# Vulnerabilities published in 2021


- [CVE-2021-43971](https://insights.sbomify.com/CVE-2021-43971/): SQL injection in sysaid:sysaid (high 8.8)
- [CVE-2021-43970](https://insights.sbomify.com/CVE-2021-43970/): File upload in quicklert:quicklert (high 8.8)
- [CVE-2021-4397](https://insights.sbomify.com/CVE-2021-4397/): Staff Directory Plugin <= 3.6 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43969](https://insights.sbomify.com/CVE-2021-43969/): SQL injection in quicklert:quicklert (medium 6.5)
- [CVE-2021-43963](https://insights.sbomify.com/CVE-2021-43963/): Information disclosure in couchbase:sync gateway (high 8.1)
- [CVE-2021-43961](https://insights.sbomify.com/CVE-2021-43961/): Cross-site scripting in sonatype:nexus repository manager (medium 4.3)
- [CVE-2021-43960](https://insights.sbomify.com/CVE-2021-43960/): Cross-site scripting in lorensbergs:connect2 (medium 4.8)
- [CVE-2021-4396](https://insights.sbomify.com/CVE-2021-4396/): Rucy <= 0.4.4 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43959](https://insights.sbomify.com/CVE-2021-43959/): Server-side request forgery in Jira Service Management Data Center (medium 5.7)
- [CVE-2021-43958](https://insights.sbomify.com/CVE-2021-43958/): Auth bypass in Crucible (critical 9.8)
- [CVE-2021-43957](https://insights.sbomify.com/CVE-2021-43957/): Path traversal in Crucible (high 7.5)
- [CVE-2021-43956](https://insights.sbomify.com/CVE-2021-43956/): Cross-site scripting in Crucible (medium 6.1)
- [CVE-2021-43955](https://insights.sbomify.com/CVE-2021-43955/): Information disclosure in Crucible (medium 4.3)
- [CVE-2021-43954](https://insights.sbomify.com/CVE-2021-43954/): Server-side request forgery in Crucible (medium 4.3)
- [CVE-2021-43953](https://insights.sbomify.com/CVE-2021-43953/): Cross-site request forgery in Jira Data Center (medium 4.3)
- [CVE-2021-43952](https://insights.sbomify.com/CVE-2021-43952/): Cross-site request forgery in Jira Data Center (medium 4.3)
- [CVE-2021-43951](https://insights.sbomify.com/CVE-2021-43951/): Information disclosure in Jira Service Management Data Center (medium 4.3)
- [CVE-2021-43950](https://insights.sbomify.com/CVE-2021-43950/): Missing authorization in Jira Service Management Data Center (medium 4.3)
- [CVE-2021-4395](https://insights.sbomify.com/CVE-2021-4395/): Abandoned Cart Recovery for WooCommerce <= 1.0.4 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43949](https://insights.sbomify.com/CVE-2021-43949/): Missing authorization in Jira Service Management Data Center (medium 4.3)
- [CVE-2021-43948](https://insights.sbomify.com/CVE-2021-43948/): Missing authorization in Jira Service Management Data Center (medium 4.3)
- [CVE-2021-43947](https://insights.sbomify.com/CVE-2021-43947/): Code injection in Jira Data Center (high 7.2)
- [CVE-2021-43946](https://insights.sbomify.com/CVE-2021-43946/): Missing authorization in Jira Data Center (medium 6.5)
- [CVE-2021-43945](https://insights.sbomify.com/CVE-2021-43945/): Cross-site scripting in Jira Data Center (medium 4.8)
- [CVE-2021-43944](https://insights.sbomify.com/CVE-2021-43944/): Code injection in Jira Data Center (high 7.2)
- [CVE-2021-43943](https://insights.sbomify.com/CVE-2021-43943/): Cross-site scripting in Jira Service Management Data Center (medium 4.8)
- [CVE-2021-43942](https://insights.sbomify.com/CVE-2021-43942/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2021-43941](https://insights.sbomify.com/CVE-2021-43941/): Cross-site request forgery in Jira Data Center (medium 6.5)
- [CVE-2021-43940](https://insights.sbomify.com/CVE-2021-43940/): Privilege escalation in Confluence Data Center (high 7.8)
- [CVE-2021-4394](https://insights.sbomify.com/CVE-2021-4394/): Locations <= 3.2.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43939](https://insights.sbomify.com/CVE-2021-43939/): Elcomplus SmartPtt Improper Authorization (high 8.8)
- [CVE-2021-43938](https://insights.sbomify.com/CVE-2021-43938/): Elcomplus SmartPTT SCADA Server Information Exposure (high 8.1)
- [CVE-2021-43937](https://insights.sbomify.com/CVE-2021-43937/): Elcomplus SmartPTT SCADA Server Cross-site Request Forgery (high 7.6)
- [CVE-2021-43936](https://insights.sbomify.com/CVE-2021-43936/): Distributed Data Systems WebHM (critical 10.0)
