# Vulnerabilities published in 2021


- [CVE-2021-43052](https://insights.sbomify.com/CVE-2021-43052/): TIBCO FTL Secret Generation Vulnerability (critical 9.3)
- [CVE-2021-43051](https://insights.sbomify.com/CVE-2021-43051/): TIBCO Spotfire Server API Authorization Vulnerability (high 7.1)
- [CVE-2021-43050](https://insights.sbomify.com/CVE-2021-43050/): TIBCO BusinessConnect Container Edition administrative username and passwords leakage (high 8.4)
- [CVE-2021-4305](https://insights.sbomify.com/CVE-2021-4305/): Woorank robots-txt-guard patterns.js makePathPattern redos (low 3.5)
- [CVE-2021-43049](https://insights.sbomify.com/CVE-2021-43049/): TIBCO BusinessConnect Container Edition username and password leakage (critical 9.8)
- [CVE-2021-43048](https://insights.sbomify.com/CVE-2021-43048/): TIBCO PartnerExpress Click-Jacking vulnerability (critical 9.8)
- [CVE-2021-43047](https://insights.sbomify.com/CVE-2021-43047/): TIBCO PartnerExpress Cross Site Scripting vulnerabilities (critical 9.0)
- [CVE-2021-43046](https://insights.sbomify.com/CVE-2021-43046/): TIBCO PartnerExpress Session Token in URL (high 7.5)
- [CVE-2021-43045](https://insights.sbomify.com/CVE-2021-43045/): Possible DOS vulnerabilities in C# Avro SDK (high 7.5)
- [CVE-2021-43044](https://insights.sbomify.com/CVE-2021-43044/): Hardcoded credentials in kaseya:unitrends backup (critical 9.8)
- [CVE-2021-43043](https://insights.sbomify.com/CVE-2021-43043/): Privilege escalation in kaseya:unitrends backup (medium 6.5)
- [CVE-2021-43042](https://insights.sbomify.com/CVE-2021-43042/): Memory corruption in kaseya:unitrends backup (critical 9.8)
- [CVE-2021-43041](https://insights.sbomify.com/CVE-2021-43041/): Memory corruption in kaseya:unitrends backup (high 8.8)
- [CVE-2021-43040](https://insights.sbomify.com/CVE-2021-43040/): Privilege escalation in kaseya:unitrends backup (high 8.8)
- [CVE-2021-4304](https://insights.sbomify.com/CVE-2021-4304/): eprintsug ulcc-core toolbox command injection (medium 6.3)
- [CVE-2021-43039](https://insights.sbomify.com/CVE-2021-43039/): Misconfiguration in kaseya:unitrends backup (medium 6.5)
- [CVE-2021-43038](https://insights.sbomify.com/CVE-2021-43038/): Code injection in kaseya:unitrends backup (high 8.8)
- [CVE-2021-43037](https://insights.sbomify.com/CVE-2021-43037/): Privilege escalation in kaseya:unitrends backup (high 7.8)
- [CVE-2021-43036](https://insights.sbomify.com/CVE-2021-43036/): Hardcoded credentials in kaseya:unitrends backup (critical 9.8)
- [CVE-2021-43035](https://insights.sbomify.com/CVE-2021-43035/): SQL injection in kaseya:unitrends backup (critical 9.8)
- [CVE-2021-43034](https://insights.sbomify.com/CVE-2021-43034/): Misconfiguration in kaseya:unitrends backup (high 7.8)
- [CVE-2021-43033](https://insights.sbomify.com/CVE-2021-43033/): Command injection in kaseya:unitrends backup (critical 9.8)
- [CVE-2021-43032](https://insights.sbomify.com/CVE-2021-43032/): Cross-site scripting in xenforo:xenforo (medium 4.8)
- [CVE-2021-43030](https://insights.sbomify.com/CVE-2021-43030/): Adobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-4303](https://insights.sbomify.com/CVE-2021-4303/): shannah Xataface Installer install_form.js.php testftp cross site scripting (low 2.0)
- [CVE-2021-43029](https://insights.sbomify.com/CVE-2021-43029/): Adobe Premiere Rush M4A File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43028](https://insights.sbomify.com/CVE-2021-43028/): Adobe Premiere Rush M4A File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43027](https://insights.sbomify.com/CVE-2021-43027/): Adobe After Effects TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (high 7.8)
- [CVE-2021-43026](https://insights.sbomify.com/CVE-2021-43026/): Adobe Premiere Rush MXF File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43025](https://insights.sbomify.com/CVE-2021-43025/): Adobe Premiere Rush SVG File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43024](https://insights.sbomify.com/CVE-2021-43024/): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43023](https://insights.sbomify.com/CVE-2021-43023/): Adobe Premiere Rush EPS/TIFF File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43022](https://insights.sbomify.com/CVE-2021-43022/): Adobe Premiere Rush PNG File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-43021](https://insights.sbomify.com/CVE-2021-43021/): Adobe Premiere Rush EXR File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-4302](https://insights.sbomify.com/CVE-2021-4302/): slackero phpwcms SVG File cross site scripting (low 3.5)
