# Vulnerabilities published in 2021


- [CVE-2021-4409](https://insights.sbomify.com/CVE-2021-4409/): WooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44088](https://insights.sbomify.com/CVE-2021-44088/): SQL injection in attendance and payroll system project:attendance and payroll system (critical 9.8)
- [CVE-2021-44087](https://insights.sbomify.com/CVE-2021-44087/): File upload in attendance and payroll system project:attendance and payroll system (critical 9.8)
- [CVE-2021-44082](https://insights.sbomify.com/CVE-2021-44082/): Cross-site scripting in textpattern:textpattern (high 8.3)
- [CVE-2021-44081](https://insights.sbomify.com/CVE-2021-44081/): Memory corruption in open5gs:open5gs (high 7.5)
- [CVE-2021-44080](https://insights.sbomify.com/CVE-2021-44080/): Command injection in sercomm:h500s firmware (high 7.2)
- [CVE-2021-4408](https://insights.sbomify.com/CVE-2021-4408/): DW Question & Answer <= 1.5.8 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44079](https://insights.sbomify.com/CVE-2021-44079/): Command injection in wazuh:wazuh (critical 9.8)
- [CVE-2021-44078](https://insights.sbomify.com/CVE-2021-44078/): Memory corruption in unicorn-engine:unicorn engine (high 8.1)
- [CVE-2021-44077](https://insights.sbomify.com/CVE-2021-44077/): Zoho ManageEngine ServiceDesk Plus Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2021-44076](https://insights.sbomify.com/CVE-2021-44076/): Cross-site scripting in crushftp:crushftp (medium 4.8)
- [CVE-2021-4407](https://insights.sbomify.com/CVE-2021-4407/): Custom Banners <= 3.2.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-4406](https://insights.sbomify.com/CVE-2021-4406/): Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others (critical 9.1)
- [CVE-2021-44057](https://insights.sbomify.com/CVE-2021-44057/): Improper authentication in Photo Station (high 7.1)
- [CVE-2021-44056](https://insights.sbomify.com/CVE-2021-44056/): Improper authentication in Video Station (high 7.1)
- [CVE-2021-44055](https://insights.sbomify.com/CVE-2021-44055/): Information leakage in Video Station (medium 5.3)
- [CVE-2021-44054](https://insights.sbomify.com/CVE-2021-44054/): Open redirect (medium 4.3)
- [CVE-2021-44053](https://insights.sbomify.com/CVE-2021-44053/): Reflected XSS (medium 5.7)
- [CVE-2021-44052](https://insights.sbomify.com/CVE-2021-44052/): Arbitrary file read (medium 6.5)
- [CVE-2021-44051](https://insights.sbomify.com/CVE-2021-44051/): Command injection (high 8.8)
- [CVE-2021-44050](https://insights.sbomify.com/CVE-2021-44050/): SQL injection in CA Network Flow Analysis (NFA) (medium 6.5)
- [CVE-2021-4405](https://insights.sbomify.com/CVE-2021-4405/): ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44049](https://insights.sbomify.com/CVE-2021-44049/): Privilege escalation in cyberark:endpoint privilege manager (high 7.8)
- [CVE-2021-44048](https://insights.sbomify.com/CVE-2021-44048/): Memory corruption in opendesign:drawings explorer (high 7.8)
- [CVE-2021-44047](https://insights.sbomify.com/CVE-2021-44047/): Use after free in opendesign:drawings sdk (high 7.8)
- [CVE-2021-44046](https://insights.sbomify.com/CVE-2021-44046/): Memory corruption in opendesign:prc sdk (high 7.8)
- [CVE-2021-44045](https://insights.sbomify.com/CVE-2021-44045/): Memory corruption in opendesign:drawings sdk (high 7.8)
- [CVE-2021-44044](https://insights.sbomify.com/CVE-2021-44044/): Memory corruption in opendesign:drawings sdk (high 7.8)
- [CVE-2021-44043](https://insights.sbomify.com/CVE-2021-44043/): Cross-site scripting in uipath:app studio (medium 5.4)
- [CVE-2021-44042](https://insights.sbomify.com/CVE-2021-44042/): Cross-site scripting in uipath:assistant (critical 9.8)
- [CVE-2021-44041](https://insights.sbomify.com/CVE-2021-44041/): Code injection in uipath:assistant (critical 9.8)
- [CVE-2021-44040](https://insights.sbomify.com/CVE-2021-44040/): HTTP request line fuzzing attacks (high 7.5)
