# Vulnerabilities published in 2021


- [CVE-2021-43578](https://insights.sbomify.com/CVE-2021-43578/): Agent-to-controller security bypass in Jenkins Squash TM Publisher (Squash4Jenkins) Plugin allows writing arbitrary files (high 8.1)
- [CVE-2021-43577](https://insights.sbomify.com/CVE-2021-43577/): XXE vulnerability in Jenkins OWASP Dependency-Check Plugin (high 7.1)
- [CVE-2021-43576](https://insights.sbomify.com/CVE-2021-43576/): XXE vulnerability in Jenkins pom2config Plugin (medium 6.5)
- [CVE-2021-43575](https://insights.sbomify.com/CVE-2021-43575/): Hardcoded credentials in knx:engineering tool software 6 (medium 5.5)
- [CVE-2021-43574](https://insights.sbomify.com/CVE-2021-43574/): Cross-site scripting in atmail:atmail (medium 6.1)
- [CVE-2021-43573](https://insights.sbomify.com/CVE-2021-43573/): Memory corruption in realtek:rtl8195am firmware (critical 9.8)
- [CVE-2021-43572](https://insights.sbomify.com/CVE-2021-43572/): Improper Verification of Cryptographic Signature in starkbank-ecdsa (critical 9.8)
- [CVE-2021-43571](https://insights.sbomify.com/CVE-2021-43571/): Improper Verification of Cryptographic Signature in starkbank-ecdsa (critical 9.8)
- [CVE-2021-43570](https://insights.sbomify.com/CVE-2021-43570/): Improper Verification of Cryptographic Signature in starkbank-ecdsa (critical 9.8)
- [CVE-2021-4357](https://insights.sbomify.com/CVE-2021-4357/): uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion (critical 9.1)
- [CVE-2021-43569](https://insights.sbomify.com/CVE-2021-43569/): Improper Verification of Cryptographic Signature in starkbank-ecdsa (critical 9.8)
- [CVE-2021-43568](https://insights.sbomify.com/CVE-2021-43568/): ecdsa-elixir fails to check signatures, vulnerable to message forging (critical 9.8)
- [CVE-2021-43566](https://insights.sbomify.com/CVE-2021-43566/): Race condition in samba:samba (low 2.5)
- [CVE-2021-43565](https://insights.sbomify.com/CVE-2021-43565/): x/crypto/ssh vulnerable to panic via malformed packets (high 7.5)
- [CVE-2021-43564](https://insights.sbomify.com/CVE-2021-43564/): Unrestricted access to predictable file paths in hov/jobfair (high 7.5)
- [CVE-2021-43563](https://insights.sbomify.com/CVE-2021-43563/): Missing authorization in pixxio:pixx.io (high 8.8)
- [CVE-2021-43562](https://insights.sbomify.com/CVE-2021-43562/): Server-side request forgery in pixxio:pixx.io (high 8.8)
- [CVE-2021-43561](https://insights.sbomify.com/CVE-2021-43561/): Cross-site Scripting in pegasus/google-for-jobs (medium 5.4)
- [CVE-2021-43560](https://insights.sbomify.com/CVE-2021-43560/): Moodle Insecure direct object reference (IDOR) in a calendar web service (medium 5.3)
- [CVE-2021-4356](https://insights.sbomify.com/CVE-2021-4356/): Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download (critical 9.0)
- [CVE-2021-43559](https://insights.sbomify.com/CVE-2021-43559/): Moodle contains CSRF vulnerability (high 8.8)
- [CVE-2021-43558](https://insights.sbomify.com/CVE-2021-43558/): Cross-site Scripting in moodle (medium 6.1)
- [CVE-2021-43557](https://insights.sbomify.com/CVE-2021-43557/): Path traversal in request_uri variable (high 7.5)
- [CVE-2021-43556](https://insights.sbomify.com/CVE-2021-43556/): FATEK Automation WinProladder (high 7.8)
- [CVE-2021-43555](https://insights.sbomify.com/CVE-2021-43555/): mySCADA myDESIGNER (high 7.3)
- [CVE-2021-43554](https://insights.sbomify.com/CVE-2021-43554/): FATEK Automation WinProladder (high 7.8)
- [CVE-2021-43553](https://insights.sbomify.com/CVE-2021-43553/): OSIsoft PI Vision (low 3.1)
- [CVE-2021-43552](https://insights.sbomify.com/CVE-2021-43552/): Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key (medium 6.1)
- [CVE-2021-43551](https://insights.sbomify.com/CVE-2021-43551/): OSIsoft PI Vision (medium 6.5)
- [CVE-2021-43550](https://insights.sbomify.com/CVE-2021-43550/): Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic Algorithm (medium 5.9)
- [CVE-2021-4355](https://insights.sbomify.com/CVE-2021-4355/): Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure (high 7.5)
- [CVE-2021-43549](https://insights.sbomify.com/CVE-2021-43549/): OSIsoft PI Web API (medium 6.9)
