# Vulnerabilities published in 2021


- [CVE-2021-42597](https://insights.sbomify.com/CVE-2021-42597/): Cross-site scripting in storage unit rental management system project:storage unit rental management system (medium 5.4)
- [CVE-2021-4259](https://insights.sbomify.com/CVE-2021-4259/): phpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparison (medium 5.0)
- [CVE-2021-42586](https://insights.sbomify.com/CVE-2021-42586/): Memory corruption in gnu:libredwg (high 8.8)
- [CVE-2021-42585](https://insights.sbomify.com/CVE-2021-42585/): Memory corruption in gnu:libredwg (high 8.8)
- [CVE-2021-42584](https://insights.sbomify.com/CVE-2021-42584/): Cross-site scripting in convos:convos (medium 5.4)
- [CVE-2021-42583](https://insights.sbomify.com/CVE-2021-42583/): Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy (high 7.5)
- [CVE-2021-42581](https://insights.sbomify.com/CVE-2021-42581/): Code injection in ramdajs:ramda (critical 9.1)
- [CVE-2021-42580](https://insights.sbomify.com/CVE-2021-42580/): SQL injection in oretnom23:online learning system (critical 9.8)
- [CVE-2021-4258](https://insights.sbomify.com/CVE-2021-4258/): whohas Package Information cleartext transmission (low 3.7)
- [CVE-2021-42577](https://insights.sbomify.com/CVE-2021-42577/): Null dereference in softing:datafeed opc suite (high 7.5)
- [CVE-2021-42576](https://insights.sbomify.com/CVE-2021-42576/): Policies not properly enforced in bluemonday (critical 9.8)
- [CVE-2021-42575](https://insights.sbomify.com/CVE-2021-42575/): Policies not properly enforced in OWASP Java HTML Sanitizer (critical 9.8)
- [CVE-2021-42574](https://insights.sbomify.com/CVE-2021-42574/): Security feature bypass in fedoraproject:fedora (high 8.3)
- [CVE-2021-4257](https://insights.sbomify.com/CVE-2021-4257/): ctrlo lenio Task task.tt cross site scripting (low 3.5)
- [CVE-2021-42568](https://insights.sbomify.com/CVE-2021-42568/): Missing authorization in sonatype:nexus repository manager (medium 4.3)
- [CVE-2021-42567](https://insights.sbomify.com/CVE-2021-42567/): Cross-site Scripting in Apereo CAS (medium 6.1)
- [CVE-2021-42566](https://insights.sbomify.com/CVE-2021-42566/): Cross-site scripting in myfactory:fms (medium 6.1)
- [CVE-2021-42565](https://insights.sbomify.com/CVE-2021-42565/): Cross-site scripting in myfactory:fms (medium 6.1)
- [CVE-2021-42564](https://insights.sbomify.com/CVE-2021-42564/): Open redirect in cryptshare:cryptshare server (medium 5.4)
- [CVE-2021-42563](https://insights.sbomify.com/CVE-2021-42563/): Privilege escalation in ni:ni service locator (high 7.8)
- [CVE-2021-42562](https://insights.sbomify.com/CVE-2021-42562/): Privilege escalation in mitre:caldera (high 8.1)
- [CVE-2021-42561](https://insights.sbomify.com/CVE-2021-42561/): Command injection in mitre:caldera (high 8.8)
- [CVE-2021-42560](https://insights.sbomify.com/CVE-2021-42560/): XML external entity in mitre:caldera (high 8.8)
- [CVE-2021-4256](https://insights.sbomify.com/CVE-2021-4256/): ctrlo lenio index.tt cross site scripting (low 3.5)
- [CVE-2021-42559](https://insights.sbomify.com/CVE-2021-42559/): Command injection in mitre:caldera (high 8.8)
- [CVE-2021-42558](https://insights.sbomify.com/CVE-2021-42558/): Cross-site scripting in mitre:caldera (medium 6.1)
- [CVE-2021-42557](https://insights.sbomify.com/CVE-2021-42557/): Auth bypass in jeedom:jeedom (high 7.5)
- [CVE-2021-42556](https://insights.sbomify.com/CVE-2021-42556/): Path traversal in rasa:rasa x (medium 5.5)
- [CVE-2021-42555](https://insights.sbomify.com/CVE-2021-42555/): Denial of service in pexip:infinity (high 7.5)
- [CVE-2021-42554](https://insights.sbomify.com/CVE-2021-42554/): Memory corruption in insyde:insydeh2o (high 8.2)
- [CVE-2021-42553](https://insights.sbomify.com/CVE-2021-42553/): STM32 USB Host Library Buffer Overflow (medium 6.8)
- [CVE-2021-42552](https://insights.sbomify.com/CVE-2021-42552/): Reflected XSS in Archivista (medium 6.1)
- [CVE-2021-42551](https://insights.sbomify.com/CVE-2021-42551/): Reflected XSS in NetBiblio WebOPAC search functionality (medium 6.1)
