# Vulnerabilities published in 2021


- [CVE-2021-4421](https://insights.sbomify.com/CVE-2021-4421/): Advanced Popups <= 1.1.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44209](https://insights.sbomify.com/CVE-2021-44209/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2021-44208](https://insights.sbomify.com/CVE-2021-44208/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2021-44207](https://insights.sbomify.com/CVE-2021-44207/): Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability (high 8.1, exploited in the wild)
- [CVE-2021-44206](https://insights.sbomify.com/CVE-2021-44206/): Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service (high 7.3)
- [CVE-2021-44205](https://insights.sbomify.com/CVE-2021-44205/): Local privilege escalation due to DLL hijacking vulnerability (high 7.3)
- [CVE-2021-44204](https://insights.sbomify.com/CVE-2021-44204/): Local privilege escalation via named pipe due to improper access control checks (high 7.8)
- [CVE-2021-44203](https://insights.sbomify.com/CVE-2021-44203/): Stored cross-site scripting (XSS) was possible in protection plan details (medium 5.4)
- [CVE-2021-44202](https://insights.sbomify.com/CVE-2021-44202/): Stored cross-site scripting (XSS) was possible in activity details (medium 5.4)
- [CVE-2021-44201](https://insights.sbomify.com/CVE-2021-44201/): Cross-site scripting (XSS) was possible in notification pop-ups (medium 6.1)
- [CVE-2021-44200](https://insights.sbomify.com/CVE-2021-44200/): Self cross-site scripting (XSS) was possible on devices page (medium 5.4)
- [CVE-2021-4420](https://insights.sbomify.com/CVE-2021-4420/): Sell Media <= 2.5.5 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44199](https://insights.sbomify.com/CVE-2021-44199/): DLL hijacking could lead to denial of service (medium 5.5)
- [CVE-2021-44198](https://insights.sbomify.com/CVE-2021-44198/): DLL hijacking could lead to local privilege escalation (high 7.8)
- [CVE-2021-44197](https://insights.sbomify.com/CVE-2021-44197/): XSS in UBIT Information Technologies Student Information Management System (medium 6.1)
- [CVE-2021-44196](https://insights.sbomify.com/CVE-2021-44196/): XSS in UBIT Information Technologies Student Information Management System (medium 6.1)
- [CVE-2021-44195](https://insights.sbomify.com/CVE-2021-44195/): Adobe After Effects JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44194](https://insights.sbomify.com/CVE-2021-44194/): Adobe After Effects 3GP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44193](https://insights.sbomify.com/CVE-2021-44193/): Adobe After Effects MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44192](https://insights.sbomify.com/CVE-2021-44192/): Adobe After Effects MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44191](https://insights.sbomify.com/CVE-2021-44191/): Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44190](https://insights.sbomify.com/CVE-2021-44190/): Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-4419](https://insights.sbomify.com/CVE-2021-4419/): WP-Backgrounds Lite <= 2.3 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44189](https://insights.sbomify.com/CVE-2021-44189/): Adobe After Effects JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44188](https://insights.sbomify.com/CVE-2021-44188/): Adobe After Effects 3GP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-44187](https://insights.sbomify.com/CVE-2021-44187/): Adobe Bridge SGI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44186](https://insights.sbomify.com/CVE-2021-44186/): Adobe Bridge SGI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44185](https://insights.sbomify.com/CVE-2021-44185/): Adobe Bridge RGB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44183](https://insights.sbomify.com/CVE-2021-44183/): Adobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44182](https://insights.sbomify.com/CVE-2021-44182/): Adobe Dimension SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-44181](https://insights.sbomify.com/CVE-2021-44181/): Adobe Dimension GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-44180](https://insights.sbomify.com/CVE-2021-44180/): Adobe Dimension PCX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-4418](https://insights.sbomify.com/CVE-2021-4418/): Custom CSS, JS & PHP <= 2.0.7 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44179](https://insights.sbomify.com/CVE-2021-44179/): Adobe Dimension GIF File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-44178](https://insights.sbomify.com/CVE-2021-44178/): Adobe Experience Manager Reflected XSS in /bin/wcm/contentfinder/page/view.html (medium 5.4)