- [CVE-2021-43019](https://insights.sbomify.com/CVE-2021-43019/): Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability (high 7.8)
- [CVE-2021-43018](https://insights.sbomify.com/CVE-2021-43018/): Adobe Photoshop JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-43017](https://insights.sbomify.com/CVE-2021-43017/): Adobe Creative Cloud DLL Hijacking Local Application Denial of Service (medium 4.2)
- [CVE-2021-43016](https://insights.sbomify.com/CVE-2021-43016/): Adobe InCopy NULL Pointer Dereference Application Denial of Service (medium 5.5)
- [CVE-2021-43015](https://insights.sbomify.com/CVE-2021-43015/): Adobe InCopy GIF File Parsing Memory Corruption Arbitrary Code Execution (high 7.8)
- [CVE-2021-43013](https://insights.sbomify.com/CVE-2021-43013/): Adobe Media Encoder memory corruption vulnerability could lead to remote code execution (high 7.8)
- [CVE-2021-43012](https://insights.sbomify.com/CVE-2021-43012/): Adobe Prelude M4A file memory corruption vulnerability could lead to remote code execution (high 7.8)
- [CVE-2021-43011](https://insights.sbomify.com/CVE-2021-43011/): Adobe Prelude M4A file memory corruption vulnerability could lead to remote code execution (high 7.8)
- [CVE-2021-43010](https://insights.sbomify.com/CVE-2021-43010/): SQL injection in safedog:safedog apache (high 7.5)
- [CVE-2021-4301](https://insights.sbomify.com/CVE-2021-4301/): slackero phpwcms sql injection (medium 6.3)
- [CVE-2021-43009](https://insights.sbomify.com/CVE-2021-43009/): Cross-site scripting in opservices:opmon (medium 6.1)
- [CVE-2021-43008](https://insights.sbomify.com/CVE-2021-43008/): Files or Directories Accessible to External Parties in Adminer (high 7.5)
- [CVE-2021-43006](https://insights.sbomify.com/CVE-2021-43006/): Integer overflow in amzetta:zportal dvm tools (high 8.8)
- [CVE-2021-43003](https://insights.sbomify.com/CVE-2021-43003/): Integer overflow in amzetta:zportal windows zclient (high 8.8)
- [CVE-2021-43002](https://insights.sbomify.com/CVE-2021-43002/): Memory corruption in amzetta:zportal dvm tools (high 8.8)
- [CVE-2021-43000](https://insights.sbomify.com/CVE-2021-43000/): Memory corruption in amzetta:zportal windows zclient (high 8.8)
- [CVE-2021-4300](https://insights.sbomify.com/CVE-2021-4300/): ghostlander Halcyon Block Verification main.cpp AddToBlockIndex access control (medium 6.3)
- [CVE-2021-42996](https://insights.sbomify.com/CVE-2021-42996/): Integer overflow in donglify:donglify (high 8.8)
- [CVE-2021-42994](https://insights.sbomify.com/CVE-2021-42994/): Memory corruption in donglify:donglify (high 8.8)
- [CVE-2021-42993](https://insights.sbomify.com/CVE-2021-42993/): Integer overflow in flexihub:flexihub (high 8.8)
- [CVE-2021-42990](https://insights.sbomify.com/CVE-2021-42990/): Memory corruption in flexihub:flexihub (high 8.8)
- [CVE-2021-4299](https://insights.sbomify.com/CVE-2021-4299/): cronvel string-kit naturalSort.js naturalSort redos (medium 4.3)
- [CVE-2021-42988](https://insights.sbomify.com/CVE-2021-42988/): Memory corruption in eltima:usb network gate (high 8.8)
- [CVE-2021-42987](https://insights.sbomify.com/CVE-2021-42987/): Integer overflow in eltima:usb network gate (high 8.8)
- [CVE-2021-42986](https://insights.sbomify.com/CVE-2021-42986/): Integer overflow in nomachine:enterprise client (high 8.8)
- [CVE-2021-42983](https://insights.sbomify.com/CVE-2021-42983/): Memory corruption in nomachine:enterprise client (high 8.8)
- [CVE-2021-42980](https://insights.sbomify.com/CVE-2021-42980/): Memory corruption in nomachine:cloud server (high 8.8)
- [CVE-2021-4298](https://insights.sbomify.com/CVE-2021-4298/): SQL injection in Sipity (medium 5.5)
- [CVE-2021-42979](https://insights.sbomify.com/CVE-2021-42979/): Integer overflow in nomachine:cloud server (high 8.8)
- [CVE-2021-42977](https://insights.sbomify.com/CVE-2021-42977/): Integer overflow in nomachine:enterprise desktop (high 8.8)
- [CVE-2021-42976](https://insights.sbomify.com/CVE-2021-42976/): Memory corruption in nomachine:enterprise desktop (high 8.8)
