# Vulnerabilities published in 2021


- [CVE-2021-44373](https://insights.sbomify.com/CVE-2021-44373/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44372](https://insights.sbomify.com/CVE-2021-44372/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44371](https://insights.sbomify.com/CVE-2021-44371/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44370](https://insights.sbomify.com/CVE-2021-44370/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-4437](https://insights.sbomify.com/CVE-2021-4437/): dbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redos (low 3.5)
- [CVE-2021-44369](https://insights.sbomify.com/CVE-2021-44369/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44368](https://insights.sbomify.com/CVE-2021-44368/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44367](https://insights.sbomify.com/CVE-2021-44367/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44366](https://insights.sbomify.com/CVE-2021-44366/): Denial of service in RLC-410W (high 8.6)
- [CVE-2021-44365](https://insights.sbomify.com/CVE-2021-44365/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44364](https://insights.sbomify.com/CVE-2021-44364/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44363](https://insights.sbomify.com/CVE-2021-44363/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44362](https://insights.sbomify.com/CVE-2021-44362/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44361](https://insights.sbomify.com/CVE-2021-44361/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44360](https://insights.sbomify.com/CVE-2021-44360/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-4436](https://insights.sbomify.com/CVE-2021-4436/): 3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2021-44359](https://insights.sbomify.com/CVE-2021-44359/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44358](https://insights.sbomify.com/CVE-2021-44358/): Denial of service in reolink:rlc-410w firmware (high 8.6)
- [CVE-2021-44357](https://insights.sbomify.com/CVE-2021-44357/): Denial of service in RLC-410W (high 8.6)
- [CVE-2021-44356](https://insights.sbomify.com/CVE-2021-44356/): Denial of service in RLC-410W (high 8.6)
- [CVE-2021-44355](https://insights.sbomify.com/CVE-2021-44355/): Denial of service in RLC-410W (high 8.6)
- [CVE-2021-44354](https://insights.sbomify.com/CVE-2021-44354/): Denial of service in RLC-410W (high 8.6)
- [CVE-2021-44352](https://insights.sbomify.com/CVE-2021-44352/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2021-44351](https://insights.sbomify.com/CVE-2021-44351/): Path traversal in naviwebs:navigate cms (high 7.5)
- [CVE-2021-44350](https://insights.sbomify.com/CVE-2021-44350/): ThinkPHP5 SQL Injection vulnerability (critical 9.8)
- [CVE-2021-4435](https://insights.sbomify.com/CVE-2021-4435/): Yarn: untrusted search path (high 7.7)
- [CVE-2021-44349](https://insights.sbomify.com/CVE-2021-44349/): SQL injection in yejiao:tuzicms (critical 9.8)
- [CVE-2021-44348](https://insights.sbomify.com/CVE-2021-44348/): SQL injection in yejiao:tuzicms (critical 9.8)
- [CVE-2021-44347](https://insights.sbomify.com/CVE-2021-44347/): SQL injection in yejiao:tuzicms (critical 9.8)
- [CVE-2021-44345](https://insights.sbomify.com/CVE-2021-44345/): SQL injection in wvti:one card integrated management system (high 7.5)
- [CVE-2021-44343](https://insights.sbomify.com/CVE-2021-44343/): Memory corruption in ok-file-formats project:ok-file-formats (high 7.8)
- [CVE-2021-44342](https://insights.sbomify.com/CVE-2021-44342/): Memory corruption in ok-file-formats project:ok-file-formats (high 7.8)
- [CVE-2021-44340](https://insights.sbomify.com/CVE-2021-44340/): Memory corruption in ok-file-formats project:ok-file-formats (high 7.8)
- [CVE-2021-4434](https://insights.sbomify.com/CVE-2021-4434/): Social Warfare <= 3.5.2 - Remote Code Execution (critical 10.0)
- [CVE-2021-44339](https://insights.sbomify.com/CVE-2021-44339/): Memory corruption in ok-file-formats project:ok-file-formats (high 7.8)
- [CVE-2021-44335](https://insights.sbomify.com/CVE-2021-44335/): Memory corruption in ok-file-formats project:ok-file-formats (high 7.8)
- [CVE-2021-44334](https://insights.sbomify.com/CVE-2021-44334/): Memory corruption in ok-file-formats project:ok-file-formats (high 7.8)
