# Vulnerabilities published in 2021


- [CVE-2021-43454](https://insights.sbomify.com/CVE-2021-43454/): Privilege escalation in anytxt:anytxt searcher (high 7.8)
- [CVE-2021-43453](https://insights.sbomify.com/CVE-2021-43453/): Memory corruption in jerryscript:jerryscript (critical 9.8)
- [CVE-2021-43451](https://insights.sbomify.com/CVE-2021-43451/): SQL injection in phpgurukul:employee record management system (critical 9.8)
- [CVE-2021-4345](https://insights.sbomify.com/CVE-2021-4345/): uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion (medium 6.5)
- [CVE-2021-43449](https://insights.sbomify.com/CVE-2021-43449/): Server-side request forgery in onlyoffice:server (high 8.1)
- [CVE-2021-43448](https://insights.sbomify.com/CVE-2021-43448/): Other in onlyoffice:server (medium 5.3)
- [CVE-2021-43447](https://insights.sbomify.com/CVE-2021-43447/): Auth bypass in onlyoffice:server (high 7.5)
- [CVE-2021-43446](https://insights.sbomify.com/CVE-2021-43446/): Cross-site scripting in onlyoffice:server (medium 6.1)
- [CVE-2021-43445](https://insights.sbomify.com/CVE-2021-43445/): Hardcoded credentials in onlyoffice:server (critical 9.8)
- [CVE-2021-43444](https://insights.sbomify.com/CVE-2021-43444/): Weak cryptography in onlyoffice:server (high 7.5)
- [CVE-2021-43442](https://insights.sbomify.com/CVE-2021-43442/): Business logic in i3international:ax46 firmware (high 8.1)
- [CVE-2021-43441](https://insights.sbomify.com/CVE-2021-43441/): Cross-site scripting in iorder project:iorder (medium 5.3)
- [CVE-2021-43440](https://insights.sbomify.com/CVE-2021-43440/): Cross-site scripting in iorder project:iorder (medium 6.1)
- [CVE-2021-4344](https://insights.sbomify.com/CVE-2021-4344/): Frontend File Manager <= 18.2 - Privilege Escalation (medium 6.4)
- [CVE-2021-43439](https://insights.sbomify.com/CVE-2021-43439/): Cross-site scripting in iresturant project:iresturant (critical 9.8)
- [CVE-2021-43438](https://insights.sbomify.com/CVE-2021-43438/): Cross-site scripting in iresturant project:iresturant (medium 5.4)
- [CVE-2021-43437](https://insights.sbomify.com/CVE-2021-43437/): Other in engineers online portal project:engineers online portal (high 8.8)
- [CVE-2021-43436](https://insights.sbomify.com/CVE-2021-43436/): Cross-site scripting in iresturant project:iresturant (medium 5.4)
- [CVE-2021-43432](https://insights.sbomify.com/CVE-2021-43432/): Cross-site scripting in exrick:xmall (medium 6.1)
- [CVE-2021-43430](https://insights.sbomify.com/CVE-2021-43430/): File upload in bigantsoft:bigant office messenger 5 (high 8.8)
- [CVE-2021-4343](https://insights.sbomify.com/CVE-2021-4343/): uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation (critical 9.8)
- [CVE-2021-43429](https://insights.sbomify.com/CVE-2021-43429/): Denial of service in seagate:cortx-s3 server (high 7.5)
- [CVE-2021-43421](https://insights.sbomify.com/CVE-2021-43421/): elFinder Unrestricted File Upload vulnerability (critical 9.8)
- [CVE-2021-43420](https://insights.sbomify.com/CVE-2021-43420/): SQL injection in online payment hub project:online payment hub (critical 9.8)
- [CVE-2021-43419](https://insights.sbomify.com/CVE-2021-43419/): Information disclosure in opayweb:opay (high 7.5)
- [CVE-2021-43415](https://insights.sbomify.com/CVE-2021-43415/): Improper Authentication in HashiCorp Nomad (high 8.8)
- [CVE-2021-43414](https://insights.sbomify.com/CVE-2021-43414/): Auth bypass in gnu:hurd (high 7.0)
- [CVE-2021-43413](https://insights.sbomify.com/CVE-2021-43413/): Privilege escalation in gnu:hurd (high 8.8)
- [CVE-2021-43412](https://insights.sbomify.com/CVE-2021-43412/): Use after free in gnu:hurd (high 7.8)
- [CVE-2021-43411](https://insights.sbomify.com/CVE-2021-43411/): Race condition in gnu:hurd (high 7.5)
- [CVE-2021-43410](https://insights.sbomify.com/CVE-2021-43410/): airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements (medium 5.3)
- [CVE-2021-4341](https://insights.sbomify.com/CVE-2021-4341/): uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX (critical 9.8)
