# Vulnerabilities published in 2021


- [CVE-2021-42257](https://insights.sbomify.com/CVE-2021-42257/): Security feature bypass in check smart project:check smart (high 7.1)
- [CVE-2021-42255](https://insights.sbomify.com/CVE-2021-42255/): Privilege escalation in blueplanet-works:appguard (high 7.8)
- [CVE-2021-42254](https://insights.sbomify.com/CVE-2021-42254/): Misconfiguration in beyondtrust:privilege management for windows (high 7.8)
- [CVE-2021-42252](https://insights.sbomify.com/CVE-2021-42252/): Memory corruption in linux:linux kernel (high 7.8)
- [CVE-2021-42250](https://insights.sbomify.com/CVE-2021-42250/): Possible log injection (medium 6.5)
- [CVE-2021-4225](https://insights.sbomify.com/CVE-2021-4225/): SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload (high 8.8)
- [CVE-2021-42245](https://insights.sbomify.com/CVE-2021-42245/): Cross-site scripting in flatcore:flatcore-cms (medium 6.1)
- [CVE-2021-42244](https://insights.sbomify.com/CVE-2021-42244/): Cross-site scripting in notimoo project:notimoo (medium 6.1)
- [CVE-2021-42242](https://insights.sbomify.com/CVE-2021-42242/): Command injection in jflyfox:jfinal cms (critical 9.8)
- [CVE-2021-42237](https://insights.sbomify.com/CVE-2021-42237/): Sitecore XP Remote Command Execution (critical 9.8, exploited in the wild)
- [CVE-2021-42235](https://insights.sbomify.com/CVE-2021-42235/): SQL injection in enhancesoft:osticket (critical 9.8)
- [CVE-2021-42233](https://insights.sbomify.com/CVE-2021-42233/): Cross-site scripting in simple blog project:simple blog (medium 5.4)
- [CVE-2021-42232](https://insights.sbomify.com/CVE-2021-42232/): Command injection in tp-link:archer a7 firmware (critical 9.8)
- [CVE-2021-42230](https://insights.sbomify.com/CVE-2021-42230/): Command injection in seowonintech:130-slc firmware (critical 9.8)
- [CVE-2021-42228](https://insights.sbomify.com/CVE-2021-42228/): Cross Site Request Forgery in kindeditor (high 8.8)
- [CVE-2021-42227](https://insights.sbomify.com/CVE-2021-42227/): Cross site scripting in kindeditor (medium 6.1)
- [CVE-2021-42224](https://insights.sbomify.com/CVE-2021-42224/): SQL injection in phpgurukul:ifsc code finder (critical 9.8)
- [CVE-2021-42223](https://insights.sbomify.com/CVE-2021-42223/): Cross-site scripting in phpgurukul:online dj booking management system (medium 6.1)
- [CVE-2021-42220](https://insights.sbomify.com/CVE-2021-42220/): Dolibarr Cross Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2021-4222](https://insights.sbomify.com/CVE-2021-4222/): WP Paginate < 2.1.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-42219](https://insights.sbomify.com/CVE-2021-42219/): Denial of service in go-ethereum (high 7.5)
- [CVE-2021-42218](https://insights.sbomify.com/CVE-2021-42218/): Denial of service in rice:open motion planning library (high 7.5)
- [CVE-2021-42216](https://insights.sbomify.com/CVE-2021-42216/): Weak cryptography in anonaddy:anonaddy (critical 9.8)
- [CVE-2021-4221](https://insights.sbomify.com/CVE-2021-4221/): Other in Firefox (medium 4.3)
- [CVE-2021-42205](https://insights.sbomify.com/CVE-2021-42205/): Denial of service in lenovo:elan miniport touchpad driver (medium 4.7)
- [CVE-2021-42204](https://insights.sbomify.com/CVE-2021-42204/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2021-42203](https://insights.sbomify.com/CVE-2021-42203/): Use after free in swftools:swftools (high 7.8)
- [CVE-2021-42202](https://insights.sbomify.com/CVE-2021-42202/): Null dereference in swftools:swftools (medium 5.5)
- [CVE-2021-42201](https://insights.sbomify.com/CVE-2021-42201/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2021-42200](https://insights.sbomify.com/CVE-2021-42200/): Null dereference in swftools:swftools (medium 5.5)
- [CVE-2021-42199](https://insights.sbomify.com/CVE-2021-42199/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2021-42198](https://insights.sbomify.com/CVE-2021-42198/): Null dereference in swftools:swftools (medium 5.5)