- [CVE-2021-42973](https://insights.sbomify.com/CVE-2021-42973/): Integer overflow in nomachine:server (high 8.8)
- [CVE-2021-42972](https://insights.sbomify.com/CVE-2021-42972/): Memory corruption in nomachine:server (high 8.8)
- [CVE-2021-42970](https://insights.sbomify.com/CVE-2021-42970/): Cross-site scripting in cxuu:cxuucms (medium 6.1)
- [CVE-2021-4297](https://insights.sbomify.com/CVE-2021-4297/): trampgeek jobe Restapi.php runs_post Privilege Escalation (medium 5.5)
- [CVE-2021-42969](https://insights.sbomify.com/CVE-2021-42969/): Command injection in anaconda:anaconda3 (high 8.8)
- [CVE-2021-42967](https://insights.sbomify.com/CVE-2021-42967/): File upload in xxyopen:novel-plus (critical 9.8)
- [CVE-2021-4296](https://insights.sbomify.com/CVE-2021-4296/): w3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scripting (low 3.5)
- [CVE-2021-42956](https://insights.sbomify.com/CVE-2021-42956/): Information disclosure in zoho:manageengine remote access plus server (high 7.8)
- [CVE-2021-42955](https://insights.sbomify.com/CVE-2021-42955/): Privilege escalation in zohocorp:manageengine remote access plus (high 7.3)
- [CVE-2021-42954](https://insights.sbomify.com/CVE-2021-42954/): Misconfiguration in zohocorp:manageengine remote access plus (high 7.8)
- [CVE-2021-42952](https://insights.sbomify.com/CVE-2021-42952/): Security feature bypass in zepl:zepl (critical 9.9)
- [CVE-2021-42951](https://insights.sbomify.com/CVE-2021-42951/): Code injection in algorithmia:msol (high 8.8)
- [CVE-2021-42950](https://insights.sbomify.com/CVE-2021-42950/): Code injection in zepl:zepl (high 8.8)
- [CVE-2021-4295](https://insights.sbomify.com/CVE-2021-4295/): XML external entity in code-validator-api (medium 5.5)
- [CVE-2021-42949](https://insights.sbomify.com/CVE-2021-42949/): Auth bypass in digitaldruid:hoteldruid (critical 9.8)
- [CVE-2021-42948](https://insights.sbomify.com/CVE-2021-42948/): Information disclosure in digitaldruid:hoteldruid (low 3.7)
- [CVE-2021-42946](https://insights.sbomify.com/CVE-2021-42946/): Cross-site scripting in htmly:htmly (medium 4.8)
- [CVE-2021-42945](https://insights.sbomify.com/CVE-2021-42945/): SQL injection in zzcms:zzcms (critical 9.8)
- [CVE-2021-42943](https://insights.sbomify.com/CVE-2021-42943/): Cross-site scripting in ipplan project:ipplan (medium 5.4)
- [CVE-2021-42940](https://insights.sbomify.com/CVE-2021-42940/): Cross-site scripting in projeqtor:projeqtor (critical 9.9)
- [CVE-2021-4294](https://insights.sbomify.com/CVE-2021-4294/): OpenShift OSIN CheckClientSecret timing discrepancy (low 2.6)
- [CVE-2021-4293](https://insights.sbomify.com/CVE-2021-4293/): gnuboard youngcart5 menu_list_update.php cross site scripting (low 3.5)
- [CVE-2021-42923](https://insights.sbomify.com/CVE-2021-42923/): Other in showmypc:showmypc (high 7.3)
- [CVE-2021-4292](https://insights.sbomify.com/CVE-2021-4292/): OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scripting (low 3.5)
- [CVE-2021-42917](https://insights.sbomify.com/CVE-2021-42917/): Memory corruption in kodi:kodi (medium 5.5)
- [CVE-2021-42913](https://insights.sbomify.com/CVE-2021-42913/): Information disclosure in samsung:syncthru web service (high 7.5)
- [CVE-2021-42912](https://insights.sbomify.com/CVE-2021-42912/): Command injection in fiberhome:aan5506-04-g2g firmware (high 8.8)
- [CVE-2021-42911](https://insights.sbomify.com/CVE-2021-42911/): Memory corruption in draytek:vigor2960 firmware (critical 9.8)
- [CVE-2021-4291](https://insights.sbomify.com/CVE-2021-4291/): OpenMRS Admin UI Module location.gsp cross site scripting (low 3.5)
- [CVE-2021-4290](https://insights.sbomify.com/CVE-2021-4290/): DHBW Fallstudie Login passport.js sql injection (medium 5.5)
- [CVE-2021-42897](https://insights.sbomify.com/CVE-2021-42897/): Command injection in feminer wms project:feminer wms (critical 9.8)
- [CVE-2021-42893](https://insights.sbomify.com/CVE-2021-42893/): Missing authorization in totolink:ex1200t firmware (high 7.5)
- [CVE-2021-42892](https://insights.sbomify.com/CVE-2021-42892/): Hardcoded credentials in totolink:ex1200t firmware (medium 4.3)
- [CVE-2021-42891](https://insights.sbomify.com/CVE-2021-42891/): Missing authorization in totolink:ex1200t firmware (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/79/