# Vulnerabilities published in 2021


- [CVE-2021-42371](https://insights.sbomify.com/CVE-2021-42371/): Hardcoded credentials in xorux:lpar2rrd (critical 9.8)
- [CVE-2021-42370](https://insights.sbomify.com/CVE-2021-42370/): Information disclosure in xorux:lpar2rrd (high 7.5)
- [CVE-2021-42369](https://insights.sbomify.com/CVE-2021-42369/): SQL injection in zucchetti:imagicle uc suite (critical 9.9)
- [CVE-2021-42367](https://insights.sbomify.com/CVE-2021-42367/): Variation Swatches for WooCommerce <= 2.1.1 Authenticated Stored Cross-Site Scripting (medium 6.4)
- [CVE-2021-42365](https://insights.sbomify.com/CVE-2021-42365/): Asgaros Forums <= 1.15.13 Authenticated Stored XSS (medium 4.8)
- [CVE-2021-42364](https://insights.sbomify.com/CVE-2021-42364/): Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-42363](https://insights.sbomify.com/CVE-2021-42363/): Preview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-42362](https://insights.sbomify.com/CVE-2021-42362/): WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload (high 8.8)
- [CVE-2021-42361](https://insights.sbomify.com/CVE-2021-42361/): Contact Form Email <= 1.3.24 Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-42360](https://insights.sbomify.com/CVE-2021-42360/): Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSS (high 7.6)
- [CVE-2021-4236](https://insights.sbomify.com/CVE-2021-4236/): Panic or authentication bypass in github.com/ecnepsnai/web (critical 9.8)
- [CVE-2021-42359](https://insights.sbomify.com/CVE-2021-42359/): WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion (high 7.5)
- [CVE-2021-42358](https://insights.sbomify.com/CVE-2021-42358/): Contact Form With Captcha <= 1.6.2 Cross-Site Request Forgery to Reflected Cross-Site Scripting (high 8.8)
- [CVE-2021-42357](https://insights.sbomify.com/CVE-2021-42357/): DOM based XSS Vulnerability in Apache Knox (medium 6.1)
- [CVE-2021-4235](https://insights.sbomify.com/CVE-2021-4235/): Denial of service in gopkg.in/yaml.v2 (medium 5.5)
- [CVE-2021-42343](https://insights.sbomify.com/CVE-2021-42343/): Workers for local Dask clusters mistakenly listened on public interfaces (critical 9.8)
- [CVE-2021-42342](https://insights.sbomify.com/CVE-2021-42342/): File upload in embedthis:goahead (critical 9.8)
- [CVE-2021-42341](https://insights.sbomify.com/CVE-2021-42341/): Memory corruption in openrc project:openrc (high 7.5)
- [CVE-2021-42340](https://insights.sbomify.com/CVE-2021-42340/): DoS via memory leak with WebSocket connections (high 7.5)
- [CVE-2021-4234](https://insights.sbomify.com/CVE-2021-4234/): Denial of service in OpenVPN Access Server (high 7.5)
- [CVE-2021-42338](https://insights.sbomify.com/CVE-2021-42338/): 4MOSAn GCB Doctor - Improper Authorization (critical 9.8)
- [CVE-2021-42337](https://insights.sbomify.com/CVE-2021-42337/): TVN-202110009 (medium 4.3)
- [CVE-2021-42336](https://insights.sbomify.com/CVE-2021-42336/): Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization (medium 4.3)
- [CVE-2021-42335](https://insights.sbomify.com/CVE-2021-42335/): Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS (medium 5.4)
- [CVE-2021-42334](https://insights.sbomify.com/CVE-2021-42334/): Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2 (high 8.8)
- [CVE-2021-42333](https://insights.sbomify.com/CVE-2021-42333/): Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1 (high 8.8)
- [CVE-2021-42332](https://insights.sbomify.com/CVE-2021-42332/): ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-3 (medium 4.3)
- [CVE-2021-42331](https://insights.sbomify.com/CVE-2021-42331/): ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2 (medium 5.4)
- [CVE-2021-42330](https://insights.sbomify.com/CVE-2021-42330/): ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1 (high 8.8)
- [CVE-2021-42329](https://insights.sbomify.com/CVE-2021-42329/): ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS (medium 5.4)
- [CVE-2021-42327](https://insights.sbomify.com/CVE-2021-42327/): Memory corruption in fedoraproject:fedora (medium 6.7)
- [CVE-2021-42326](https://insights.sbomify.com/CVE-2021-42326/): Information disclosure in debian:debian linux (medium 5.3)
- [CVE-2021-42325](https://insights.sbomify.com/CVE-2021-42325/): Froxlor SQL injection vulnerability (critical 9.8)