- [CVE-2021-4404](https://insights.sbomify.com/CVE-2021-4404/): Event Espresso 4 Decaf <= 4.10.11 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44038](https://insights.sbomify.com/CVE-2021-44038/): Privilege escalation in quagga:quagga (high 7.8)
- [CVE-2021-44037](https://insights.sbomify.com/CVE-2021-44037/): Business logic in teampasswordmanager:team password manager (high 7.5)
- [CVE-2021-44036](https://insights.sbomify.com/CVE-2021-44036/): Cross-site request forgery in teampasswordmanager:team password manager (high 8.8)
- [CVE-2021-44035](https://insights.sbomify.com/CVE-2021-44035/): File upload in wolterskluwer:teammate audit management (medium 4.4)
- [CVE-2021-44033](https://insights.sbomify.com/CVE-2021-44033/): Security feature bypass in ionic:identity vault (medium 6.8)
- [CVE-2021-44032](https://insights.sbomify.com/CVE-2021-44032/): Auth bypass in tp-link:omada software controller (high 7.5)
- [CVE-2021-44031](https://insights.sbomify.com/CVE-2021-44031/): File upload in quest:kace desktop authority (critical 9.8)
- [CVE-2021-44030](https://insights.sbomify.com/CVE-2021-44030/): Cross-site scripting in quest:kace desktop authority (medium 6.1)
- [CVE-2021-4403](https://insights.sbomify.com/CVE-2021-4403/): Remove Schema <= 1.5 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44029](https://insights.sbomify.com/CVE-2021-44029/): Deserialization in quest:kace desktop authority (critical 9.8)
- [CVE-2021-44028](https://insights.sbomify.com/CVE-2021-44028/): XML external entity in quest:kace desktop authority (medium 5.5)
- [CVE-2021-44026](https://insights.sbomify.com/CVE-2021-44026/): Roundcube Webmail SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2021-44025](https://insights.sbomify.com/CVE-2021-44025/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-44024](https://insights.sbomify.com/CVE-2021-44024/): Path traversal in Trend Micro Apex One (high 7.1)
- [CVE-2021-44023](https://insights.sbomify.com/CVE-2021-44023/): Path traversal in Trend Micro Security (Consumer) (high 7.1)
- [CVE-2021-44022](https://insights.sbomify.com/CVE-2021-44022/): Denial of service in Trend Micro Apex One (medium 5.5)
- [CVE-2021-44021](https://insights.sbomify.com/CVE-2021-44021/): Privilege escalation in Trend Micro Worry-Free Business Security (high 7.8)
- [CVE-2021-44020](https://insights.sbomify.com/CVE-2021-44020/): Privilege escalation in Trend Micro Worry-Free Business Security (high 7.8)
- [CVE-2021-4402](https://insights.sbomify.com/CVE-2021-4402/): Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-44019](https://insights.sbomify.com/CVE-2021-44019/): Privilege escalation in Trend Micro Worry-Free Business Security (high 7.8)
- [CVE-2021-44018](https://insights.sbomify.com/CVE-2021-44018/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-44017](https://insights.sbomify.com/CVE-2021-44017/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44016](https://insights.sbomify.com/CVE-2021-44016/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-44015](https://insights.sbomify.com/CVE-2021-44015/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44014](https://insights.sbomify.com/CVE-2021-44014/): Use after free in JT Open (high 7.8)
- [CVE-2021-44013](https://insights.sbomify.com/CVE-2021-44013/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-44012](https://insights.sbomify.com/CVE-2021-44012/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44011](https://insights.sbomify.com/CVE-2021-44011/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44010](https://insights.sbomify.com/CVE-2021-44010/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-4401](https://insights.sbomify.com/CVE-2021-4401/): Style Kits <= 1.8.0 - Cross-Site Request Forgery Bypass (high 8.8)