- [CVE-2021-43409](https://insights.sbomify.com/CVE-2021-43409/): WPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scripting (critical 9.3)
- [CVE-2021-43408](https://insights.sbomify.com/CVE-2021-43408/): Duplicate Post WordPress Plugin SQL Injection Vulnerability (medium 6.5)
- [CVE-2021-43406](https://insights.sbomify.com/CVE-2021-43406/): Other in fusionpbx:fusionpbx (high 8.8)
- [CVE-2021-43405](https://insights.sbomify.com/CVE-2021-43405/): Other in fusionpbx:fusionpbx (high 8.8)
- [CVE-2021-43404](https://insights.sbomify.com/CVE-2021-43404/): Other in fusionpbx:fusionpbx (high 8.8)
- [CVE-2021-43403](https://insights.sbomify.com/CVE-2021-43403/): Path traversal in fusionpbx:fusionpbx (medium 6.5)
- [CVE-2021-43400](https://insights.sbomify.com/CVE-2021-43400/): Use after free in bluez:bluez (critical 9.1)
- [CVE-2021-4340](https://insights.sbomify.com/CVE-2021-4340/): uListing <= 1.6.6 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-43399](https://insights.sbomify.com/CVE-2021-43399/): Memory corruption in yubico:yubihsm 2 software development kit (high 7.5)
- [CVE-2021-43398](https://insights.sbomify.com/CVE-2021-43398/): Weak cryptography in cryptopp:crypto\+\+ (medium 5.3)
- [CVE-2021-43397](https://insights.sbomify.com/CVE-2021-43397/): Privilege escalation in liquidfiles:liquidfiles (high 8.8)
- [CVE-2021-43396](https://insights.sbomify.com/CVE-2021-43396/): Other in gnu:glibc (high 7.5)
- [CVE-2021-43395](https://insights.sbomify.com/CVE-2021-43395/): Denial of service in illumos:illumos (medium 5.5)
- [CVE-2021-43394](https://insights.sbomify.com/CVE-2021-43394/): Auth bypass in unisys:messaging integration services (critical 9.8)
- [CVE-2021-43393](https://insights.sbomify.com/CVE-2021-43393/): Weak cryptography in st:j-safe3 firmware (medium 6.2)
- [CVE-2021-43392](https://insights.sbomify.com/CVE-2021-43392/): Weak cryptography in st:j-safe3 firmware (medium 6.2)
- [CVE-2021-43391](https://insights.sbomify.com/CVE-2021-43391/): Memory corruption in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-43390](https://insights.sbomify.com/CVE-2021-43390/): Memory corruption in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-4339](https://insights.sbomify.com/CVE-2021-4339/): uListing <= 1.6.6 - Unauthenticated Information Disclosure (high 7.5)
- [CVE-2021-43389](https://insights.sbomify.com/CVE-2021-43389/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2021-43388](https://insights.sbomify.com/CVE-2021-43388/): Information disclosure in unisys:cargo mobile (high 7.5)
- [CVE-2021-4338](https://insights.sbomify.com/CVE-2021-4338/): 404 to 301 <= 3.0.7 - Missing Authorization to Redirect Creation (medium 6.4)
- [CVE-2021-4337](https://insights.sbomify.com/CVE-2021-4337/): Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization (high 8.8)
- [CVE-2021-43362](https://insights.sbomify.com/CVE-2021-43362/): MedData HBYS 1.0 Remote SQL Injection Vulnerability (critical 9.9)
- [CVE-2021-43361](https://insights.sbomify.com/CVE-2021-43361/): MedData HBYS 1.0 Remote SQL Injection Vulnerability (critical 9.9)
- [CVE-2021-43360](https://insights.sbomify.com/CVE-2021-43360/): Sunnet eHRD - Insecure Deserialization (high 8.8)
- [CVE-2021-4336](https://insights.sbomify.com/CVE-2021-4336/): ITRS Group monitor-ninja scheduled_reports.php sql injection (medium 5.5)
- [CVE-2021-43359](https://insights.sbomify.com/CVE-2021-43359/): Sunnet eHRD - Broken Access Control (high 8.8)
- [CVE-2021-43358](https://insights.sbomify.com/CVE-2021-43358/): Sunnet eHRD - Path Traversal (high 7.5)
- [CVE-2021-43355](https://insights.sbomify.com/CVE-2021-43355/): Fresenius Kabi Agilia Connect Infusion System use of client side authentication (high 7.3)
- [CVE-2021-43353](https://insights.sbomify.com/CVE-2021-43353/): Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-43350](https://insights.sbomify.com/CVE-2021-43350/): LDAP filter injection vulnerability in Traffic Ops (critical 9.8)
- [CVE-2021-4335](https://insights.sbomify.com/CVE-2021-4335/): Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions (medium 6.3)