- [CVE-2021-43935](https://insights.sbomify.com/CVE-2021-43935/): ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products (high 8.1)
- [CVE-2021-43934](https://insights.sbomify.com/CVE-2021-43934/): Elcomplus SmartPtt Unrestricted Upload of File with Dangerous Type (critical 9.8)
- [CVE-2021-43933](https://insights.sbomify.com/CVE-2021-43933/): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (medium 6.1)
- [CVE-2021-43932](https://insights.sbomify.com/CVE-2021-43932/): Elcomplus SmartPtt Cross-site Scripting (critical 9.0)
- [CVE-2021-43931](https://insights.sbomify.com/CVE-2021-43931/): Distributed Data Systems WebHM (critical 9.8)
- [CVE-2021-43930](https://insights.sbomify.com/CVE-2021-43930/): Elcomplus SmartPtt Path Traversal (medium 4.9)
- [CVE-2021-4393](https://insights.sbomify.com/CVE-2021-4393/): eCommerce Product Catalog Plugin for WordPress <= 3.0.17 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43929](https://insights.sbomify.com/CVE-2021-43929/): Cross-site scripting in DiskStation Manager (DSM) (medium 6.5)
- [CVE-2021-43928](https://insights.sbomify.com/CVE-2021-43928/): Command injection in Mail Station (critical 9.9)
- [CVE-2021-43927](https://insights.sbomify.com/CVE-2021-43927/): SQL injection in DiskStation Manager (DSM) (medium 4.7)
- [CVE-2021-43926](https://insights.sbomify.com/CVE-2021-43926/): SQL injection in DiskStation Manager (DSM) (medium 4.7)
- [CVE-2021-43925](https://insights.sbomify.com/CVE-2021-43925/): SQL injection in DiskStation Manager (DSM) (medium 4.7)
- [CVE-2021-4392](https://insights.sbomify.com/CVE-2021-4392/): eCommerce Product Catalog Plugin for WordPress <= 2.9.43 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-4391](https://insights.sbomify.com/CVE-2021-4391/): Ultimate Gift Cards for WooCommerce <= 2.1.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43908](https://insights.sbomify.com/CVE-2021-43908/): Visual Studio Code Spoofing Vulnerability (medium 4.3)
- [CVE-2021-43907](https://insights.sbomify.com/CVE-2021-43907/): Visual Studio Code WSL Extension Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2021-43905](https://insights.sbomify.com/CVE-2021-43905/): Microsoft Office app Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2021-4390](https://insights.sbomify.com/CVE-2021-4390/): Contact Form 7 Style <= 3.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43899](https://insights.sbomify.com/CVE-2021-43899/): Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2021-43896](https://insights.sbomify.com/CVE-2021-43896/): Microsoft PowerShell Spoofing Vulnerability (medium 5.5)
- [CVE-2021-43893](https://insights.sbomify.com/CVE-2021-43893/): Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2021-43892](https://insights.sbomify.com/CVE-2021-43892/): Microsoft BizTalk ESB Toolkit Spoofing Vulnerability (high 7.4)
- [CVE-2021-43891](https://insights.sbomify.com/CVE-2021-43891/): Visual Studio Code Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-43890](https://insights.sbomify.com/CVE-2021-43890/): Microsoft Windows AppX Installer Spoofing (high 7.1, exploited in the wild)
- [CVE-2021-4389](https://insights.sbomify.com/CVE-2021-4389/): WP Travel <= 4.4.6 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43889](https://insights.sbomify.com/CVE-2021-43889/): Microsoft Defender for IoT Remote Code Execution Vulnerability (high 7.2)
- [CVE-2021-43888](https://insights.sbomify.com/CVE-2021-43888/): Microsoft Defender for IoT Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-43883](https://insights.sbomify.com/CVE-2021-43883/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-43882](https://insights.sbomify.com/CVE-2021-43882/): Microsoft Defender for IoT Remote Code Execution Vulnerability (critical 9.0)
- [CVE-2021-43880](https://insights.sbomify.com/CVE-2021-43880/): Windows Mobile Device Management Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2021-4388](https://insights.sbomify.com/CVE-2021-4388/): Opal Estate <= 1.6.11 - Missing Authorization (medium 4.3)
