# Vulnerabilities published in 2021


- [CVE-2021-42890](https://insights.sbomify.com/CVE-2021-42890/): Command injection in totolink:ex1200t firmware (critical 9.8)
- [CVE-2021-4289](https://insights.sbomify.com/CVE-2021-4289/): OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting (low 3.5)
- [CVE-2021-42889](https://insights.sbomify.com/CVE-2021-42889/): Missing authorization in totolink:ex1200t firmware (high 7.5)
- [CVE-2021-42888](https://insights.sbomify.com/CVE-2021-42888/): Command injection in totolink:ex1200t firmware (critical 9.8)
- [CVE-2021-42887](https://insights.sbomify.com/CVE-2021-42887/): Auth bypass in totolink:ex1200t firmware (critical 9.8)
- [CVE-2021-42886](https://insights.sbomify.com/CVE-2021-42886/): Information disclosure in totolink:ex1200t firmware (high 7.5)
- [CVE-2021-42885](https://insights.sbomify.com/CVE-2021-42885/): Command injection in totolink:ex1200t firmware (critical 9.8)
- [CVE-2021-42884](https://insights.sbomify.com/CVE-2021-42884/): Command injection in totolink:ex1200t firmware (critical 9.8)
- [CVE-2021-4288](https://insights.sbomify.com/CVE-2021-4288/): OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting (low 3.5)
- [CVE-2021-42877](https://insights.sbomify.com/CVE-2021-42877/): Denial of service in totolink:ex1200t firmware (high 7.5)
- [CVE-2021-42875](https://insights.sbomify.com/CVE-2021-42875/): Command injection in totolink:ex1200t firmware (critical 9.8)
- [CVE-2021-42872](https://insights.sbomify.com/CVE-2021-42872/): Command injection in totolink:ex1200t firmware (critical 9.8)
- [CVE-2021-42870](https://insights.sbomify.com/CVE-2021-42870/): Memory corruption in accel-ppp:accel-ppp (high 7.5)
- [CVE-2021-4287](https://insights.sbomify.com/CVE-2021-4287/): ReFirm Labs binwalk Archive Extraction extractor.py symlink (medium 5.0)
- [CVE-2021-42869](https://insights.sbomify.com/CVE-2021-42869/): Cross-site scripting in chikitsa:patient management software (medium 4.8)
- [CVE-2021-42868](https://insights.sbomify.com/CVE-2021-42868/): Cross-site scripting in chikitsa:patient management software (medium 4.8)
- [CVE-2021-42867](https://insights.sbomify.com/CVE-2021-42867/): Cross-site scripting in htmly:htmly (medium 4.8)
- [CVE-2021-42866](https://insights.sbomify.com/CVE-2021-42866/): Cross-site scripting in pixelimity:pixelimity (medium 4.8)
- [CVE-2021-42863](https://insights.sbomify.com/CVE-2021-42863/): Memory corruption in jerryscript:jerryscript (critical 9.8)
- [CVE-2021-42860](https://insights.sbomify.com/CVE-2021-42860/): Memory corruption in mini-xml project:mini-xml (high 7.5)
- [CVE-2021-4286](https://insights.sbomify.com/CVE-2021-4286/): cocagne pysrp _ctsrp.py calculate_x information exposure (low 2.6)
- [CVE-2021-42859](https://insights.sbomify.com/CVE-2021-42859/): Denial of service in mini-xml project:mini-xml (high 7.5)
- [CVE-2021-42857](https://insights.sbomify.com/CVE-2021-42857/): Directory Traversal Partial Write at AgentDaServlet (medium 5.3)
- [CVE-2021-42856](https://insights.sbomify.com/CVE-2021-42856/): Reflected Cross-site Scripting at DsaDataTest (medium 4.7)
- [CVE-2021-42855](https://insights.sbomify.com/CVE-2021-42855/): Local privilege escalation due to misconfigured write permission on .debug_command.config file (high 7.8)