- [CVE-2021-43548](https://insights.sbomify.com/CVE-2021-43548/): Philips Patient Information Center iX (PIC iX) and Efficia CM Series Improper Input Validation (medium 6.5)
- [CVE-2021-43547](https://insights.sbomify.com/CVE-2021-43547/): TwinOaks Computing CoreDX DDS Secure Network Amplification (high 7.5)
- [CVE-2021-43546](https://insights.sbomify.com/CVE-2021-43546/): Other in Firefox (medium 4.3)
- [CVE-2021-43545](https://insights.sbomify.com/CVE-2021-43545/): Denial of service in Firefox (medium 6.5)
- [CVE-2021-43544](https://insights.sbomify.com/CVE-2021-43544/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2021-43543](https://insights.sbomify.com/CVE-2021-43543/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2021-43542](https://insights.sbomify.com/CVE-2021-43542/): Information disclosure in Firefox (medium 6.5)
- [CVE-2021-43541](https://insights.sbomify.com/CVE-2021-43541/): Other in Firefox (medium 6.5)
- [CVE-2021-43540](https://insights.sbomify.com/CVE-2021-43540/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2021-4354](https://insights.sbomify.com/CVE-2021-4354/): PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload (high 8.8)
- [CVE-2021-43539](https://insights.sbomify.com/CVE-2021-43539/): Use after free in Firefox (high 8.8)
- [CVE-2021-43538](https://insights.sbomify.com/CVE-2021-43538/): Race condition in Firefox (medium 4.3)
- [CVE-2021-43537](https://insights.sbomify.com/CVE-2021-43537/): Integer overflow in Firefox (high 8.8)
- [CVE-2021-43536](https://insights.sbomify.com/CVE-2021-43536/): Information disclosure in Firefox (medium 6.5)
- [CVE-2021-43535](https://insights.sbomify.com/CVE-2021-43535/): Use after free in Firefox (high 8.8)
- [CVE-2021-43534](https://insights.sbomify.com/CVE-2021-43534/): Memory corruption in Firefox (high 8.8)
- [CVE-2021-43533](https://insights.sbomify.com/CVE-2021-43533/): Other in Firefox (medium 4.3)
- [CVE-2021-43532](https://insights.sbomify.com/CVE-2021-43532/): Open redirect in Firefox (medium 6.1)
- [CVE-2021-43531](https://insights.sbomify.com/CVE-2021-43531/): Information disclosure in Firefox (medium 4.3)
- [CVE-2021-43530](https://insights.sbomify.com/CVE-2021-43530/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2021-4353](https://insights.sbomify.com/CVE-2021-4353/): WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export (medium 5.3)
- [CVE-2021-43529](https://insights.sbomify.com/CVE-2021-43529/): Memory corruption in Thunderbird (critical 9.8)
- [CVE-2021-43528](https://insights.sbomify.com/CVE-2021-43528/): Privilege escalation in Thunderbird (medium 6.5)
- [CVE-2021-43527](https://insights.sbomify.com/CVE-2021-43527/): Memory corruption in NSS (critical 9.8)
- [CVE-2021-43523](https://insights.sbomify.com/CVE-2021-43523/): Other in uclibc-ng project:uclibc-ng (critical 9.6)
- [CVE-2021-43522](https://insights.sbomify.com/CVE-2021-43522/): Memory corruption in insyde:insydeh2o (high 7.5)
- [CVE-2021-43521](https://insights.sbomify.com/CVE-2021-43521/): Memory corruption in zlog project:zlog (high 7.5)
- [CVE-2021-4352](https://insights.sbomify.com/CVE-2021-4352/): JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Change (medium 5.3)
- [CVE-2021-43519](https://insights.sbomify.com/CVE-2021-43519/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2021-43518](https://insights.sbomify.com/CVE-2021-43518/): Memory corruption in fedoraproject:fedora (high 7.8)
- [CVE-2021-43517](https://insights.sbomify.com/CVE-2021-43517/): Hardcoded credentials in foscam:fi9805e firmware (critical 9.8)
- [CVE-2021-43515](https://insights.sbomify.com/CVE-2021-43515/): Improper Neutralization of Formula Elements in a CSV File in Kimai 2 (high 7.8)
- [CVE-2021-43512](https://insights.sbomify.com/CVE-2021-43512/): Information disclosure in flightradar24:flightradar24 flight tracker (medium 5.5)
- [CVE-2021-43510](https://insights.sbomify.com/CVE-2021-43510/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2021-4351](https://insights.sbomify.com/CVE-2021-4351/): Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change (medium 5.8)