- [CVE-2021-42197](https://insights.sbomify.com/CVE-2021-42197/): Denial of service in swftools:swftools (high 7.8)
- [CVE-2021-42196](https://insights.sbomify.com/CVE-2021-42196/): Null dereference in swftools:swftools (medium 5.5)
- [CVE-2021-42195](https://insights.sbomify.com/CVE-2021-42195/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2021-42194](https://insights.sbomify.com/CVE-2021-42194/): XML external entity in eyoucms:eyoucms (high 7.2)
- [CVE-2021-42193](https://insights.sbomify.com/CVE-2021-42193/): Cross-site scripting in nopcommerce:nopcommerce (medium 6.1)
- [CVE-2021-42192](https://insights.sbomify.com/CVE-2021-42192/): Privilege escalation in konga project:konga (high 8.8)
- [CVE-2021-4219](https://insights.sbomify.com/CVE-2021-4219/): Denial of service in imagemagick (medium 5.5)
- [CVE-2021-42185](https://insights.sbomify.com/CVE-2021-42185/): SQL injection in wdja:wdja (critical 9.8)
- [CVE-2021-42183](https://insights.sbomify.com/CVE-2021-42183/): Path traversal in masacms:masacms (high 7.5)
- [CVE-2021-4218](https://insights.sbomify.com/CVE-2021-4218/): Denial of service in kernel (medium 5.5)
- [CVE-2021-42171](https://insights.sbomify.com/CVE-2021-42171/): Unrestricted Upload of File with Dangerous Type in Zenario CMS (high 7.2)
- [CVE-2021-4217](https://insights.sbomify.com/CVE-2021-4217/): Null dereference in unzip (low 3.3)
- [CVE-2021-42169](https://insights.sbomify.com/CVE-2021-42169/): SQL injection in simple payroll system with dynamic tax bracket project:simple payroll system with dynamic tax bracket (critical 9.8)
- [CVE-2021-42168](https://insights.sbomify.com/CVE-2021-42168/): Cross-site scripting in try my recipe project:try my recipe (medium 6.1)
- [CVE-2021-42165](https://insights.sbomify.com/CVE-2021-42165/): Command injection in mitrastar:gpt-2541gnac-n1 firmware (high 8.8)
- [CVE-2021-4216](https://insights.sbomify.com/CVE-2021-4216/): Denial of service in mupdf (medium 5.5)
- [CVE-2021-42147](https://insights.sbomify.com/CVE-2021-42147/): Memory corruption in contiki-ng:tinydtls (critical 9.1)
- [CVE-2021-42146](https://insights.sbomify.com/CVE-2021-42146/): Security feature bypass in contiki-ng:tinydtls (high 7.5)
- [CVE-2021-42145](https://insights.sbomify.com/CVE-2021-42145/): Denial of service in contiki-ng:tinydtls (high 7.5)
- [CVE-2021-42144](https://insights.sbomify.com/CVE-2021-42144/): Memory corruption in contiki-ng:contiki-ng tinydtls (high 7.5)
- [CVE-2021-42143](https://insights.sbomify.com/CVE-2021-42143/): Denial of service in contiki-ng:tinydtls (critical 9.1)
- [CVE-2021-42142](https://insights.sbomify.com/CVE-2021-42142/): Denial of service in contiki-ng:tinydtls (high 8.2)
- [CVE-2021-42141](https://insights.sbomify.com/CVE-2021-42141/): Denial of service in contiki-ng:tinydtls (high 7.5)
- [CVE-2021-4214](https://insights.sbomify.com/CVE-2021-4214/): Memory corruption in libpng (medium 5.5)
- [CVE-2021-42139](https://insights.sbomify.com/CVE-2021-42139/): Code injection in deno:deno standard modules (critical 9.8)
- [CVE-2021-42138](https://insights.sbomify.com/CVE-2021-42138/): Weak cryptography in Safenet Authentication Service (high 7.2)
- [CVE-2021-42137](https://insights.sbomify.com/CVE-2021-42137/): Missing authorization in zammad:zammad (medium 5.3)
- [CVE-2021-42136](https://insights.sbomify.com/CVE-2021-42136/): Cross-site scripting in vanderbilt:redcap (critical 9.0)
- [CVE-2021-42135](https://insights.sbomify.com/CVE-2021-42135/): Incorrect Privilege Assignment in HashiCorp Vault (high 8.1)
- [CVE-2021-42134](https://insights.sbomify.com/CVE-2021-42134/): Cross-site Scripting in django-unicorn (medium 6.1)
- [CVE-2021-42133](https://insights.sbomify.com/CVE-2021-42133/): File upload in Ivanti Avalanche (high 8.1)
- [CVE-2021-42132](https://insights.sbomify.com/CVE-2021-42132/): Command injection in Ivanti Avalanche (high 8.8)
- [CVE-2021-42131](https://insights.sbomify.com/CVE-2021-42131/): SQL injection in Ivanti Avalanche (high 8.8)
- [CVE-2021-42130](https://insights.sbomify.com/CVE-2021-42130/): Deserialization in Ivanti Avalanche (high 8.8)