- [CVE-2021-44177](https://insights.sbomify.com/CVE-2021-44177/): Adobe Experience Manager Stored XSS in user name parameter in the package manager (high 8.1)
- [CVE-2021-44176](https://insights.sbomify.com/CVE-2021-44176/): Adobe Experience Manager Stored XSS in workflow Stages parameter (high 8.1)
- [CVE-2021-44172](https://insights.sbomify.com/CVE-2021-44172/): Information disclosure in FortiClientEMS (low 3.6)
- [CVE-2021-44171](https://insights.sbomify.com/CVE-2021-44171/): Command injection in Fortinet FortiOS (critical 9.0)
- [CVE-2021-44170](https://insights.sbomify.com/CVE-2021-44170/): Memory corruption in Fortinet FortiProxy, FortiOS (medium 6.7)
- [CVE-2021-4417](https://insights.sbomify.com/CVE-2021-4417/): Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass (medium 5.4)
- [CVE-2021-44169](https://insights.sbomify.com/CVE-2021-44169/): Privilege escalation in Fortinet FortiClientWindows (high 8.2)
- [CVE-2021-44168](https://insights.sbomify.com/CVE-2021-44168/): Fortinet FortiOS Arbitrary File Download (low 3.3, exploited in the wild)
- [CVE-2021-44167](https://insights.sbomify.com/CVE-2021-44167/): Misconfiguration in Fortinet FortiClientLinux (medium 6.8)
- [CVE-2021-44166](https://insights.sbomify.com/CVE-2021-44166/): Auth bypass in Fortinet FortiTokenAndroid (medium 4.1)
- [CVE-2021-44165](https://insights.sbomify.com/CVE-2021-44165/): Memory corruption in POWER METER SICAM Q100 (high 7.2)
- [CVE-2021-44164](https://insights.sbomify.com/CVE-2021-44164/): Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload (critical 9.8)
- [CVE-2021-44163](https://insights.sbomify.com/CVE-2021-44163/): Chain Sea Information Integration Co., Ltd ai chatbot system - Reflected XSS (medium 6.1)
- [CVE-2021-44162](https://insights.sbomify.com/CVE-2021-44162/): Chain Sea Information Integration Co., Ltd ai chatbot system - Path Traversal (high 7.5)
- [CVE-2021-44161](https://insights.sbomify.com/CVE-2021-44161/): Changing Information Technology Inc. MOTP(Mobile One Time Password) - SQL Injection (high 8.8)
- [CVE-2021-44160](https://insights.sbomify.com/CVE-2021-44160/): Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key (high 7.3)
- [CVE-2021-4416](https://insights.sbomify.com/CVE-2021-4416/): wp-mpdf <= 3.5.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44159](https://insights.sbomify.com/CVE-2021-44159/): 4MOSAn GCB Doctor - Unrestricted Upload of File (critical 9.8)
- [CVE-2021-44158](https://insights.sbomify.com/CVE-2021-44158/): ASUS RT-AX56U Router - Stack-based buffer overflow (high 8.0)
- [CVE-2021-44155](https://insights.sbomify.com/CVE-2021-44155/): Information disclosure in reprisesoftware:reprise license manager (medium 5.3)
- [CVE-2021-44154](https://insights.sbomify.com/CVE-2021-44154/): Memory corruption in reprisesoftware:reprise license manager (high 7.2)
- [CVE-2021-44153](https://insights.sbomify.com/CVE-2021-44153/): Privilege escalation in reprisesoftware:reprise license manager (high 7.2)
- [CVE-2021-44152](https://insights.sbomify.com/CVE-2021-44152/): Missing authorization in reprisesoftware:reprise license manager (critical 9.8)
- [CVE-2021-44151](https://insights.sbomify.com/CVE-2021-44151/): Weak cryptography in reprisesoftware:reprise license manager (high 7.5)
- [CVE-2021-44150](https://insights.sbomify.com/CVE-2021-44150/): Weak cryptography in transloadit:tusdotnet (high 7.5)
- [CVE-2021-4415](https://insights.sbomify.com/CVE-2021-4415/): Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44149](https://insights.sbomify.com/CVE-2021-44149/): Security feature bypass in trustedfirmware:op-tee (high 7.8)
- [CVE-2021-44148](https://insights.sbomify.com/CVE-2021-44148/): Cross-site scripting in gl-inet:gl-ar150 firmware (medium 6.1)
- [CVE-2021-44147](https://insights.sbomify.com/CVE-2021-44147/): XML external entity in claris:filemaker pro (medium 5.5)
- [CVE-2021-44145](https://insights.sbomify.com/CVE-2021-44145/): Apache NiFi information disclosure by XXE (medium 6.5)
- [CVE-2021-44144](https://insights.sbomify.com/CVE-2021-44144/): Asterix Heap-based Buffer Overflow (critical 9.1)
