://insights.sbomify.com/CVE-2021-44905/): Missing authorization in cef:fortessa ftbtld firmware (high 8.2)
- [CVE-2021-44903](https://insights.sbomify.com/CVE-2021-44903/): Privilege escalation in msi:center pro (high 7.8)
- [CVE-2021-44901](https://insights.sbomify.com/CVE-2021-44901/): Privilege escalation in msi:dragon center (high 7.8)
- [CVE-2021-44900](https://insights.sbomify.com/CVE-2021-44900/): Privilege escalation in msi:app player (high 7.8)
- [CVE-2021-44899](https://insights.sbomify.com/CVE-2021-44899/): Privilege escalation in msi:center (high 7.8)
- [CVE-2021-44896](https://insights.sbomify.com/CVE-2021-44896/): DMP Roadmap before 3.0.4 allows XSS. (medium 6.1)
- [CVE-2021-44892](https://insights.sbomify.com/CVE-2021-44892/): ThinkPHP Remote Code Execution (RCE) vulnerability (high 8.8)
- [CVE-2021-44886](https://insights.sbomify.com/CVE-2021-44886/): Missing authorization in zammad:zammad (medium 5.3)
- [CVE-2021-44882](https://insights.sbomify.com/CVE-2021-44882/): Command injection in dlink:dir-878 firmware (critical 9.8)
- [CVE-2021-44881](https://insights.sbomify.com/CVE-2021-44881/): Command injection in dlink:dir-882 firmware (critical 9.8)
- [CVE-2021-44880](https://insights.sbomify.com/CVE-2021-44880/): Command injection in dlink:dir-878 firmware (critical 9.8)
- [CVE-2021-44879](https://insights.sbomify.com/CVE-2021-44879/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2021-44878](https://insights.sbomify.com/CVE-2021-44878/): Pac4j token validation bypass if OpenID Connect provider supports none algorithm (high 7.5)
- [CVE-2021-44877](https://insights.sbomify.com/CVE-2021-44877/): Auth bypass in dalmark:systeam enterprise resource planning (high 7.5)
- [CVE-2021-44876](https://insights.sbomify.com/CVE-2021-44876/): Information disclosure in dalmark:systeam enterprise resource planning (medium 5.3)
- [CVE-2021-44875](https://insights.sbomify.com/CVE-2021-44875/): Information disclosure in dalmark:systeam enterprise resource planning (medium 5.3)
- [CVE-2021-44874](https://insights.sbomify.com/CVE-2021-44874/): SQL injection in dalmark:systeam enterprise resource planning (high 8.8)
- [CVE-2021-44868](https://insights.sbomify.com/CVE-2021-44868/): SQL injection in MCMS (critical 9.8)
- [CVE-2021-44866](https://insights.sbomify.com/CVE-2021-44866/): SQL injection in projectworlds:online movie ticket booking system (high 7.5)
- [CVE-2021-44864](https://insights.sbomify.com/CVE-2021-44864/): Memory corruption in tp-link:wn886n firmware (medium 6.5)
- [CVE-2021-44862](https://insights.sbomify.com/CVE-2021-44862/): Sensitive Information store in NSClient logs (high 8.4)
- [CVE-2021-44860](https://insights.sbomify.com/CVE-2021-44860/): Memory corruption in opendesign:drawings sdk (high 7.8)
- [CVE-2021-44859](https://insights.sbomify.com/CVE-2021-44859/): Memory corruption in opendesign:drawings sdk (high 7.8)
- [CVE-2021-44858](https://insights.sbomify.com/CVE-2021-44858/): Missing authorization in mediawiki:mediawiki (high 7.5)
- [CVE-2021-44857](https://insights.sbomify.com/CVE-2021-44857/): Missing authorization in mediawiki:mediawiki (medium 6.5)
- [CVE-2021-44856](https://insights.sbomify.com/CVE-2021-44856/): Security feature bypass in mediawiki:mediawiki (medium 5.3)
- [CVE-2021-44855](https://insights.sbomify.com/CVE-2021-44855/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2021-44854](https://insights.sbomify.com/CVE-2021-44854/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2021-44852](https://insights.sbomify.com/CVE-2021-44852/): Privilege escalation in biostar:racing gt evo (high 7.8)
- [CVE-2021-44850](https://insights.sbomify.com/CVE-2021-44850/): Security feature bypass in amd:xilinx z-7007s firmware (medium 6.8)
- [CVE-2021-44848](https://insights.sbomify.com/CVE-2021-44848/): Information disclosure in cybelesoft:thinfinity virtualui (medium 5.3)
- [CVE-2021-44847](https://insights.sbomify.com/CVE-2021-44847/): Memory corruption in fedoraproject:fedora (critical 9.8)
- [CVE-2021-44840](https://insights.sbomify.com/CVE-2021-44840/): Missing authorization in deltarm:delta rm (low 2.7)
- [CVE-2021-44839](https://insights.sbomify.com/CVE-2021-44839/): Missing authorization in deltarm:delta rm (medium 6.5)
- [CVE-2021-44838](https://insights.sbomify.com/CVE-2021-44838/): Missing authorization in deltarm:delta rm (medium 4.3)
- [CVE-2021-44837](https://insights.sbomify.com/CVE-2021-44837/): Missing authorization in deltarm:delta rm (medium 4.3)
- [CVE-2021-44836](https://insights.sbomify.com/CVE-2021-44836/): Missing authorization in deltarm:delta rm (medium 4.3)
- [CVE-2021-44835](https://insights.sbomify.com/CVE-2021-44835/): SQL injection in aivhub:active intelligence visualization (critical 9.8)
- [CVE-2021-44833](https://insights.sbomify.com/CVE-2021-44833/): Misconfiguration in amazon:aws opensearch (critical 9.8)
- [CVE-2021-44832](https://insights.sbomify.com/CVE-2021-44832/): Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration (medium 6.6)