- [CVE-2021-42324](https://insights.sbomify.com/CVE-2021-42324/): Command injection in dcnglobal:s4600-10p-si firmware (high 7.4)
- [CVE-2021-42323](https://insights.sbomify.com/CVE-2021-42323/): Azure RTOS Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-42322](https://insights.sbomify.com/CVE-2021-42322/): Visual Studio Code Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-42321](https://insights.sbomify.com/CVE-2021-42321/): Microsoft Exchange Server Remote Code Execution (high 8.8, exploited in the wild)
- [CVE-2021-42320](https://insights.sbomify.com/CVE-2021-42320/): Microsoft SharePoint Server Spoofing Vulnerability (high 8.0)
- [CVE-2021-4232](https://insights.sbomify.com/CVE-2021-4232/): Zoo Management System manage-ticket.php cross site scripting (low 3.5)
- [CVE-2021-42319](https://insights.sbomify.com/CVE-2021-42319/): Visual Studio Elevation of Privilege Vulnerability (medium 4.7)
- [CVE-2021-42316](https://insights.sbomify.com/CVE-2021-42316/): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-42315](https://insights.sbomify.com/CVE-2021-42315/): Microsoft Defender for IoT Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-42314](https://insights.sbomify.com/CVE-2021-42314/): Microsoft Defender for IoT Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-42313](https://insights.sbomify.com/CVE-2021-42313/): Microsoft Defender for IoT Remote Code Execution Vulnerability (critical 10.0)
- [CVE-2021-42312](https://insights.sbomify.com/CVE-2021-42312/): Microsoft Defender for IoT Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-42311](https://insights.sbomify.com/CVE-2021-42311/): Microsoft Defender for IoT Remote Code Execution Vulnerability (critical 10.0)
- [CVE-2021-42310](https://insights.sbomify.com/CVE-2021-42310/): Microsoft Defender for IoT Remote Code Execution Vulnerability (high 8.1)
- [CVE-2021-4231](https://insights.sbomify.com/CVE-2021-4231/): Angular Comment cross site scripting (low 3.5)
- [CVE-2021-42309](https://insights.sbomify.com/CVE-2021-42309/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-42308](https://insights.sbomify.com/CVE-2021-42308/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (low 3.1)
- [CVE-2021-42307](https://insights.sbomify.com/CVE-2021-42307/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 4.3)
- [CVE-2021-42306](https://insights.sbomify.com/CVE-2021-42306/): Azure Active Directory Information Disclosure Vulnerability (high 8.1)
- [CVE-2021-42305](https://insights.sbomify.com/CVE-2021-42305/): Microsoft Exchange Server Spoofing Vulnerability (medium 6.5)
- [CVE-2021-42304](https://insights.sbomify.com/CVE-2021-42304/): Azure RTOS Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2021-42303](https://insights.sbomify.com/CVE-2021-42303/): Azure RTOS Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2021-42302](https://insights.sbomify.com/CVE-2021-42302/): Azure RTOS Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2021-42301](https://insights.sbomify.com/CVE-2021-42301/): Azure RTOS Information Disclosure Vulnerability (low 3.3)
- [CVE-2021-42300](https://insights.sbomify.com/CVE-2021-42300/): Azure Sphere Tampering Vulnerability (medium 6.0)
- [CVE-2021-4230](https://insights.sbomify.com/CVE-2021-4230/): Airfield Online MySQL Backup improper authentication (low 3.7)
- [CVE-2021-42299](https://insights.sbomify.com/CVE-2021-42299/): Microsoft Surface Pro 3 Security Feature Bypass Vulnerability (medium 5.6)
- [CVE-2021-42298](https://insights.sbomify.com/CVE-2021-42298/): Microsoft Defender Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-42297](https://insights.sbomify.com/CVE-2021-42297/): Windows 10 Update Assistant Elevation of Privilege Vulnerability (medium 5.0)
- [CVE-2021-42296](https://insights.sbomify.com/CVE-2021-42296/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-42295](https://insights.sbomify.com/CVE-2021-42295/): Visual Basic for Applications Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-42294](https://insights.sbomify.com/CVE-2021-42294/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 7.2)
- [CVE-2021-42293](https://insights.sbomify.com/CVE-2021-42293/): Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2021-42292](https://insights.sbomify.com/CVE-2021-42292/): Microsoft Excel Security Feature Bypass (high 7.8, exploited in the wild)