- [CVE-2021-43877](https://insights.sbomify.com/CVE-2021-43877/): ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2021-43876](https://insights.sbomify.com/CVE-2021-43876/): Microsoft SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2021-43875](https://insights.sbomify.com/CVE-2021-43875/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-4387](https://insights.sbomify.com/CVE-2021-4387/): Opal Estate <= 1.6.11 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43863](https://insights.sbomify.com/CVE-2021-43863/): SQL Injection in FileContentProvider (GHSL-2021-1007) (high 7.5)
- [CVE-2021-43862](https://insights.sbomify.com/CVE-2021-43862/): Self XSS on user input (low 3.7)
- [CVE-2021-43861](https://insights.sbomify.com/CVE-2021-43861/): Incorrect sanitisation function leads to `XSS` (high 7.2)
- [CVE-2021-43860](https://insights.sbomify.com/CVE-2021-43860/): Permissions granted to applications can be hidden from the user at install time (high 8.2)
- [CVE-2021-4386](https://insights.sbomify.com/CVE-2021-4386/): WP Security Question <= 1.0.5 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43859](https://insights.sbomify.com/CVE-2021-43859/): Denial of Service by injecting highly recursive collections or maps in XStream (high 7.5)
- [CVE-2021-43858](https://insights.sbomify.com/CVE-2021-43858/): User privilege escalation in MinIO (high 8.8)
- [CVE-2021-43857](https://insights.sbomify.com/CVE-2021-43857/): Gerapy may contain remote code execution vulnerability (critical 9.8)
- [CVE-2021-43856](https://insights.sbomify.com/CVE-2021-43856/): Stored XSS in non-image uploads in Requarks/wiki (high 8.2)
- [CVE-2021-43855](https://insights.sbomify.com/CVE-2021-43855/): Stored XSS via SVG in Requarks/wiki (high 8.2)
- [CVE-2021-43854](https://insights.sbomify.com/CVE-2021-43854/): Inefficient Regular Expression Complexity in nltk (high 7.5)
- [CVE-2021-43853](https://insights.sbomify.com/CVE-2021-43853/): Cross-Site Scripting in AjaxNetProfessional (high 8.7)
- [CVE-2021-43852](https://insights.sbomify.com/CVE-2021-43852/): JavaScript Prototype Pollution in oro/platform (high 8.8)
- [CVE-2021-43851](https://insights.sbomify.com/CVE-2021-43851/): SQL injection vulnerability in anuko timetracker (high 8.1)
- [CVE-2021-43850](https://insights.sbomify.com/CVE-2021-43850/): Denial of Service in discourse (medium 6.8)
- [CVE-2021-4385](https://insights.sbomify.com/CVE-2021-4385/): WP Private Content Plus <= 3.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43849](https://insights.sbomify.com/CVE-2021-43849/): DoS vulnerability (medium 6.2)
- [CVE-2021-43848](https://insights.sbomify.com/CVE-2021-43848/): Unititialized memory access in h2o (high 7.4)
- [CVE-2021-43847](https://insights.sbomify.com/CVE-2021-43847/): Authorization Bypass in Space Invite in HumHub (medium 6.5)
- [CVE-2021-43846](https://insights.sbomify.com/CVE-2021-43846/): CSRF forgery protection bypass for Spree::OrdersController#populate (medium 5.3)
- [CVE-2021-43845](https://insights.sbomify.com/CVE-2021-43845/): Prevent out-of-bounds read in PJSIP (high 8.2)
- [CVE-2021-43844](https://insights.sbomify.com/CVE-2021-43844/): Externally Controlled Reference to a Resource in Another Sphere in MSEdgeRedirect (high 8.8)
- [CVE-2021-43843](https://insights.sbomify.com/CVE-2021-43843/): Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1 (medium 5.3)
- [CVE-2021-43842](https://insights.sbomify.com/CVE-2021-43842/): Stored XSS via SVG file upload in Wiki.js (medium 5.4)
- [CVE-2021-43841](https://insights.sbomify.com/CVE-2021-43841/): XSS by SVG upload in xwiki-platform (medium 5.4)
- [CVE-2021-43840](https://insights.sbomify.com/CVE-2021-43840/): Path traversal in message_bus (medium 4.4)
- [CVE-2021-4384](https://insights.sbomify.com/CVE-2021-4384/): WordPress Photo Gallery – Image Gallery <= 1.0.6 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2021-43839](https://insights.sbomify.com/CVE-2021-43839/): Drainage of FeeCollector's Block Transaction Fees (high 7.5)
- [CVE-2021-43838](https://insights.sbomify.com/CVE-2021-43838/): Regular Expression Denial of Service (ReDoS) in jsx-slack (medium 5.3)
- [CVE-2021-43837](https://insights.sbomify.com/CVE-2021-43837/): Template injection in vault-cli (high 8.4)
- [CVE-2021-43836](https://insights.sbomify.com/CVE-2021-43836/): PHP file inclusion in the Sulu admin panel (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/72/