- [CVE-2021-44331](https://insights.sbomify.com/CVE-2021-44331/): Memory corruption in arm:adaptive scalable texture compression encoder (high 7.8)
- [CVE-2021-4433](https://insights.sbomify.com/CVE-2021-4433/): Karjasoft Sami HTTP Server HTTP HEAD Rrequest denial of service (medium 5.3)
- [CVE-2021-44321](https://insights.sbomify.com/CVE-2021-44321/): Cross-site request forgery in mini-inventory-and-sales-management-system project:mini-inventory-and-sales-management-system (medium 5.0)
- [CVE-2021-44320](https://insights.sbomify.com/CVE-2021-44320/): Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. (high 7.5)
- [CVE-2021-4432](https://insights.sbomify.com/CVE-2021-4432/): PCMan FTP Server USER Command denial of service (medium 5.3)
- [CVE-2021-44319](https://insights.sbomify.com/CVE-2021-44319/): Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. (high 7.5)
- [CVE-2021-44317](https://insights.sbomify.com/CVE-2021-44317/): Cross-site scripting in phpgurukul:bus pass management system (medium 5.4)
- [CVE-2021-44315](https://insights.sbomify.com/CVE-2021-44315/): Information disclosure in phpgurukul:bus pass management system (high 7.5)
- [CVE-2021-44312](https://insights.sbomify.com/CVE-2021-44312/): Cross-site request forgery in firmware analysis and comparison tool project:firmware analysis and comparison tool (high 8.8)
- [CVE-2021-44310](https://insights.sbomify.com/CVE-2021-44310/): Cross-site scripting in firmware analysis and comparison tool project:firmware analysis and comparison tool (medium 4.8)
- [CVE-2021-4431](https://insights.sbomify.com/CVE-2021-4431/): msyk FMDataAPI FMDataAPI_Sample.php cross site scripting (low 3.5)
- [CVE-2021-44302](https://insights.sbomify.com/CVE-2021-44302/): SQL injection in baicloud-cms project:baicloud-cms (high 8.8)
- [CVE-2021-4430](https://insights.sbomify.com/CVE-2021-4430/): Ortus Solutions ColdBox Elixir ENV Variable defaultConfig.js information disclosure (low 3.5)
- [CVE-2021-44299](https://insights.sbomify.com/CVE-2021-44299/): Cross-site scripting in naviwebs:navigate cms (medium 5.4)
- [CVE-2021-44283](https://insights.sbomify.com/CVE-2021-44283/): Memory corruption in shieldstore project:shieldstore (high 7.5)
- [CVE-2021-44280](https://insights.sbomify.com/CVE-2021-44280/): SQL injection in attendance management system project:attendance management system (critical 9.8)
- [CVE-2021-4428](https://insights.sbomify.com/CVE-2021-4428/): what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure (low 2.7)
- [CVE-2021-44279](https://insights.sbomify.com/CVE-2021-44279/): Cross-site Scripting in LibreNMS (medium 6.1)
- [CVE-2021-44278](https://insights.sbomify.com/CVE-2021-44278/): Path traversal in librenms/librenms (critical 9.8)
- [CVE-2021-44277](https://insights.sbomify.com/CVE-2021-44277/): Cross-site Scripting in LibreNMS (medium 6.1)
- [CVE-2021-44273](https://insights.sbomify.com/CVE-2021-44273/): Security feature bypass in e2bn:e2guardian (high 7.4)
- [CVE-2021-4427](https://insights.sbomify.com/CVE-2021-4427/): Vuukle Comments, Reactions, Share Bar, Revenue <= 3.4.31 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44269](https://insights.sbomify.com/CVE-2021-44269/): Memory corruption in fedoraproject:fedora (medium 5.5)
- [CVE-2021-44266](https://insights.sbomify.com/CVE-2021-44266/): Cross-site scripting in gunet:open eclass platform (medium 6.1)
- [CVE-2021-44263](https://insights.sbomify.com/CVE-2021-44263/): Cross-site scripting in gurock:testrail (medium 5.4)
- [CVE-2021-44262](https://insights.sbomify.com/CVE-2021-44262/): Missing authorization in netgear:mbr1517 firmware (high 7.5)
- [CVE-2021-44261](https://insights.sbomify.com/CVE-2021-44261/): Missing authorization in netgear:r6220 firmware (medium 5.3)
- [CVE-2021-44260](https://insights.sbomify.com/CVE-2021-44260/): Missing authorization in wavlink:wl-wn531g3 firmware (high 7.5)
- [CVE-2021-4426](https://insights.sbomify.com/CVE-2021-4426/): Absolute Reviews <= 1.0.8 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44259](https://insights.sbomify.com/CVE-2021-44259/): Auth bypass in wavlink:wl-wn531g3 firmware (critical 9.8)
