# Vulnerabilities published in 2021


- [CVE-2021-42098](https://insights.sbomify.com/CVE-2021-42098/): Privilege escalation in Remote Desktop Manager (high 8.8)
- [CVE-2021-42097](https://insights.sbomify.com/CVE-2021-42097/): Cross-site request forgery in debian:debian linux (high 8.0)
- [CVE-2021-42096](https://insights.sbomify.com/CVE-2021-42096/): Weak cryptography in debian:debian linux (medium 4.3)
- [CVE-2021-42095](https://insights.sbomify.com/CVE-2021-42095/): Denial of service in netsarang:xshell (high 7.5)
- [CVE-2021-42094](https://insights.sbomify.com/CVE-2021-42094/): Command injection in zammad:zammad (critical 9.8)
- [CVE-2021-42093](https://insights.sbomify.com/CVE-2021-42093/): Code injection in zammad:zammad (high 7.2)
- [CVE-2021-42092](https://insights.sbomify.com/CVE-2021-42092/): Cross-site scripting in zammad:zammad (medium 5.4)
- [CVE-2021-42091](https://insights.sbomify.com/CVE-2021-42091/): Server-side request forgery in zammad:zammad (critical 9.1)
- [CVE-2021-42090](https://insights.sbomify.com/CVE-2021-42090/): Deserialization in zammad:zammad (critical 9.8)
- [CVE-2021-4209](https://insights.sbomify.com/CVE-2021-4209/): Null dereference in GnuTLS (medium 6.5)
- [CVE-2021-42089](https://insights.sbomify.com/CVE-2021-42089/): Information disclosure in zammad:zammad (high 7.5)
- [CVE-2021-42088](https://insights.sbomify.com/CVE-2021-42088/): Cross-site scripting in zammad:zammad (medium 6.1)
- [CVE-2021-42087](https://insights.sbomify.com/CVE-2021-42087/): Information disclosure in zammad:zammad (medium 4.9)
- [CVE-2021-42086](https://insights.sbomify.com/CVE-2021-42086/): Privilege escalation in zammad:zammad (high 8.8)
- [CVE-2021-42085](https://insights.sbomify.com/CVE-2021-42085/): Cross-site scripting in zammad:zammad (medium 5.4)
- [CVE-2021-42084](https://insights.sbomify.com/CVE-2021-42084/): Denial of service in zammad:zammad (medium 6.5)
- [CVE-2021-42083](https://insights.sbomify.com/CVE-2021-42083/): Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335 (high 8.7)
- [CVE-2021-42082](https://insights.sbomify.com/CVE-2021-42082/): Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355 (high 7.8)
- [CVE-2021-42081](https://insights.sbomify.com/CVE-2021-42081/): Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355 (critical 9.1)
- [CVE-2021-42080](https://insights.sbomify.com/CVE-2021-42080/): Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355 (high 7.4)
- [CVE-2021-4208](https://insights.sbomify.com/CVE-2021-4208/): ExportFeed <= 2.0.1.0 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-42079](https://insights.sbomify.com/CVE-2021-42079/): SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355 (medium 6.2)
- [CVE-2021-42078](https://insights.sbomify.com/CVE-2021-42078/): Cross-site scripting in php event calendar project:php event calendar (medium 6.1)
- [CVE-2021-42077](https://insights.sbomify.com/CVE-2021-42077/): SQL injection in kaysongroup:php event calendar (critical 9.8)
- [CVE-2021-42076](https://insights.sbomify.com/CVE-2021-42076/): Denial of service in barrier project:barrier (high 7.5)
- [CVE-2021-42075](https://insights.sbomify.com/CVE-2021-42075/): Denial of service in barrier project:barrier (high 7.5)
- [CVE-2021-42074](https://insights.sbomify.com/CVE-2021-42074/): Use after free in barrier project:barrier (high 7.5)
- [CVE-2021-42073](https://insights.sbomify.com/CVE-2021-42073/): Auth bypass in barrier project:barrier (high 8.2)
- [CVE-2021-42072](https://insights.sbomify.com/CVE-2021-42072/): Auth bypass in barrier project:barrier (high 8.8)
- [CVE-2021-42071](https://insights.sbomify.com/CVE-2021-42071/): Command injection in visual-tools:dvr vx16 firmware (critical 9.8)
- [CVE-2021-42070](https://insights.sbomify.com/CVE-2021-42070/): Denial of service in SAP 3D Visual Enterprise Viewer (low 3.3)
- [CVE-2021-4207](https://insights.sbomify.com/CVE-2021-4207/): Race condition in QEMU (high 8.2)
- [CVE-2021-42069](https://insights.sbomify.com/CVE-2021-42069/): Memory corruption in SAP 3D Visual Enterprise Viewer (low 3.3)
- [CVE-2021-42068](https://insights.sbomify.com/CVE-2021-42068/): Denial of service in SAP 3D Visual Enterprise Viewer (low 3.3)
- [CVE-2021-42067](https://insights.sbomify.com/CVE-2021-42067/): Missing authorization in SAP NetWeaver AS for ABAP and ABAP Platform (medium 4.3)
- [CVE-2021-42066](https://insights.sbomify.com/CVE-2021-42066/): Information disclosure in SAP Business One (medium 4.4)