- [CVE-2021-42550](https://insights.sbomify.com/CVE-2021-42550/): RCE from attacker with configuration edit priviledges through JNDI lookup (medium 6.6)
- [CVE-2021-4255](https://insights.sbomify.com/CVE-2021-4255/): ctrlo lenio contractor.tt cross site scripting (low 3.5)
- [CVE-2021-42549](https://insights.sbomify.com/CVE-2021-42549/): reflected XSS in search functionality of WP Cloud Plugins - Lets-Box (medium 4.7)
- [CVE-2021-42548](https://insights.sbomify.com/CVE-2021-42548/): reflected XSS in search functionality of WP Cloud Plugins - Share-one-Drive (medium 4.7)
- [CVE-2021-42547](https://insights.sbomify.com/CVE-2021-42547/): reflected XSS in search functionality of WP Cloud Plugins - Out-of-the-Box (medium 4.7)
- [CVE-2021-42546](https://insights.sbomify.com/CVE-2021-42546/): Reflected XSS in search functionality of WP Cloud Plugins - Use-Your-Drive (medium 4.7)
- [CVE-2021-42545](https://insights.sbomify.com/CVE-2021-42545/): Insufficient Session Expiration in TopEase (high 8.1)
- [CVE-2021-42544](https://insights.sbomify.com/CVE-2021-42544/): Lack of Rate limiting in Authentication in TopEase (high 7.5)
- [CVE-2021-42543](https://insights.sbomify.com/CVE-2021-42543/): AzeoTech DAQFactory (high 7.8)
- [CVE-2021-42542](https://insights.sbomify.com/CVE-2021-42542/): Emerson WirelessHART Gateway (high 8.0)
- [CVE-2021-42540](https://insights.sbomify.com/CVE-2021-42540/): Emerson WirelessHART Gateway (high 8.0)
- [CVE-2021-4254](https://insights.sbomify.com/CVE-2021-4254/): ctrlo lenio Notice main.tt cross site scripting (low 3.5)
- [CVE-2021-42539](https://insights.sbomify.com/CVE-2021-42539/): Emerson WirelessHART Gateway (high 8.0)
- [CVE-2021-42538](https://insights.sbomify.com/CVE-2021-42538/): Emerson WirelessHART Gateway (high 8.0)
- [CVE-2021-42537](https://insights.sbomify.com/CVE-2021-42537/): VISAM VBASE Editor Improper Restriction of XML (medium 5.9)
- [CVE-2021-42536](https://insights.sbomify.com/CVE-2021-42536/): Emerson WirelessHART Gateway (high 8.0)
- [CVE-2021-42535](https://insights.sbomify.com/CVE-2021-42535/): VISAM VBASE Editor Cross Site Scripting (medium 5.3)
- [CVE-2021-42534](https://insights.sbomify.com/CVE-2021-42534/): Trane Building Automation Controllers Cross-site Scripting (medium 6.3)
- [CVE-2021-42533](https://insights.sbomify.com/CVE-2021-42533/): Adobe Bridge DCM File Parsing Double Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-42532](https://insights.sbomify.com/CVE-2021-42532/): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (high 7.8)
- [CVE-2021-42531](https://insights.sbomify.com/CVE-2021-42531/): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (high 7.8)
- [CVE-2021-42530](https://insights.sbomify.com/CVE-2021-42530/): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (high 7.8)
- [CVE-2021-4253](https://insights.sbomify.com/CVE-2021-4253/): ctrlo lenio Ticket Lenio.pm cross site scripting (low 3.5)
- [CVE-2021-42529](https://insights.sbomify.com/CVE-2021-42529/): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (high 7.8)
- [CVE-2021-42528](https://insights.sbomify.com/CVE-2021-42528/): XMP-Toolkit Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-42527](https://insights.sbomify.com/CVE-2021-42527/): Adobe Premiere Elements PSD file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-42526](https://insights.sbomify.com/CVE-2021-42526/): Adobe Premiere Elements WAV file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-42525](https://insights.sbomify.com/CVE-2021-42525/): Adobe Animate SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-42524](https://insights.sbomify.com/CVE-2021-42524/): Adobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-42523](https://insights.sbomify.com/CVE-2021-42523/): Information disclosure in colord (high 7.5)
- [CVE-2021-42522](https://insights.sbomify.com/CVE-2021-42522/): Information disclosure in GNOME anjuta (high 7.5)
- [CVE-2021-42521](https://insights.sbomify.com/CVE-2021-42521/): VTK NULL pointer dereference vulnerability (high 7.5)
- [CVE-2021-4252](https://insights.sbomify.com/CVE-2021-4252/): WP-Ban ban-options.php toggle_checkbox cross site scripting (low 3.5)