- [CVE-2021-44255](https://insights.sbomify.com/CVE-2021-44255/): Unrestricted Upload of File with Dangerous Type in motionEye (high 7.2)
- [CVE-2021-4425](https://insights.sbomify.com/CVE-2021-4425/): Defender Security <= 2.4.6 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44249](https://insights.sbomify.com/CVE-2021-44249/): SQL injection in online motorcycle \(bike\) rental system project:online motorcycle \(bike\) rental system (critical 9.8)
- [CVE-2021-44247](https://insights.sbomify.com/CVE-2021-44247/): Command injection in totolink:a3100r firmware (critical 9.8)
- [CVE-2021-44246](https://insights.sbomify.com/CVE-2021-44246/): Memory corruption in totolink:a3100r firmware (high 7.5)
- [CVE-2021-44245](https://insights.sbomify.com/CVE-2021-44245/): SQL injection in covid 19 testing management system project:covid 19 testing management system (critical 9.8)
- [CVE-2021-44244](https://insights.sbomify.com/CVE-2021-44244/): SQL injection in sourcecodester logistic hub parcel\'s management system project:sourcecodester logistic hub parcel\'s management system (critical 9.8)
- [CVE-2021-4424](https://insights.sbomify.com/CVE-2021-4424/): Slider Hero <= 8.2.0 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44238](https://insights.sbomify.com/CVE-2021-44238/): Code injection in ayacms project:ayacms (high 7.2)
- [CVE-2021-44235](https://insights.sbomify.com/CVE-2021-44235/): Command injection in SAP NetWeaver AS ABAP (medium 6.7)
- [CVE-2021-44234](https://insights.sbomify.com/CVE-2021-44234/): Information disclosure in SAP Business One (medium 5.5)
- [CVE-2021-44233](https://insights.sbomify.com/CVE-2021-44233/): Missing authorization in SAP GRC Access Control (high 8.8)
- [CVE-2021-44232](https://insights.sbomify.com/CVE-2021-44232/): Path traversal in SAF-T Framework (high 7.7)
- [CVE-2021-44231](https://insights.sbomify.com/CVE-2021-44231/): Code injection in SAP ABAP Server & ABAP Platform (Translation Tools) (critical 9.8)
- [CVE-2021-44230](https://insights.sbomify.com/CVE-2021-44230/): Misconfiguration in portswigger:burp suite (medium 6.5)
- [CVE-2021-4423](https://insights.sbomify.com/CVE-2021-4423/): RAYS Grid <= 1.2.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44228](https://insights.sbomify.com/CVE-2021-44228/): Apache Log4j2 Remote Code Execution (critical 10.0, exploited in the wild)
- [CVE-2021-44227](https://insights.sbomify.com/CVE-2021-44227/): Cross Site Request Forgery in mailman (high 8.8)
- [CVE-2021-44226](https://insights.sbomify.com/CVE-2021-44226/): Privilege escalation in razer:synapse (high 7.3)
- [CVE-2021-44225](https://insights.sbomify.com/CVE-2021-44225/): Missing authorization in fedoraproject:fedora (medium 5.4)
- [CVE-2021-44224](https://insights.sbomify.com/CVE-2021-44224/): Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier (high 8.2)
- [CVE-2021-44223](https://insights.sbomify.com/CVE-2021-44223/): Supply chain in wordpress:wordpress (high 8.1)
- [CVE-2021-44222](https://insights.sbomify.com/CVE-2021-44222/): Missing authorization in SIMATIC eaSie Core Package (critical 9.1)
- [CVE-2021-44221](https://insights.sbomify.com/CVE-2021-44221/): Denial of service in SIMATIC eaSie Core Package (high 7.5)
- [CVE-2021-4422](https://insights.sbomify.com/CVE-2021-4422/): POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44219](https://insights.sbomify.com/CVE-2021-44219/): SQL injection in gin-vue-admin project:gin-vue-admin (critical 9.8)
- [CVE-2021-44217](https://insights.sbomify.com/CVE-2021-44217/): Cross-site Scripting in Ericsson CodeChecker (medium 6.1)
- [CVE-2021-44216](https://insights.sbomify.com/CVE-2021-44216/): Misconfiguration in northern.tech:cfengine (medium 5.5)
- [CVE-2021-44215](https://insights.sbomify.com/CVE-2021-44215/): Misconfiguration in northern.tech:cfengine (medium 5.5)
- [CVE-2021-44213](https://insights.sbomify.com/CVE-2021-44213/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2021-44212](https://insights.sbomify.com/CVE-2021-44212/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2021-44211](https://insights.sbomify.com/CVE-2021-44211/): Cross-site scripting in open-xchange:ox app suite (medium 5.4)
- [CVE-2021-44210](https://insights.sbomify.com/CVE-2021-44210/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/69/