# Vulnerabilities published in 2021


- [CVE-2021-43835](https://insights.sbomify.com/CVE-2021-43835/): Privilege escalation in the Sulu Admin panel (high 7.2)
- [CVE-2021-43834](https://insights.sbomify.com/CVE-2021-43834/): Incorrect Authentication in elabftw (critical 9.1)
- [CVE-2021-43833](https://insights.sbomify.com/CVE-2021-43833/): Account takeover in eLabFTW (high 8.1)
- [CVE-2021-43832](https://insights.sbomify.com/CVE-2021-43832/): Improper Access Control in spinnaker (critical 10.0)
- [CVE-2021-43831](https://insights.sbomify.com/CVE-2021-43831/): Files on the host computer can be accessed from the Gradio interface (high 7.7)
- [CVE-2021-43830](https://insights.sbomify.com/CVE-2021-43830/): SQL injection in OpenProject (high 7.4)
- [CVE-2021-4383](https://insights.sbomify.com/CVE-2021-4383/): WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection (high 8.1)
- [CVE-2021-43829](https://insights.sbomify.com/CVE-2021-43829/): Unrestricted Upload of Files in Patrowl (high 7.4)
- [CVE-2021-43828](https://insights.sbomify.com/CVE-2021-43828/): Improper Privilege Management in Patrowl (high 7.5)
- [CVE-2021-43827](https://insights.sbomify.com/CVE-2021-43827/): Inline footnotes wrapped in <a> tags can cause errors in discourse-footnotes (medium 4.3)
- [CVE-2021-43826](https://insights.sbomify.com/CVE-2021-43826/): Crash when tunneling TCP over HTTP in Envoy (high 7.5)
- [CVE-2021-43825](https://insights.sbomify.com/CVE-2021-43825/): Use-after-free in Envoy (medium 6.1)
- [CVE-2021-43824](https://insights.sbomify.com/CVE-2021-43824/): Null pointer dereference in envoy (high 7.5)
- [CVE-2021-43823](https://insights.sbomify.com/CVE-2021-43823/): Side-channel attack in Sourcegraph (medium 6.5)
- [CVE-2021-43822](https://insights.sbomify.com/CVE-2021-43822/): SQL injection in jackalope/jackalope-doctrine-dbal (high 8.5)
- [CVE-2021-43821](https://insights.sbomify.com/CVE-2021-43821/): Files Accessible to External Parties in Opencast (critical 9.9)
- [CVE-2021-43820](https://insights.sbomify.com/CVE-2021-43820/): Permissions check bypass in Seafile (high 7.4)
- [CVE-2021-4382](https://insights.sbomify.com/CVE-2021-4382/): Recently <= 3.0.4 - Arbitrary File Upload to Remote Code Exectution (high 8.8)
- [CVE-2021-43819](https://insights.sbomify.com/CVE-2021-43819/): Stargate-Bukkit improperly handles vehicles causing data duplication. (high 7.5)
- [CVE-2021-43818](https://insights.sbomify.com/CVE-2021-43818/): HTML Cleaner allows crafted and SVG embedded scripts to pass through (high 8.2)
- [CVE-2021-43817](https://insights.sbomify.com/CVE-2021-43817/): Reflected Cross-Site-Scripting vulnerability in Collabora Online (high 8.2)
- [CVE-2021-43816](https://insights.sbomify.com/CVE-2021-43816/): Improper Preservation of Permissions in containerd (high 8.0)
- [CVE-2021-43815](https://insights.sbomify.com/CVE-2021-43815/): Grafana directory traversal for `.cvs` files (medium 4.3)
- [CVE-2021-43814](https://insights.sbomify.com/CVE-2021-43814/): Heap-based OOB write when parsing dwarf DIE info in Rizin (high 7.7)
- [CVE-2021-43813](https://insights.sbomify.com/CVE-2021-43813/): Directory Traversal in Grafana (medium 4.3)
- [CVE-2021-43812](https://insights.sbomify.com/CVE-2021-43812/): Open redirect in nextjs-auth0 (medium 6.4)
- [CVE-2021-43811](https://insights.sbomify.com/CVE-2021-43811/): Code injection via unsafe YAML loading (high 7.8)
- [CVE-2021-43810](https://insights.sbomify.com/CVE-2021-43810/): Cross-site Scripting (XSS) when redirect an url (high 8.8)
- [CVE-2021-4381](https://insights.sbomify.com/CVE-2021-4381/): uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route (critical 9.8)
- [CVE-2021-43809](https://insights.sbomify.com/CVE-2021-43809/): Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile (medium 6.7)
- [CVE-2021-43808](https://insights.sbomify.com/CVE-2021-43808/): Blade `@parent` Exploitation Leading To Possible XSS in Laravel (medium 5.3)
- [CVE-2021-43807](https://insights.sbomify.com/CVE-2021-43807/): HTTP Method Spoofing in Opencast (high 7.5)
- [CVE-2021-43806](https://insights.sbomify.com/CVE-2021-43806/): SQL injection in Tuleap (high 8.8)
- [CVE-2021-43805](https://insights.sbomify.com/CVE-2021-43805/): ReDos vulnerability on guest checkout email validation (high 7.5)