- [CVE-2021-4251](https://insights.sbomify.com/CVE-2021-4251/): as include.cdn.php getFullURL cross site scripting (low 3.5)
- [CVE-2021-4250](https://insights.sbomify.com/CVE-2021-4250/): cgriego active_attr Regex boolean_typecaster.rb call denial of service (low 3.5)
- [CVE-2021-4249](https://insights.sbomify.com/CVE-2021-4249/): xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop (medium 4.3)
- [CVE-2021-4248](https://insights.sbomify.com/CVE-2021-4248/): kapetan dns Request.cs entropy (medium 5.6)
- [CVE-2021-4247](https://insights.sbomify.com/CVE-2021-4247/): OWASP NodeGoat Query Parameter research.js denial of service (medium 4.3)
- [CVE-2021-4246](https://insights.sbomify.com/CVE-2021-4246/): roxlukas LMeve Login Page sql injection (medium 6.3)
- [CVE-2021-4245](https://insights.sbomify.com/CVE-2021-4245/): chbrown rfc6902 pointer.ts prototype pollution (medium 5.5)
- [CVE-2021-4244](https://insights.sbomify.com/CVE-2021-4244/): yikes-inc-easy-mailchimp-extender Plugin add_field_to_form.php cross site scripting (low 2.6)
- [CVE-2021-4242](https://insights.sbomify.com/CVE-2021-4242/): Sapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injection (medium 6.3)
- [CVE-2021-4241](https://insights.sbomify.com/CVE-2021-4241/): phpservermon User.php setUserLoggedIn predictable algorithm in random number generator (low 2.6)
- [CVE-2021-4240](https://insights.sbomify.com/CVE-2021-4240/): phpservermon User.php generatePasswordResetToken predictable algorithm in random number generator (low 2.6)
- [CVE-2021-42392](https://insights.sbomify.com/CVE-2021-42392/): RCE in H2 Console (critical 9.8)
- [CVE-2021-42391](https://insights.sbomify.com/CVE-2021-42391/): Denial of service in clickhouse (medium 6.5)
- [CVE-2021-42390](https://insights.sbomify.com/CVE-2021-42390/): Denial of service in clickhouse (medium 6.5)
- [CVE-2021-4239](https://insights.sbomify.com/CVE-2021-4239/): Weak encryption and denial of service in github.com/flynn/noise (high 7.5)
- [CVE-2021-42389](https://insights.sbomify.com/CVE-2021-42389/): Denial of service in clickhouse (medium 6.5)
- [CVE-2021-42388](https://insights.sbomify.com/CVE-2021-42388/): Memory corruption in clickhouse (high 8.1)
- [CVE-2021-42387](https://insights.sbomify.com/CVE-2021-42387/): Memory corruption in clickhouse (high 8.1)
- [CVE-2021-42386](https://insights.sbomify.com/CVE-2021-42386/): Use after free in busybox (high 7.2)
- [CVE-2021-42385](https://insights.sbomify.com/CVE-2021-42385/): Use after free in busybox (high 7.2)
- [CVE-2021-42384](https://insights.sbomify.com/CVE-2021-42384/): Use after free in busybox (high 7.2)
- [CVE-2021-42383](https://insights.sbomify.com/CVE-2021-42383/): Use after free in busybox (high 7.2)
- [CVE-2021-42382](https://insights.sbomify.com/CVE-2021-42382/): Use after free in busybox (high 7.2)
- [CVE-2021-42381](https://insights.sbomify.com/CVE-2021-42381/): Use after free in busybox (high 7.2)
- [CVE-2021-42380](https://insights.sbomify.com/CVE-2021-42380/): Use after free in busybox (high 7.2)
- [CVE-2021-4238](https://insights.sbomify.com/CVE-2021-4238/): Insufficient randomness in github.com/Masterminds/goutils (critical 9.1)
- [CVE-2021-42379](https://insights.sbomify.com/CVE-2021-42379/): Use after free in busybox (high 7.2)
- [CVE-2021-42378](https://insights.sbomify.com/CVE-2021-42378/): Use after free in busybox (high 7.2)
- [CVE-2021-42377](https://insights.sbomify.com/CVE-2021-42377/): Memory corruption in busybox (critical 9.8)
- [CVE-2021-42376](https://insights.sbomify.com/CVE-2021-42376/): Null dereference in busybox (medium 5.5)
- [CVE-2021-42375](https://insights.sbomify.com/CVE-2021-42375/): Denial of service in busybox (medium 5.5)
- [CVE-2021-42374](https://insights.sbomify.com/CVE-2021-42374/): Memory corruption in busybox (medium 5.3)
- [CVE-2021-42373](https://insights.sbomify.com/CVE-2021-42373/): Null dereference in busybox (medium 5.5)
- [CVE-2021-42372](https://insights.sbomify.com/CVE-2021-42372/): Command injection in xorux:lpar2rrd (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/82/