- [CVE-2021-44829](https://insights.sbomify.com/CVE-2021-44829/): Cross-site scripting in afi-solutions:webacms (medium 6.1)
- [CVE-2021-44828](https://insights.sbomify.com/CVE-2021-44828/): Memory corruption in arm:bifrost gpu kernel driver (high 7.8)
- [CVE-2021-44827](https://insights.sbomify.com/CVE-2021-44827/): Command injection in tp-link:archer c20i firmware (high 8.8)
- [CVE-2021-4481](https://insights.sbomify.com/CVE-2021-4481/): Dräger Protector Software Local Privilege Escalation via Insecure File Permissions (high 8.3)
- [CVE-2021-4480](https://insights.sbomify.com/CVE-2021-4480/): Dräger Protector Software Local Privilege Escalation via Insecure File Permissions (high 8.3)
- [CVE-2021-44795](https://insights.sbomify.com/CVE-2021-44795/): Modifying User Permissions via Unauthorized Access in Single Connect (medium 5.3)
- [CVE-2021-44794](https://insights.sbomify.com/CVE-2021-44794/): Information Leakege via Unauthorized Access in Single Connect (medium 5.3)
- [CVE-2021-44793](https://insights.sbomify.com/CVE-2021-44793/): Information Leakege via Unauthorized Access in Single Connect (high 8.6)
- [CVE-2021-44792](https://insights.sbomify.com/CVE-2021-44792/): Information Leakege via Unauthorized Access in Single Connect (medium 5.3)
- [CVE-2021-44791](https://insights.sbomify.com/CVE-2021-44791/): Reflected XSS on certain HTTP endpoints (medium 6.1)
- [CVE-2021-44790](https://insights.sbomify.com/CVE-2021-44790/): Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier (critical 9.8)
- [CVE-2021-4479](https://insights.sbomify.com/CVE-2021-4479/): Dräger Atlan A350 1.00 <= 1.01 DoS via Medibus Interface (medium 6.3)
- [CVE-2021-4478](https://insights.sbomify.com/CVE-2021-4478/): Dräger CC-Vision Basic and CC-Vision E-Cal Out-of-Bounds Write via Malicious GDT File (high 8.3)
- [CVE-2021-44779](https://insights.sbomify.com/CVE-2021-44779/): WordPress [GWA] AutoResponder plugin <= 2.3 - Unauthenticated SQL Injection (SQLi) vulnerability (high 7.3)
- [CVE-2021-44777](https://insights.sbomify.com/CVE-2021-44777/): Cross-site request forgery in Email Tracker (WordPress plugin) (medium 5.4)
- [CVE-2021-44776](https://insights.sbomify.com/CVE-2021-44776/): spx_restservice SubNet_handler_func Broken Access Control (medium 6.5)
- [CVE-2021-44775](https://insights.sbomify.com/CVE-2021-44775/): Cross-site scripting in Odoo Community (medium 6.5)
- [CVE-2021-4477](https://insights.sbomify.com/CVE-2021-4477/): Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass (critical 9.3)
- [CVE-2021-44769](https://insights.sbomify.com/CVE-2021-44769/): TLS Certificate Generation Function Improper Input Validation (medium 4.9)
- [CVE-2021-44768](https://insights.sbomify.com/CVE-2021-44768/): Delta Electronics CNCSoft Out-of-bounds Read (medium 6.1)
- [CVE-2021-44760](https://insights.sbomify.com/CVE-2021-44760/): WordPress WP-DownloadManager plugin <= 1.68.6 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2021-44759](https://insights.sbomify.com/CVE-2021-44759/): Improper authentication vulnerability in TLS origin verification (high 8.1)
- [CVE-2021-44758](https://insights.sbomify.com/CVE-2021-44758/): Null dereference in heimdal project:heimdal (high 7.5)
- [CVE-2021-44757](https://insights.sbomify.com/CVE-2021-44757/): Auth bypass in zohocorp:manageengine desktop central (critical 9.1)
- [CVE-2021-44751](https://insights.sbomify.com/CVE-2021-44751/): F-Secure SAFE Browser vulnerable to USSD attacks (medium 4.3)
- [CVE-2021-44750](https://insights.sbomify.com/CVE-2021-44750/): Arbitrary Code Execution (medium 6.4)
- [CVE-2021-44749](https://insights.sbomify.com/CVE-2021-44749/): Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser Protection for Android (medium 5.5)
- [CVE-2021-44748](https://insights.sbomify.com/CVE-2021-44748/): Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser for Android (medium 5.5)
- [CVE-2021-44747](https://insights.sbomify.com/CVE-2021-44747/): Denial-of-Service (DoS) Vulnerability (medium 4.6)
- [CVE-2021-44746](https://insights.sbomify.com/CVE-2021-44746/): Information disclosure in nec:univerge dt800 data maintenance tool (medium 5.3)
- [CVE-2021-44743](https://insights.sbomify.com/CVE-2021-44743/): Adobe Bridge JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-44742](https://insights.sbomify.com/CVE-2021-44742/): Adobe Reader Out-of-bounds Read Remote Code Execution Vulnerability (low 3.3)
- [CVE-2021-44741](https://insights.sbomify.com/CVE-2021-44741/): Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service (low 3.3)
- [CVE-2021-44740](https://insights.sbomify.com/CVE-2021-44740/): Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service (low 3.3)
- [CVE-2021-4474](https://insights.sbomify.com/CVE-2021-4474/): Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access (medium 6.9)
- [CVE-2021-44739](https://insights.sbomify.com/CVE-2021-44739/): Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Auth leak vulnerability (low 3.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/65/