- [CVE-2021-43804](https://insights.sbomify.com/CVE-2021-43804/): Out-of-bounds read when parsing RTCP BYE message in PJSIP (high 7.3)
- [CVE-2021-43803](https://insights.sbomify.com/CVE-2021-43803/): Unexpected server crash in Next.js (high 7.5)
- [CVE-2021-43802](https://insights.sbomify.com/CVE-2021-43802/): Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports (critical 9.9)
- [CVE-2021-43801](https://insights.sbomify.com/CVE-2021-43801/): Uncaught Exception in mercurius (high 7.5)
- [CVE-2021-43800](https://insights.sbomify.com/CVE-2021-43800/): Asset directory traversal with some storage modules on Windows (high 7.5)
- [CVE-2021-4380](https://insights.sbomify.com/CVE-2021-4380/): Pinterest Automatic <= 4.14.3 - Unuathenticated Arbitrary Options Update (critical 9.8)
- [CVE-2021-43799](https://insights.sbomify.com/CVE-2021-43799/): RabbitMQ exposes ports with weak default secrets in Zulip Server (high 8.6)
- [CVE-2021-43798](https://insights.sbomify.com/CVE-2021-43798/): Grafana Path Traversal (high 7.5, exploited in the wild)
- [CVE-2021-43797](https://insights.sbomify.com/CVE-2021-43797/): HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling (medium 6.5)
- [CVE-2021-43795](https://insights.sbomify.com/CVE-2021-43795/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria (high 7.5)
- [CVE-2021-43794](https://insights.sbomify.com/CVE-2021-43794/): Anonymous user cache poisoning via development-mode header in Discourse (medium 5.3)
- [CVE-2021-43793](https://insights.sbomify.com/CVE-2021-43793/): Bypass of Poll voting limits in Discourse (medium 4.3)
- [CVE-2021-43792](https://insights.sbomify.com/CVE-2021-43792/): Notifications leak in Discourse (medium 4.3)
- [CVE-2021-43791](https://insights.sbomify.com/CVE-2021-43791/): Ineffective expiration validation for invitation links in Zulip (medium 6.5)
- [CVE-2021-43790](https://insights.sbomify.com/CVE-2021-43790/): Use After Free in lucet (high 8.5)
- [CVE-2021-4379](https://insights.sbomify.com/CVE-2021-4379/): WooCommerce Multi Currency <= 2.1.17 - Missing Authorization (medium 6.5)
- [CVE-2021-43789](https://insights.sbomify.com/CVE-2021-43789/): Blind SQLi using Search filters in PrestaShop (high 7.5)
- [CVE-2021-43788](https://insights.sbomify.com/CVE-2021-43788/): Path traversal in translator module of NobeBB (medium 5.0)
- [CVE-2021-43787](https://insights.sbomify.com/CVE-2021-43787/): XSS via prototype pollution (critical 9.0)
- [CVE-2021-43786](https://insights.sbomify.com/CVE-2021-43786/): API token verification can be bypassed (critical 9.8)
- [CVE-2021-43785](https://insights.sbomify.com/CVE-2021-43785/): Cross Site Scripting Vulnerability in @joeattardi/emoji-button (high 7.6)
- [CVE-2021-43784](https://insights.sbomify.com/CVE-2021-43784/): Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (medium 6.0)
- [CVE-2021-43783](https://insights.sbomify.com/CVE-2021-43783/): Path Traversal in @backstage/plugin-scaffolder-backend (high 8.5)
- [CVE-2021-43782](https://insights.sbomify.com/CVE-2021-43782/): Indirect LDAP injection in Tuleap (medium 6.7)
- [CVE-2021-43781](https://insights.sbomify.com/CVE-2021-43781/): Permissions not properly checked in Invenio-Drafts-Resources (medium 6.4)
- [CVE-2021-43780](https://insights.sbomify.com/CVE-2021-43780/): Server-Side Request Forgery (SSRF) in Redash (medium 6.8)
- [CVE-2021-4378](https://insights.sbomify.com/CVE-2021-4378/): WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2021-43779](https://insights.sbomify.com/CVE-2021-43779/): Remote Command Execution vulnerability (critical 9.9)
- [CVE-2021-43778](https://insights.sbomify.com/CVE-2021-43778/): Path traversal in GLPI barcode plugin (critical 9.1)
- [CVE-2021-43777](https://insights.sbomify.com/CVE-2021-43777/): Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce) (medium 6.8)
- [CVE-2021-43776](https://insights.sbomify.com/CVE-2021-43776/): XSS vulnerability in @backstage/plugin-auth-backend (high 7.4)
- [CVE-2021-43775](https://insights.sbomify.com/CVE-2021-43775/): Arbitrary file reading vulnerability in Aim (high 8.6)
- [CVE-2021-43774](https://insights.sbomify.com/CVE-2021-43774/): Weak cryptography in fujifilm:apeosport-iv 2060 firmware (medium 4.9)
- [CVE-2021-43772](https://insights.sbomify.com/CVE-2021-43772/): Security feature bypass in Trend Micro Security 2021 (Consumer) (medium 5.5)