- [CVE-2021-4334](https://insights.sbomify.com/CVE-2021-4334/): Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options (high 8.8)
- [CVE-2021-43339](https://insights.sbomify.com/CVE-2021-43339/): Command injection in ericsson:network location (high 8.8)
- [CVE-2021-43337](https://insights.sbomify.com/CVE-2021-43337/): Missing authorization in fedoraproject:fedora (medium 6.5)
- [CVE-2021-43336](https://insights.sbomify.com/CVE-2021-43336/): Memory corruption in opendesign:drawings software development kit (high 7.8)
- [CVE-2021-43334](https://insights.sbomify.com/CVE-2021-43334/): Cross-site scripting in buddyboss:buddyboss (medium 5.4)
- [CVE-2021-43333](https://insights.sbomify.com/CVE-2021-43333/): Missing authorization in datalogic:dxu (medium 6.5)
- [CVE-2021-43332](https://insights.sbomify.com/CVE-2021-43332/): Weak cryptography in debian:debian linux (medium 6.5)
- [CVE-2021-43331](https://insights.sbomify.com/CVE-2021-43331/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2021-4333](https://insights.sbomify.com/CVE-2021-4333/): WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation (medium 6.5)
- [CVE-2021-43329](https://insights.sbomify.com/CVE-2021-43329/): SQL injection in mumara:classic (critical 9.8)
- [CVE-2021-43327](https://insights.sbomify.com/CVE-2021-43327/): Security feature bypass in renesas:rx65 firmware (medium 4.6)
- [CVE-2021-43326](https://insights.sbomify.com/CVE-2021-43326/): Misconfiguration in automox:automox (high 7.8)
- [CVE-2021-43325](https://insights.sbomify.com/CVE-2021-43325/): Misconfiguration in automox:automox (high 7.8)
- [CVE-2021-43324](https://insights.sbomify.com/CVE-2021-43324/): Cross-site Scripting in LibreNMS (medium 6.1)
- [CVE-2021-43323](https://insights.sbomify.com/CVE-2021-43323/): Privilege escalation in insyde:insydeh2o (high 8.2)
- [CVE-2021-4332](https://insights.sbomify.com/CVE-2021-4332/): Path traversal in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.5)
- [CVE-2021-43319](https://insights.sbomify.com/CVE-2021-43319/): Command injection in zohocorp:manageengine network configuration manager (critical 9.8)
- [CVE-2021-43317](https://insights.sbomify.com/CVE-2021-43317/): Memory corruption in upx (high 7.5)
- [CVE-2021-43316](https://insights.sbomify.com/CVE-2021-43316/): Memory corruption in upx (high 7.5)
- [CVE-2021-43315](https://insights.sbomify.com/CVE-2021-43315/): Memory corruption in upx (high 7.5)
- [CVE-2021-43314](https://insights.sbomify.com/CVE-2021-43314/): Memory corruption in upx (high 7.5)
- [CVE-2021-43313](https://insights.sbomify.com/CVE-2021-43313/): Memory corruption in upx (high 7.5)
- [CVE-2021-43312](https://insights.sbomify.com/CVE-2021-43312/): Memory corruption in upx (high 7.5)
- [CVE-2021-43311](https://insights.sbomify.com/CVE-2021-43311/): Memory corruption in upx (high 7.5)
- [CVE-2021-43310](https://insights.sbomify.com/CVE-2021-43310/): Auth bypass in keylime (critical 9.8)
- [CVE-2021-4331](https://insights.sbomify.com/CVE-2021-4331/): Privilege escalation in The Plus Addons for Elementor Page Builder Pro (high 8.8)
- [CVE-2021-43309](https://insights.sbomify.com/CVE-2021-43309/): ReDoS in uri-template-lite URI.expand function (medium 5.9)
- [CVE-2021-43308](https://insights.sbomify.com/CVE-2021-43308/): Exponential ReDoS in markdown-link-extractor (medium 5.9)
- [CVE-2021-43307](https://insights.sbomify.com/CVE-2021-43307/): Exponential ReDoS in semver-regex (medium 5.9)
- [CVE-2021-43306](https://insights.sbomify.com/CVE-2021-43306/): Exponential ReDoS in jquery-validation (medium 5.9)
- [CVE-2021-43305](https://insights.sbomify.com/CVE-2021-43305/): Memory corruption in clickhouse (high 8.8)
- [CVE-2021-43304](https://insights.sbomify.com/CVE-2021-43304/): Memory corruption in clickhouse (high 8.8)
- [CVE-2021-43303](https://insights.sbomify.com/CVE-2021-43303/): Memory corruption in pjsip (critical 9.8)
- [CVE-2021-43302](https://insights.sbomify.com/CVE-2021-43302/): Memory corruption in pjsip (critical 9.1)
- [CVE-2021-43301](https://insights.sbomify.com/CVE-2021-43301/): Memory corruption in pjsip (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/76/