- [CVE-2021-44009](https://insights.sbomify.com/CVE-2021-44009/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44008](https://insights.sbomify.com/CVE-2021-44008/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44007](https://insights.sbomify.com/CVE-2021-44007/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44006](https://insights.sbomify.com/CVE-2021-44006/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-44005](https://insights.sbomify.com/CVE-2021-44005/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-44004](https://insights.sbomify.com/CVE-2021-44004/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44003](https://insights.sbomify.com/CVE-2021-44003/): Memory corruption in JT2Go (medium 5.5)
- [CVE-2021-44002](https://insights.sbomify.com/CVE-2021-44002/): Memory corruption in JT Open (high 7.8)
- [CVE-2021-44001](https://insights.sbomify.com/CVE-2021-44001/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-44000](https://insights.sbomify.com/CVE-2021-44000/): Memory corruption in JT2Go (high 7.8)
- [CVE-2021-4400](https://insights.sbomify.com/CVE-2021-4400/): Better Search <= 2.5.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43999](https://insights.sbomify.com/CVE-2021-43999/): Improper validation of SAML responses (high 8.8)
- [CVE-2021-43998](https://insights.sbomify.com/CVE-2021-43998/): HashiCorp Vault Incorrect Permission Assignment for Critical Resource (medium 6.5)
- [CVE-2021-43997](https://insights.sbomify.com/CVE-2021-43997/): Privilege escalation in amazon:freertos (high 7.8)
- [CVE-2021-43996](https://insights.sbomify.com/CVE-2021-43996/): Incorrect Access Control in Ignition (critical 9.8)
- [CVE-2021-43991](https://insights.sbomify.com/CVE-2021-43991/): Persistent XSS via Avatar Upload in Kentico Xperience CMS (medium 6.8)
- [CVE-2021-43990](https://insights.sbomify.com/CVE-2021-43990/): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (medium 6.1)
- [CVE-2021-4399](https://insights.sbomify.com/CVE-2021-4399/): Edwiser Bridge <= 2.0.6 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43989](https://insights.sbomify.com/CVE-2021-43989/): mySCADA myPRO (high 7.5)
- [CVE-2021-43988](https://insights.sbomify.com/CVE-2021-43988/): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (medium 6.1)
- [CVE-2021-43987](https://insights.sbomify.com/CVE-2021-43987/): mySCADA myPRO (critical 9.8)
- [CVE-2021-43986](https://insights.sbomify.com/CVE-2021-43986/): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (medium 6.0)
- [CVE-2021-43985](https://insights.sbomify.com/CVE-2021-43985/): mySCADA myPRO (critical 9.1)
- [CVE-2021-43984](https://insights.sbomify.com/CVE-2021-43984/): mySCADA myPRO (critical 10.0)
- [CVE-2021-43983](https://insights.sbomify.com/CVE-2021-43983/): WECON LeviStudioU (high 7.8)
- [CVE-2021-43982](https://insights.sbomify.com/CVE-2021-43982/): Delta Electronics CNCSoft (high 7.8)
- [CVE-2021-43981](https://insights.sbomify.com/CVE-2021-43981/): mySCADA myPRO (critical 10.0)
- [CVE-2021-43980](https://insights.sbomify.com/CVE-2021-43980/): Apache Tomcat: Information disclosure (low 3.7)
- [CVE-2021-4398](https://insights.sbomify.com/CVE-2021-4398/): Amministrazione Trasparente <= 7.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43979](https://insights.sbomify.com/CVE-2021-43979/): Race condition in openpolicyagent:gatekeeper (medium 5.3)
- [CVE-2021-43978](https://insights.sbomify.com/CVE-2021-43978/): Hardcoded credentials in allegro:allegro (high 7.1)
- [CVE-2021-43977](https://insights.sbomify.com/CVE-2021-43977/): Cross-site scripting in smartertools:smartermail (medium 6.1)
- [CVE-2021-43976](https://insights.sbomify.com/CVE-2021-43976/): Denial of service in debian:debian linux (medium 4.6)
- [CVE-2021-43975](https://insights.sbomify.com/CVE-2021-43975/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2021-43974](https://insights.sbomify.com/CVE-2021-43974/): Auth bypass in sysaid:itil (medium 5.3)
- [CVE-2021-43973](https://insights.sbomify.com/CVE-2021-43973/): File upload in sysaid:sysaid (high 8.8)
- [CVE-2021-43972](https://insights.sbomify.com/CVE-2021-43972/): Path traversal in sysaid:sysaid (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/71/