- [CVE-2021-42854](https://insights.sbomify.com/CVE-2021-42854/): Directory Traversal Read/Write/Delete at PluginServlet (critical 9.8)
- [CVE-2021-42853](https://insights.sbomify.com/CVE-2021-42853/): Directory Traversal Delete/Read at AgentDiagnosticServlet (critical 9.1)
- [CVE-2021-42852](https://insights.sbomify.com/CVE-2021-42852/): Command injection in Personal Cloud Storage A1 (high 8.0)
- [CVE-2021-42851](https://insights.sbomify.com/CVE-2021-42851/): Missing authorization in Personal Cloud Storage A1 (medium 6.3)
- [CVE-2021-42850](https://insights.sbomify.com/CVE-2021-42850/): Hardcoded credentials in Personal Cloud Storage A1 (high 8.8)
- [CVE-2021-4285](https://insights.sbomify.com/CVE-2021-4285/): Nagios NCPA tail.html cross site scripting (low 3.5)
- [CVE-2021-42849](https://insights.sbomify.com/CVE-2021-42849/): Hardcoded credentials in Personal Cloud Storage A1 (medium 6.8)
- [CVE-2021-42848](https://insights.sbomify.com/CVE-2021-42848/): Missing authorization in Personal Cloud Storage A1 (medium 4.3)
- [CVE-2021-42847](https://insights.sbomify.com/CVE-2021-42847/): File upload in zohocorp:manageengine adaudit plus (critical 9.8)
- [CVE-2021-42841](https://insights.sbomify.com/CVE-2021-42841/): Cross-site scripting in practo:insta hms (medium 6.1)
- [CVE-2021-42840](https://insights.sbomify.com/CVE-2021-42840/): File upload in salesagility:suitecrm (high 8.8)
- [CVE-2021-4284](https://insights.sbomify.com/CVE-2021-4284/): OpenMRS HTML Form Entry UI Framework Integration Module cross site scripting (low 3.5)
- [CVE-2021-42839](https://insights.sbomify.com/CVE-2021-42839/): Grand Vice info Co. webopac7 - Arbitrary File Upload (high 8.8)
- [CVE-2021-42838](https://insights.sbomify.com/CVE-2021-42838/): Grand Vice info Co. webopac7 - Reflected XSS (medium 6.1)
- [CVE-2021-42837](https://insights.sbomify.com/CVE-2021-42837/): Auth bypass in talend:data catalog (critical 9.8)
- [CVE-2021-42836](https://insights.sbomify.com/CVE-2021-42836/): Duplicate Advisory: ReDoS via crafted JSON input in GJSON (high 7.5)
- [CVE-2021-42835](https://insights.sbomify.com/CVE-2021-42835/): Race condition in plex:media server (high 7.0)
- [CVE-2021-42833](https://insights.sbomify.com/CVE-2021-42833/): Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.x (critical 9.3)
- [CVE-2021-4283](https://insights.sbomify.com/CVE-2021-4283/): FreeBPX voicemail Settings ssettings.php cross site scripting (low 2.4)
- [CVE-2021-4282](https://insights.sbomify.com/CVE-2021-4282/): FreePBX voicemail page.voicemail.php cross site scripting (low 3.5)
- [CVE-2021-42811](https://insights.sbomify.com/CVE-2021-42811/): Vulnerability in SafeNet KeySecure (low 3.3)
- [CVE-2021-42810](https://insights.sbomify.com/CVE-2021-42810/): Privilege escalation in SafeNet Authentication Service (high 7.8)
- [CVE-2021-4281](https://insights.sbomify.com/CVE-2021-4281/): Brave UX for-the-badge combine-prs.yml os command injection (medium 4.6)
- [CVE-2021-42809](https://insights.sbomify.com/CVE-2021-42809/): The Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link Library (medium 6.5)
- [CVE-2021-42808](https://insights.sbomify.com/CVE-2021-42808/): Privilege escalation in Sentinel Protection Installer (medium 6.5)