- [CVE-2021-43771](https://insights.sbomify.com/CVE-2021-43771/): Privilege escalation in Trend Micro Antivirus for MAC 2021 (high 7.8)
- [CVE-2021-4377](https://insights.sbomify.com/CVE-2021-4377/): Doneren met Mollie <= 2.8.4 - Information Disclosure (medium 6.5)
- [CVE-2021-43768](https://insights.sbomify.com/CVE-2021-43768/): In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface runn (medium 5.3)
- [CVE-2021-43767](https://insights.sbomify.com/CVE-2021-43767/): Security feature bypass in Odyssey (medium 5.9)
- [CVE-2021-43766](https://insights.sbomify.com/CVE-2021-43766/): SQL injection in Odyssey (high 8.1)
- [CVE-2021-43765](https://insights.sbomify.com/CVE-2021-43765/): Adobe Experience Manager Stored XSS in the Carousel Set (high 8.1)
- [CVE-2021-43764](https://insights.sbomify.com/CVE-2021-43764/): Adobe Experience Manager Stored XSS in the Spin Set (high 8.0)
- [CVE-2021-43763](https://insights.sbomify.com/CVE-2021-43763/): Adobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-43762](https://insights.sbomify.com/CVE-2021-43762/): Adobe Experience Manager Unicode normalization leads to dispatcher bypass (medium 6.5)
- [CVE-2021-43761](https://insights.sbomify.com/CVE-2021-43761/): Adobe Experience Manager Stored XSS on Edit Tag page via Localization input (high 8.0)
- [CVE-2021-43760](https://insights.sbomify.com/CVE-2021-43760/): Adobe Media Encoder MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-4376](https://insights.sbomify.com/CVE-2021-4376/): WooCommerce Multi Currency <= 2.1.17 - Missing Authorization (medium 4.3)
- [CVE-2021-43759](https://insights.sbomify.com/CVE-2021-43759/): Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-43758](https://insights.sbomify.com/CVE-2021-43758/): Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-43757](https://insights.sbomify.com/CVE-2021-43757/): Adobe Media Encoder 3GP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-43756](https://insights.sbomify.com/CVE-2021-43756/): Adobe Media Encoder Memory Corruption Vulnerability could lead to Remote Code Execution (high 7.8)
- [CVE-2021-43755](https://insights.sbomify.com/CVE-2021-43755/): Adobe After Effects Memory Corruption could lead to Arbitrary Code Execution (high 7.8)
- [CVE-2021-43754](https://insights.sbomify.com/CVE-2021-43754/): Adobe Prelude Corruption could lead to Arbitrary code execution (high 7.8)
- [CVE-2021-43753](https://insights.sbomify.com/CVE-2021-43753/): Adobe Lightroom TIF File Parsing Use-After-Free Information Disclosure Vulnerability (high 7.8)
- [CVE-2021-43752](https://insights.sbomify.com/CVE-2021-43752/): Adobe Illustrator TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-43751](https://insights.sbomify.com/CVE-2021-43751/): Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-43750](https://insights.sbomify.com/CVE-2021-43750/): Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-Service (medium 5.5)
- [CVE-2021-4375](https://insights.sbomify.com/CVE-2021-4375/): Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure (medium 4.3)
- [CVE-2021-43749](https://insights.sbomify.com/CVE-2021-43749/): Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-Service (medium 5.5)
- [CVE-2021-43748](https://insights.sbomify.com/CVE-2021-43748/): Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-Service (medium 5.5)
- [CVE-2021-43747](https://insights.sbomify.com/CVE-2021-43747/): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43746](https://insights.sbomify.com/CVE-2021-43746/): Adobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-43745](https://insights.sbomify.com/CVE-2021-43745/): Denial of service in trillium notes project:trillum notes (medium 5.5)
- [CVE-2021-43742](https://insights.sbomify.com/CVE-2021-43742/): Cross-site scripting in cmsimple:cmsimple (medium 5.4)
- [CVE-2021-43741](https://insights.sbomify.com/CVE-2021-43741/): Path traversal in cmsimple:cmsimple (critical 9.8)
- [CVE-2021-4374](https://insights.sbomify.com/CVE-2021-4374/): WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update (critical 9.1)
- [CVE-2021-43738](https://insights.sbomify.com/CVE-2021-43738/): Cross-site request forgery in xiaohuanxiong cms project:xiaohuanxiong cms (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/73/