- [CVE-2021-4213](https://insights.sbomify.com/CVE-2021-4213/): Denial of service in JSS (high 7.5)
- [CVE-2021-42129](https://insights.sbomify.com/CVE-2021-42129/): Command injection in Ivanti Avalanche (high 8.8)
- [CVE-2021-42128](https://insights.sbomify.com/CVE-2021-42128/): Privilege escalation in Ivanti Avalanche (critical 9.8)
- [CVE-2021-42127](https://insights.sbomify.com/CVE-2021-42127/): Deserialization in Ivanti Avalanche (critical 9.8)
- [CVE-2021-42126](https://insights.sbomify.com/CVE-2021-42126/): Privilege escalation in Ivanti Avalanche (high 8.8)
- [CVE-2021-42125](https://insights.sbomify.com/CVE-2021-42125/): File upload in Ivanti Avalance (high 8.8)
- [CVE-2021-42124](https://insights.sbomify.com/CVE-2021-42124/): Missing authorization in Ivanti Avalanche (high 8.8)
- [CVE-2021-42123](https://insights.sbomify.com/CVE-2021-42123/): Missing Upload Filter in TopEase (high 7.3)
- [CVE-2021-42122](https://insights.sbomify.com/CVE-2021-42122/): Denial of Service via Invalid Object Attribute in TopEase (medium 4.3)
- [CVE-2021-42121](https://insights.sbomify.com/CVE-2021-42121/): Denial of Service via Invalid Date Format in TopEase (medium 4.3)
- [CVE-2021-42120](https://insights.sbomify.com/CVE-2021-42120/): Missing Character Length (Denial of Service) in TopEase (medium 6.5)
- [CVE-2021-4212](https://insights.sbomify.com/CVE-2021-4212/): Other in BIOS (medium 6.7)
- [CVE-2021-42119](https://insights.sbomify.com/CVE-2021-42119/): Stored XSS in Search Function in TopEase (high 7.3)
- [CVE-2021-42118](https://insights.sbomify.com/CVE-2021-42118/): Stored XSS in TopEase (high 8.1)
- [CVE-2021-42117](https://insights.sbomify.com/CVE-2021-42117/): UI Redressing in TopEase (low 3.5)
- [CVE-2021-42116](https://insights.sbomify.com/CVE-2021-42116/): Unauthorized Menu Item Access in TopEase (medium 4.3)
- [CVE-2021-42115](https://insights.sbomify.com/CVE-2021-42115/): Missing HTTPOnly flag on sensitive cookie in TopEase (high 8.1)
- [CVE-2021-42114](https://insights.sbomify.com/CVE-2021-42114/): Scalable Rowhammering In the Frequency Domain to Bypass TRR Mitigations On Modern DDR4/LPDDR4X Devices (critical 9.0)
- [CVE-2021-42113](https://insights.sbomify.com/CVE-2021-42113/): Privilege escalation in insyde:insydeh2o (high 8.2)
- [CVE-2021-42112](https://insights.sbomify.com/CVE-2021-42112/): Cross-site Scripting in Limesurvey (medium 6.1)
- [CVE-2021-42111](https://insights.sbomify.com/CVE-2021-42111/): Information disclosure in rcdevs:openotp token (medium 5.5)
- [CVE-2021-42110](https://insights.sbomify.com/CVE-2021-42110/): Privilege escalation in allegro:allegro (high 7.1)
- [CVE-2021-4211](https://insights.sbomify.com/CVE-2021-4211/): Other in BIOS (medium 6.7)
- [CVE-2021-42109](https://insights.sbomify.com/CVE-2021-42109/): Privilege escalation in vitec:avediastream m9305 firmware (critical 9.8)
- [CVE-2021-42108](https://insights.sbomify.com/CVE-2021-42108/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42107](https://insights.sbomify.com/CVE-2021-42107/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42106](https://insights.sbomify.com/CVE-2021-42106/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42105](https://insights.sbomify.com/CVE-2021-42105/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42104](https://insights.sbomify.com/CVE-2021-42104/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42103](https://insights.sbomify.com/CVE-2021-42103/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42102](https://insights.sbomify.com/CVE-2021-42102/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42101](https://insights.sbomify.com/CVE-2021-42101/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-4210](https://insights.sbomify.com/CVE-2021-4210/): Other in BIOS (medium 6.7)
- [CVE-2021-42099](https://insights.sbomify.com/CVE-2021-42099/): File upload in zohocorp:manageengine m365 manager plus (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/84/