- [CVE-2021-4280](https://insights.sbomify.com/CVE-2021-4280/): styler_praat_scripts Slash file_segmenter.praat denial of service (medium 4.3)
- [CVE-2021-42797](https://insights.sbomify.com/CVE-2021-42797/): Path traversal in aveva:edge (high 7.5)
- [CVE-2021-42796](https://insights.sbomify.com/CVE-2021-42796/): Command injection in aveva:edge (critical 9.8)
- [CVE-2021-42794](https://insights.sbomify.com/CVE-2021-42794/): Server-side request forgery in aveva:edge (medium 5.3)
- [CVE-2021-42791](https://insights.sbomify.com/CVE-2021-42791/): Missing authorization in veridiumid:veridiumad (high 7.3)
- [CVE-2021-4279](https://insights.sbomify.com/CVE-2021-4279/): Starcounter-Jack JSON-Patch prototype pollution (medium 6.3)
- [CVE-2021-42787](https://insights.sbomify.com/CVE-2021-42787/): Directory Traversal Write/Delete/Partial Read at AgentConfigurationServlet (critical 9.4)
- [CVE-2021-42786](https://insights.sbomify.com/CVE-2021-42786/): Remote Code Execution at AgentControllerServlet (critical 9.8)
- [CVE-2021-42785](https://insights.sbomify.com/CVE-2021-42785/): Buffer Overflow in tvnviewer.exe via Crafted Packet in TightVNC Viewer 2.8.59 (critical 9.8)
- [CVE-2021-42784](https://insights.sbomify.com/CVE-2021-42784/): OS Command Injection in debug_fcgi in D-Link DWR-932C E1 Firmware 1.0.0.4 (critical 9.8)
- [CVE-2021-42783](https://insights.sbomify.com/CVE-2021-42783/): Missing Authentication in debug_post_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4 (critical 9.8)
- [CVE-2021-42782](https://insights.sbomify.com/CVE-2021-42782/): Memory corruption in opensc (medium 5.3)
- [CVE-2021-42781](https://insights.sbomify.com/CVE-2021-42781/): Memory corruption in opensc (medium 5.3)
- [CVE-2021-42780](https://insights.sbomify.com/CVE-2021-42780/): Use after free in opensc (medium 5.3)
- [CVE-2021-4278](https://insights.sbomify.com/CVE-2021-4278/): cronvel tree-kit prototype pollution (medium 5.5)
- [CVE-2021-42779](https://insights.sbomify.com/CVE-2021-42779/): Use after free in opensc (medium 5.3)
- [CVE-2021-42778](https://insights.sbomify.com/CVE-2021-42778/): Memory corruption in opensc (medium 5.3)
- [CVE-2021-42777](https://insights.sbomify.com/CVE-2021-42777/): Code injection in stimulsoft:reports (critical 9.8)
- [CVE-2021-42776](https://insights.sbomify.com/CVE-2021-42776/): XML external entity in cloverdx:cloverdx (high 7.7)
- [CVE-2021-42775](https://insights.sbomify.com/CVE-2021-42775/): Path traversal in broadcom:emulex hba manager (critical 9.1)
- [CVE-2021-42774](https://insights.sbomify.com/CVE-2021-42774/): Memory corruption in broadcom:emulex hba manager (critical 9.8)
- [CVE-2021-42773](https://insights.sbomify.com/CVE-2021-42773/): Path traversal in broadcom:emulex hba manager (high 7.5)
- [CVE-2021-42772](https://insights.sbomify.com/CVE-2021-42772/): Memory corruption in broadcom:emulex hba manager (critical 9.8)
- [CVE-2021-42771](https://insights.sbomify.com/CVE-2021-42771/): Directory Traversal in Babel (high 7.8)
- [CVE-2021-42770](https://insights.sbomify.com/CVE-2021-42770/): Cross-site scripting in opnsense:opnsense (medium 6.1)