- [CVE-2021-43509](https://insights.sbomify.com/CVE-2021-43509/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2021-43506](https://insights.sbomify.com/CVE-2021-43506/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2021-43505](https://insights.sbomify.com/CVE-2021-43505/): Cross-site scripting in simple client management system project:simple client management system (medium 5.4)
- [CVE-2021-4350](https://insights.sbomify.com/CVE-2021-4350/): Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails (high 7.2)
- [CVE-2021-43498](https://insights.sbomify.com/CVE-2021-43498/): Missing authorization in atutor:atutor (high 7.5)
- [CVE-2021-43496](https://insights.sbomify.com/CVE-2021-43496/): Path traversal in clustering project:clustering (high 7.5)
- [CVE-2021-43495](https://insights.sbomify.com/CVE-2021-43495/): Path traversal in alquistai:alquist (high 7.5)
- [CVE-2021-43494](https://insights.sbomify.com/CVE-2021-43494/): Path traversal in codingforentrepreneurs:opencv rest api (high 7.5)
- [CVE-2021-43493](https://insights.sbomify.com/CVE-2021-43493/): Path traversal in servermanagement project:servermanagement (high 7.5)
- [CVE-2021-43492](https://insights.sbomify.com/CVE-2021-43492/): Path traversal in alquistai:alquist (high 7.5)
- [CVE-2021-4349](https://insights.sbomify.com/CVE-2021-4349/): Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery (high 8.8)
- [CVE-2021-43484](https://insights.sbomify.com/CVE-2021-43484/): File upload in simple client management system project:simple client management system (critical 9.8)
- [CVE-2021-43483](https://insights.sbomify.com/CVE-2021-43483/): Missing authorization in claro:kaon cg3000 firmware (high 8.0)
- [CVE-2021-43481](https://insights.sbomify.com/CVE-2021-43481/): SQL injection in webtareas project:webtareas (critical 9.8)
- [CVE-2021-4348](https://insights.sbomify.com/CVE-2021-4348/): Ultimate GDPR & CCPA <= 2.4 - Unauthenticated Settings Import & Export (high 7.5)
- [CVE-2021-43479](https://insights.sbomify.com/CVE-2021-43479/): Code injection in secretarycms:the secretary (critical 9.8)
- [CVE-2021-43478](https://insights.sbomify.com/CVE-2021-43478/): Misconfiguration in hoosk:hoosk (medium 5.4)
- [CVE-2021-43474](https://insights.sbomify.com/CVE-2021-43474/): Missing authorization in dlink:dir-823g firmware (critical 9.8)
- [CVE-2021-43471](https://insights.sbomify.com/CVE-2021-43471/): Auth bypass in canon:lbp223dw firmware (high 7.5)
- [CVE-2021-4347](https://insights.sbomify.com/CVE-2021-4347/): Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change (critical 9.9)
- [CVE-2021-43469](https://insights.sbomify.com/CVE-2021-43469/): Command injection in vinga:wr-n300u firmware (high 8.8)
- [CVE-2021-43466](https://insights.sbomify.com/CVE-2021-43466/): Template injection in thymeleaf-spring5 (critical 9.8)
- [CVE-2021-43464](https://insights.sbomify.com/CVE-2021-43464/): Remote code execution in Subrion (high 8.8)
- [CVE-2021-43463](https://insights.sbomify.com/CVE-2021-43463/): Privilege escalation in ext2 file system driver project:ext2 file system driver (high 7.8)
- [CVE-2021-43462](https://insights.sbomify.com/CVE-2021-43462/): Cross-site scripting in rumble mail server project:rumble mail server (medium 5.4)
- [CVE-2021-43461](https://insights.sbomify.com/CVE-2021-43461/): Cross-site scripting in rumble mail server project:rumble mail server (medium 5.4)
- [CVE-2021-43460](https://insights.sbomify.com/CVE-2021-43460/): Privilege escalation in systemexplorer:system explorer (high 7.8)
- [CVE-2021-4346](https://insights.sbomify.com/CVE-2021-4346/): uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes (critical 9.8)
- [CVE-2021-43459](https://insights.sbomify.com/CVE-2021-43459/): Cross-site scripting in rumble mail server project:rumble mail server (medium 5.4)
- [CVE-2021-43458](https://insights.sbomify.com/CVE-2021-43458/): Privilege escalation in vembu:bdr suite (high 7.8)
- [CVE-2021-43457](https://insights.sbomify.com/CVE-2021-43457/): Privilege escalation in bvpn:bvpn (high 7.8)
- [CVE-2021-43456](https://insights.sbomify.com/CVE-2021-43456/): Privilege escalation in rumble mail server project:rumble mail server (high 7.8)
- [CVE-2021-43455](https://insights.sbomify.com/CVE-2021-43455/): Privilege escalation in freelan:freelan (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/75/