# Vulnerabilities published in 2021


- [CVE-2021-44599](https://insights.sbomify.com/CVE-2021-44599/): SQL injection in online enrollment management system project:online enrollment management system (high 7.5)
- [CVE-2021-44598](https://insights.sbomify.com/CVE-2021-44598/): Cross-site scripting in attendance management system project:attendance management system (medium 6.1)
- [CVE-2021-44596](https://insights.sbomify.com/CVE-2021-44596/): Missing authorization in wondershare:dr.fone (critical 9.8)
- [CVE-2021-44595](https://insights.sbomify.com/CVE-2021-44595/): Missing authorization in wondershare:dr.fone (high 8.8)
- [CVE-2021-44593](https://insights.sbomify.com/CVE-2021-44593/): SQL injection in simple college website project:simple college website (high 8.1)
- [CVE-2021-44591](https://insights.sbomify.com/CVE-2021-44591/): Denial of service in libming:libming (medium 6.5)
- [CVE-2021-44590](https://insights.sbomify.com/CVE-2021-44590/): Denial of service in libming:libming (medium 6.5)
- [CVE-2021-4459](https://insights.sbomify.com/CVE-2021-4459/): SMA: Directory Traversal in Sunny Boy <3.10.27.R (medium 6.5)
- [CVE-2021-44586](https://insights.sbomify.com/CVE-2021-44586/): Path traversal in dst-admin project:dst-admin (high 7.5)
- [CVE-2021-44585](https://insights.sbomify.com/CVE-2021-44585/): Cross-site Scripting in jeecg-boot (medium 6.1)
- [CVE-2021-44584](https://insights.sbomify.com/CVE-2021-44584/): Cross-site scripting in emlog:emlog (medium 6.1)
- [CVE-2021-44582](https://insights.sbomify.com/CVE-2021-44582/): Privilege escalation in money transfer management system project:money transfer management system (high 8.8)
- [CVE-2021-44581](https://insights.sbomify.com/CVE-2021-44581/): SQL injection in kreado:kreasfero (high 7.5)
- [CVE-2021-4458](https://insights.sbomify.com/CVE-2021-4458/): Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL Injection (medium 5.9)
- [CVE-2021-4457](https://insights.sbomify.com/CVE-2021-4457/): ZoomSounds < 6.05 - Unauthenticated Arbitrary File Upload (critical 9.1)
- [CVE-2021-44568](https://insights.sbomify.com/CVE-2021-44568/): Memory corruption in opensuse:libsolv (medium 6.5)
- [CVE-2021-44567](https://insights.sbomify.com/CVE-2021-44567/): SQL injection in francoisjacquet/rosariosis (critical 9.8)
- [CVE-2021-44566](https://insights.sbomify.com/CVE-2021-44566/): Cross site scripting in francoisjacquet/rosariosis (medium 5.4)
- [CVE-2021-44565](https://insights.sbomify.com/CVE-2021-44565/): Cross site scripting in francoisjacquet/rosariosis (medium 5.4)
- [CVE-2021-44564](https://insights.sbomify.com/CVE-2021-44564/): Weak cryptography in kalkitech:sync2000-m1 firmware (high 8.1)
- [CVE-2021-4456](https://insights.sbomify.com/CVE-2021-4456/): Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact (medium 6.5)
- [CVE-2021-44557](https://insights.sbomify.com/CVE-2021-44557/): XML external entity in kb:multiner (critical 9.1)
- [CVE-2021-44556](https://insights.sbomify.com/CVE-2021-44556/): XML external entity in kb:digger (critical 9.1)
- [CVE-2021-44554](https://insights.sbomify.com/CVE-2021-44554/): Information disclosure in cybelesoft:thinfinity virtualui (medium 5.3)
- [CVE-2021-44550](https://insights.sbomify.com/CVE-2021-44550/): Access Control vulnerability within CoreNLP (critical 9.8)
- [CVE-2021-4455](https://insights.sbomify.com/CVE-2021-4455/): Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2021-44549](https://insights.sbomify.com/CVE-2021-44549/): SMTPS server hostname not checked when making TLS connection to SMTPS server (high 7.4)
- [CVE-2021-44548](https://insights.sbomify.com/CVE-2021-44548/): Apache Solr information disclosure vulnerability through DataImportHandler (critical 9.8)
- [CVE-2021-44547](https://insights.sbomify.com/CVE-2021-44547/): Privilege escalation in Odoo Community (high 8.7)
- [CVE-2021-44545](https://insights.sbomify.com/CVE-2021-44545/): Denial of service in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products (medium 6.5)
- [CVE-2021-44544](https://insights.sbomify.com/CVE-2021-44544/): Delta Electronics DIAEnergie (Update A) (high 7.5)