- [CVE-2021-42291](https://insights.sbomify.com/CVE-2021-42291/): Active Directory Domain Services Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2021-4229](https://insights.sbomify.com/CVE-2021-4229/): ua-parser-js Crypto Mining backdoor (medium 5.0)
- [CVE-2021-42288](https://insights.sbomify.com/CVE-2021-42288/): Windows Hello Security Feature Bypass Vulnerability (medium 5.7)
- [CVE-2021-42287](https://insights.sbomify.com/CVE-2021-42287/): Microsoft Active Directory Domain Services Privilege Escalation (high 7.5, exploited in the wild)
- [CVE-2021-42286](https://insights.sbomify.com/CVE-2021-42286/): Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-42285](https://insights.sbomify.com/CVE-2021-42285/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-42284](https://insights.sbomify.com/CVE-2021-42284/): Windows Hyper-V Denial of Service Vulnerability (medium 6.8)
- [CVE-2021-42283](https://insights.sbomify.com/CVE-2021-42283/): NTFS Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2021-42282](https://insights.sbomify.com/CVE-2021-42282/): Active Directory Domain Services Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2021-42280](https://insights.sbomify.com/CVE-2021-42280/): Windows Feedback Hub Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2021-4228](https://insights.sbomify.com/CVE-2021-4228/): Hard-coded TLS Certificate (medium 5.8)
- [CVE-2021-42279](https://insights.sbomify.com/CVE-2021-42279/): Chakra Scripting Engine Memory Corruption Vulnerability (medium 4.2)
- [CVE-2021-42278](https://insights.sbomify.com/CVE-2021-42278/): Microsoft Active Directory Domain Services Privilege Escalation (high 7.5, exploited in the wild)
- [CVE-2021-42277](https://insights.sbomify.com/CVE-2021-42277/): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2021-42276](https://insights.sbomify.com/CVE-2021-42276/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-42275](https://insights.sbomify.com/CVE-2021-42275/): Microsoft COM for Windows Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-42274](https://insights.sbomify.com/CVE-2021-42274/): Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability (medium 6.8)
- [CVE-2021-42272](https://insights.sbomify.com/CVE-2021-42272/): Adobe Animate GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-42271](https://insights.sbomify.com/CVE-2021-42271/): Adobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-42270](https://insights.sbomify.com/CVE-2021-42270/): Adobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-4227](https://insights.sbomify.com/CVE-2021-4227/): Ark Comment Editor <= 2.15.6 - Iframe Injection via Comment (medium 5.3)
- [CVE-2021-42269](https://insights.sbomify.com/CVE-2021-42269/): Adobe Animate FLA File Parsing Use After Free Remote Code Execution (high 7.8)
- [CVE-2021-42268](https://insights.sbomify.com/CVE-2021-42268/): Adobe Animate FLA File Parsing Null Pointer Dereference Application Denial of Service (medium 5.5)
- [CVE-2021-42267](https://insights.sbomify.com/CVE-2021-42267/): Adobe Animate FLA File Parsing Memory Corruption Arbitrary Code Execution (high 7.8)
- [CVE-2021-42266](https://insights.sbomify.com/CVE-2021-42266/): Adobe Animate FLA File Parsing Memory Corruption Arbitrary Code Execution (high 7.8)
- [CVE-2021-42265](https://insights.sbomify.com/CVE-2021-42265/): Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-42264](https://insights.sbomify.com/CVE-2021-42264/): Adobe Premiere Pro Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-42263](https://insights.sbomify.com/CVE-2021-42263/): Adobe Premiere Pro Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-42262](https://insights.sbomify.com/CVE-2021-42262/): Denial of service in softing:datafeed opc suite (medium 6.5)
- [CVE-2021-42261](https://insights.sbomify.com/CVE-2021-42261/): Path traversal in revisorlab:video management system (high 7.5)
- [CVE-2021-42260](https://insights.sbomify.com/CVE-2021-42260/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2021-4226](https://insights.sbomify.com/CVE-2021-4226/): RSFirewall < 1.1.25 - IP Block Bypass (critical 9.8)
- [CVE-2021-42258](https://insights.sbomify.com/CVE-2021-42258/): BQE BillQuick Web Suite SQL Injection (critical 9.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/83/