- [CVE-2021-44143](https://insights.sbomify.com/CVE-2021-44143/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2021-44142](https://insights.sbomify.com/CVE-2021-44142/): Memory corruption in Samba (high 8.8)
- [CVE-2021-44141](https://insights.sbomify.com/CVE-2021-44141/): Information disclosure in Samba (medium 4.3)
- [CVE-2021-44140](https://insights.sbomify.com/CVE-2021-44140/): Arbitrary file deletion on logout (critical 9.1)
- [CVE-2021-4414](https://insights.sbomify.com/CVE-2021-4414/): Abandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44139](https://insights.sbomify.com/CVE-2021-44139/): Server-side request forgery in hashicorp:sentinel (high 7.5)
- [CVE-2021-44138](https://insights.sbomify.com/CVE-2021-44138/): Path Traversal in Caucho Resin (high 7.5)
- [CVE-2021-44135](https://insights.sbomify.com/CVE-2021-44135/): SQL injection in pagekit/pagekit (critical 9.8)
- [CVE-2021-44132](https://insights.sbomify.com/CVE-2021-44132/): Command injection in c-data onu4ferw project:c-data onu4ferw firmware (high 7.8)
- [CVE-2021-4413](https://insights.sbomify.com/CVE-2021-4413/): Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44127](https://insights.sbomify.com/CVE-2021-44127/): Command injection in dlink:dap-1360f1 firmware (critical 9.8)
- [CVE-2021-44124](https://insights.sbomify.com/CVE-2021-44124/): Path traversal in hiby:r3 pro firmware (high 7.5)
- [CVE-2021-44123](https://insights.sbomify.com/CVE-2021-44123/): File upload in spip:spip (high 8.8)
- [CVE-2021-44122](https://insights.sbomify.com/CVE-2021-44122/): Cross-site request forgery in spip:spip (high 8.8)
- [CVE-2021-44120](https://insights.sbomify.com/CVE-2021-44120/): Cross-site scripting in spip:spip (medium 5.4)
- [CVE-2021-4412](https://insights.sbomify.com/CVE-2021-4412/): WP Prayer <= 1.6.5 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44118](https://insights.sbomify.com/CVE-2021-44118/): Cross-site scripting in spip:spip (medium 5.4)
- [CVE-2021-44117](https://insights.sbomify.com/CVE-2021-44117/): Cross-site request forgery in thedaylightstudio:fuel cms (high 8.8)
- [CVE-2021-44116](https://insights.sbomify.com/CVE-2021-44116/): Cross-site Scripting in Anchor CMS (medium 6.1)
- [CVE-2021-44114](https://insights.sbomify.com/CVE-2021-44114/): Cross-site scripting in stock management system project:stock management system (medium 4.8)
- [CVE-2021-44111](https://insights.sbomify.com/CVE-2021-44111/): Path Traversal in S-Cart (medium 4.4)
- [CVE-2021-4411](https://insights.sbomify.com/CVE-2021-4411/): WP EasyPay – Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44109](https://insights.sbomify.com/CVE-2021-44109/): Memory corruption in open5gs:open5gs (high 7.5)
- [CVE-2021-44108](https://insights.sbomify.com/CVE-2021-44108/): Null dereference in open5gs:open5gs (high 7.5)
- [CVE-2021-4410](https://insights.sbomify.com/CVE-2021-4410/): Qtranslate Slug <= 1.1.18 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44098](https://insights.sbomify.com/CVE-2021-44098/): SQL injection in egavilanmedia:expense management system (critical 9.8)
- [CVE-2021-44097](https://insights.sbomify.com/CVE-2021-44097/): SQL injection in contact-form-with-messages-entry-management project:contact-form-with-messages-entry-management (critical 9.8)
- [CVE-2021-44096](https://insights.sbomify.com/CVE-2021-44096/): SQL injection in egavilanmedia:user registration and login system with admin panel (critical 9.8)
- [CVE-2021-44095](https://insights.sbomify.com/CVE-2021-44095/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2021-44094](https://insights.sbomify.com/CVE-2021-44094/): File upload in zrlog:zrlog (high 7.8)
- [CVE-2021-44093](https://insights.sbomify.com/CVE-2021-44093/): File upload in zrlog:zrlog (critical 9.8)
- [CVE-2021-44092](https://insights.sbomify.com/CVE-2021-44092/): SQL injection in code-projects:pharmacy management (critical 9.8)
- [CVE-2021-44091](https://insights.sbomify.com/CVE-2021-44091/): Cross-site scripting in multi restaurant table reservation system project:multi restaurant table reservation system (medium 5.4)
- [CVE-2021-44090](https://insights.sbomify.com/CVE-2021-44090/): SQL injection in sourcecodester online reviewer system project:sourcecodester online reviewer system (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/70/