- [CVE-2021-44543](https://insights.sbomify.com/CVE-2021-44543/): Cross-site scripting in privoxy (medium 6.1)
- [CVE-2021-44542](https://insights.sbomify.com/CVE-2021-44542/): Denial of service in Privoxy (high 7.5)
- [CVE-2021-44541](https://insights.sbomify.com/CVE-2021-44541/): Denial of service in Privoxy (high 7.5)
- [CVE-2021-44540](https://insights.sbomify.com/CVE-2021-44540/): Denial of service in Privoxy (high 7.5)
- [CVE-2021-4454](https://insights.sbomify.com/CVE-2021-4454/): can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate (high 7.5)
- [CVE-2021-44538](https://insights.sbomify.com/CVE-2021-44538/): Memory corruption in cinny project:cinny (critical 9.8)
- [CVE-2021-44537](https://insights.sbomify.com/CVE-2021-44537/): Code injection in fedoraproject:fedora (high 7.8)
- [CVE-2021-44534](https://insights.sbomify.com/CVE-2021-44534/): Path traversal in ExpressionEngine (medium 6.5)
- [CVE-2021-44533](https://insights.sbomify.com/CVE-2021-44533/): Security feature bypass in Node (medium 5.3)
- [CVE-2021-44532](https://insights.sbomify.com/CVE-2021-44532/): Security feature bypass in Node (medium 5.3)
- [CVE-2021-44531](https://insights.sbomify.com/CVE-2021-44531/): Security feature bypass in Node (high 7.4)
- [CVE-2021-44530](https://insights.sbomify.com/CVE-2021-44530/): Code injection in UniFi Network application (critical 9.8)
- [CVE-2021-4453](https://insights.sbomify.com/CVE-2021-4453/): drm/amd/pm: fix a potential gpu_metrics_table memory leak (medium 5.5)
- [CVE-2021-44529](https://insights.sbomify.com/CVE-2021-44529/): Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability (critical 9.8, exploited in the wild)
- [CVE-2021-44528](https://insights.sbomify.com/CVE-2021-44528/): actionpack Open Redirect in Host Authorization Middleware (medium 6.1)
- [CVE-2021-44527](https://insights.sbomify.com/CVE-2021-44527/): Denial of service in UniFi Switches (medium 6.5)
- [CVE-2021-44526](https://insights.sbomify.com/CVE-2021-44526/): Auth bypass in zohocorp:manageengine servicedesk plus (critical 9.8)
- [CVE-2021-44525](https://insights.sbomify.com/CVE-2021-44525/): Auth bypass in zohocorp:manageengine pam360 (critical 9.8)
- [CVE-2021-44524](https://insights.sbomify.com/CVE-2021-44524/): Auth bypass in SiPass integrated V2.76 (critical 9.8)
- [CVE-2021-44523](https://insights.sbomify.com/CVE-2021-44523/): Missing authorization in SiPass integrated V2.76 (critical 9.1)
- [CVE-2021-44522](https://insights.sbomify.com/CVE-2021-44522/): Missing authorization in SiPass integrated V2.76 (high 7.5)
- [CVE-2021-44521](https://insights.sbomify.com/CVE-2021-44521/): Remote code execution for scripted UDFs (critical 9.1)
- [CVE-2021-44520](https://insights.sbomify.com/CVE-2021-44520/): Command injection in citrix:xenmobile server (high 8.8)
- [CVE-2021-4452](https://insights.sbomify.com/CVE-2021-4452/): Google Language Translator <= 6.0.9 - Reflected Cross-Site Scripting (high 7.1)
- [CVE-2021-44519](https://insights.sbomify.com/CVE-2021-44519/): Path traversal in citrix:xenmobile server (high 8.8)
- [CVE-2021-44518](https://insights.sbomify.com/CVE-2021-44518/): Weak cryptography in digipas:egeetouch manager (medium 6.8)
- [CVE-2021-44515](https://insights.sbomify.com/CVE-2021-44515/): Zoho Desktop Central Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2021-44514](https://insights.sbomify.com/CVE-2021-44514/): Auth bypass in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2021-44513](https://insights.sbomify.com/CVE-2021-44513/): Race condition in tmate:tmate-ssh-server (high 7.0)
- [CVE-2021-44512](https://insights.sbomify.com/CVE-2021-44512/): Misconfiguration in tmate:tmate-ssh-server (high 7.0)
- [CVE-2021-44510](https://insights.sbomify.com/CVE-2021-44510/): Denial of service in fisglobal:gt.m (high 7.5)
- [CVE-2021-4451](https://insights.sbomify.com/CVE-2021-4451/): NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization (medium 6.6)
- [CVE-2021-44509](https://insights.sbomify.com/CVE-2021-44509/): Integer overflow in fisglobal:gt.m (high 7.5)