- [CVE-2021-4277](https://insights.sbomify.com/CVE-2021-4277/): fredsmith utils Filename screenshot_sync predictable state (low 2.6)
- [CVE-2021-42767](https://insights.sbomify.com/CVE-2021-42767/): Neo4j Graph Database vulnerable to Path Traversal (critical 9.1)
- [CVE-2021-42766](https://insights.sbomify.com/CVE-2021-42766/): Denial of service in proof-of-stake ethereum project:proof-of-stake ethereum (critical 9.1)
- [CVE-2021-42765](https://insights.sbomify.com/CVE-2021-42765/): Denial of service in proof-of-stake ethereum project:proof-of-stake ethereum (high 7.5)
- [CVE-2021-42764](https://insights.sbomify.com/CVE-2021-42764/): Business logic in proof-of-stake ethereum project:proof-of-stake ethereum (critical 9.1)
- [CVE-2021-42763](https://insights.sbomify.com/CVE-2021-42763/): Information disclosure in couchbase:couchbase server (high 7.5)
- [CVE-2021-42762](https://insights.sbomify.com/CVE-2021-42762/): Security feature bypass in debian:debian linux (medium 5.3)
- [CVE-2021-42761](https://insights.sbomify.com/CVE-2021-42761/): Auth bypass in FortiWeb (high 8.5)
- [CVE-2021-42760](https://insights.sbomify.com/CVE-2021-42760/): SQL injection in Fortinet FortiWLM (high 8.8)
- [CVE-2021-4276](https://insights.sbomify.com/CVE-2021-4276/): SQL injection in hedgehog (medium 4.1)
- [CVE-2021-42759](https://insights.sbomify.com/CVE-2021-42759/): Command injection in Fortinet Meru AP (medium 6.7)
- [CVE-2021-42758](https://insights.sbomify.com/CVE-2021-42758/): Privilege escalation in Fortinet FortiWLC (high 8.8)
- [CVE-2021-42757](https://insights.sbomify.com/CVE-2021-42757/): Memory corruption in FortiADC (medium 6.3)
- [CVE-2021-42756](https://insights.sbomify.com/CVE-2021-42756/): Memory corruption in FortiWeb (critical 9.3)
- [CVE-2021-42755](https://insights.sbomify.com/CVE-2021-42755/): Integer overflow in Fortinet FortiSwitch, FortiRecorder, FortiVoiceEnterprise, FortiOS, FortiProxy (medium 4.3)
- [CVE-2021-42754](https://insights.sbomify.com/CVE-2021-42754/): Code injection in Fortinet FortiClientMac (low 3.2)
- [CVE-2021-42753](https://insights.sbomify.com/CVE-2021-42753/): Path traversal in fortinet:fortiweb (high 8.1)
- [CVE-2021-42752](https://insights.sbomify.com/CVE-2021-42752/): Cross-site scripting in Fortinet FortiWLM (medium 5.4)
- [CVE-2021-42751](https://insights.sbomify.com/CVE-2021-42751/): Cross-site scripting in thingsboard:thingsboard (medium 4.8)
- [CVE-2021-42750](https://insights.sbomify.com/CVE-2021-42750/): Cross-site scripting in thingsboard:thingsboard (medium 4.8)
- [CVE-2021-4275](https://insights.sbomify.com/CVE-2021-4275/): katlings pyambic-pentameter cross-site request forgery (medium 4.3)
- [CVE-2021-42749](https://insights.sbomify.com/CVE-2021-42749/): Security feature bypass in fastlinemedia:beaver themer (medium 5.3)
- [CVE-2021-42748](https://insights.sbomify.com/CVE-2021-42748/): Security feature bypass in fastlinemedia:beaver builder (medium 5.3)
- [CVE-2021-42744](https://insights.sbomify.com/CVE-2021-42744/): Philips MRI 1.5T and 3T Information Exposure (medium 5.9)
- [CVE-2021-42743](https://insights.sbomify.com/CVE-2021-42743/): Local privilege escalation via a default path in Splunk Enterprise Windows (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/80/