- [CVE-2021-44508](https://insights.sbomify.com/CVE-2021-44508/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44507](https://insights.sbomify.com/CVE-2021-44507/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44506](https://insights.sbomify.com/CVE-2021-44506/): Null dereference in yottadb:gt.m (high 7.5)
- [CVE-2021-44505](https://insights.sbomify.com/CVE-2021-44505/): Null dereference in yottadb:gt.m (high 7.5)
- [CVE-2021-44504](https://insights.sbomify.com/CVE-2021-44504/): Integer overflow in fisglobal:gt.m (high 7.5)
- [CVE-2021-44503](https://insights.sbomify.com/CVE-2021-44503/): Memory corruption in fisglobal:gt.m (high 7.5)
- [CVE-2021-44502](https://insights.sbomify.com/CVE-2021-44502/): Denial of service in fisglobal:gt.m (high 7.5)
- [CVE-2021-44501](https://insights.sbomify.com/CVE-2021-44501/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44500](https://insights.sbomify.com/CVE-2021-44500/): Denial of service in fisglobal:gt.m (high 7.5)
- [CVE-2021-4450](https://insights.sbomify.com/CVE-2021-4450/): Post Grid <= 2.1.12 - Contributor+ SQL Injection (high 8.8)
- [CVE-2021-44499](https://insights.sbomify.com/CVE-2021-44499/): Integer overflow in fisglobal:gt.m (high 7.5)
- [CVE-2021-44498](https://insights.sbomify.com/CVE-2021-44498/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44497](https://insights.sbomify.com/CVE-2021-44497/): Use after free in fisglobal:gt.m (high 7.5)
- [CVE-2021-44496](https://insights.sbomify.com/CVE-2021-44496/): Memory corruption in fisglobal:gt.m (critical 9.8)
- [CVE-2021-44495](https://insights.sbomify.com/CVE-2021-44495/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44494](https://insights.sbomify.com/CVE-2021-44494/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44493](https://insights.sbomify.com/CVE-2021-44493/): Integer overflow in fisglobal:gt.m (high 7.5)
- [CVE-2021-44492](https://insights.sbomify.com/CVE-2021-44492/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44491](https://insights.sbomify.com/CVE-2021-44491/): Denial of service in fisglobal:gt.m (high 7.5)
- [CVE-2021-44490](https://insights.sbomify.com/CVE-2021-44490/): Denial of service in fisglobal:gt.m (high 7.5)
- [CVE-2021-4449](https://insights.sbomify.com/CVE-2021-4449/): ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2021-44489](https://insights.sbomify.com/CVE-2021-44489/): Integer overflow in fisglobal:gt.m (high 7.5)
- [CVE-2021-44488](https://insights.sbomify.com/CVE-2021-44488/): Memory corruption in fisglobal:gt.m (critical 9.1)
- [CVE-2021-44487](https://insights.sbomify.com/CVE-2021-44487/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44486](https://insights.sbomify.com/CVE-2021-44486/): Memory corruption in fisglobal:gt.m (critical 9.8)
- [CVE-2021-44485](https://insights.sbomify.com/CVE-2021-44485/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44484](https://insights.sbomify.com/CVE-2021-44484/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44483](https://insights.sbomify.com/CVE-2021-44483/): Denial of service in fisglobal:gt.m (high 7.5)
- [CVE-2021-44482](https://insights.sbomify.com/CVE-2021-44482/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44481](https://insights.sbomify.com/CVE-2021-44481/): Null dereference in fisglobal:gt.m (high 7.5)
- [CVE-2021-44480](https://insights.sbomify.com/CVE-2021-44480/): Hardcoded credentials in wokkalokka:wokka watch q50 firmware (high 8.1)
- [CVE-2021-4448](https://insights.sbomify.com/CVE-2021-4448/): Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization (high 7.3)
- [CVE-2021-44479](https://insights.sbomify.com/CVE-2021-44479/): Memory corruption in nxp:kinetis k82 firmware (medium 6.1)
- [CVE-2021-44478](https://insights.sbomify.com/CVE-2021-44478/): Cross-site scripting in Polarion ALM (medium 6.1)
- [CVE-2021-44477](https://insights.sbomify.com/CVE-2021-44477/): GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference (high 7.5)
- [CVE-2021-44476](https://insights.sbomify.com/CVE-2021-44476/): Security feature bypass in Odoo Community (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/67/