- [CVE-2021-42064](https://insights.sbomify.com/CVE-2021-42064/): SQL injection in SAP Commerce (critical 9.8)
- [CVE-2021-42063](https://insights.sbomify.com/CVE-2021-42063/): Cross-site scripting in SAP Knowledge Warehouse (medium 6.1)
- [CVE-2021-42062](https://insights.sbomify.com/CVE-2021-42062/): Missing authorization in SAP ERP HCM Portugal (medium 4.3)
- [CVE-2021-42061](https://insights.sbomify.com/CVE-2021-42061/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (medium 5.4)
- [CVE-2021-42060](https://insights.sbomify.com/CVE-2021-42060/): Privilege escalation in insyde:insydeh2o (high 8.2)
- [CVE-2021-4206](https://insights.sbomify.com/CVE-2021-4206/): Integer overflow in QEMU (high 8.2)
- [CVE-2021-42059](https://insights.sbomify.com/CVE-2021-42059/): Memory corruption in insyde:insydeh2o (medium 6.7)
- [CVE-2021-42057](https://insights.sbomify.com/CVE-2021-42057/): Obsidian Dataview vulnerable to code injection due to unsafe eval (high 7.8)
- [CVE-2021-42056](https://insights.sbomify.com/CVE-2021-42056/): Race condition in thalesgroup:safenet authentication client (medium 6.7)
- [CVE-2021-42055](https://insights.sbomify.com/CVE-2021-42055/): Misconfiguration in asus:ux582lr firmware (medium 6.8)
- [CVE-2021-42054](https://insights.sbomify.com/CVE-2021-42054/): Memory corruption in accel-ppp:accel-ppp (high 7.5)
- [CVE-2021-42053](https://insights.sbomify.com/CVE-2021-42053/): Cross-site scripting in Unicorn framework (medium 5.4)
- [CVE-2021-42052](https://insights.sbomify.com/CVE-2021-42052/): Path traversal in ipesa:e-flow (high 7.5)
- [CVE-2021-42051](https://insights.sbomify.com/CVE-2021-42051/): Cross-site scripting in abantecart:abantecart (medium 5.4)
- [CVE-2021-42050](https://insights.sbomify.com/CVE-2021-42050/): Cross-site scripting in abantecart:abantecart (medium 6.1)
- [CVE-2021-42049](https://insights.sbomify.com/CVE-2021-42049/): Business logic in mediawiki:mediawiki (medium 6.5)
- [CVE-2021-42048](https://insights.sbomify.com/CVE-2021-42048/): Cross-site scripting in mediawiki:mediawiki (medium 4.8)
- [CVE-2021-42047](https://insights.sbomify.com/CVE-2021-42047/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2021-42046](https://insights.sbomify.com/CVE-2021-42046/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2021-42045](https://insights.sbomify.com/CVE-2021-42045/): Business logic in mediawiki:mediawiki (medium 5.4)
- [CVE-2021-42044](https://insights.sbomify.com/CVE-2021-42044/): Cross-site scripting in mediawiki:mediawiki (medium 4.8)
- [CVE-2021-42043](https://insights.sbomify.com/CVE-2021-42043/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2021-42042](https://insights.sbomify.com/CVE-2021-42042/): Cross-site scripting in mediawiki:mediawiki (medium 4.8)
- [CVE-2021-42041](https://insights.sbomify.com/CVE-2021-42041/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2021-42040](https://insights.sbomify.com/CVE-2021-42040/): Denial of service in mediawiki:mediawiki (high 7.5)
- [CVE-2021-4204](https://insights.sbomify.com/CVE-2021-4204/): Memory corruption in kernel (high 7.1)
- [CVE-2021-4203](https://insights.sbomify.com/CVE-2021-4203/): Use after free in kernel (medium 6.8)
- [CVE-2021-42029](https://insights.sbomify.com/CVE-2021-42029/): Privilege escalation in SIMATIC STEP 7 (TIA Portal) V15 (high 7.8)
- [CVE-2021-42028](https://insights.sbomify.com/CVE-2021-42028/): Memory corruption in syngo fastView (high 7.8)
- [CVE-2021-42027](https://insights.sbomify.com/CVE-2021-42027/): Security feature bypass in SINUMERIK Edge (high 7.4)
- [CVE-2021-42026](https://insights.sbomify.com/CVE-2021-42026/): Missing authorization in Mendix Applications using Mendix 8 (medium 4.3)
- [CVE-2021-42025](https://insights.sbomify.com/CVE-2021-42025/): Missing authorization in Mendix Applications using Mendix 8 (medium 6.5)
- [CVE-2021-42024](https://insights.sbomify.com/CVE-2021-42024/): Memory corruption in Simcenter STAR-CCM+ Viewer (high 7.8)
- [CVE-2021-42023](https://insights.sbomify.com/CVE-2021-42023/): Weak cryptography in ModelSim Simulation (medium 6.5)
- [CVE-2021-42022](https://insights.sbomify.com/CVE-2021-42022/): Path traversal in SIMATIC eaSie PCS 7 Skill Package (medium 6.5)
- [CVE-2021-42021](https://insights.sbomify.com/CVE-2021-42021/): Path traversal in Siveillance Video DLNA Server (high 7.5)
- [CVE-2021-42020](https://insights.sbomify.com/CVE-2021-42020/): Other in RUGGEDCOM M2100 (high 7.5)
- [CVE-2021-4202](https://insights.sbomify.com/CVE-2021-4202/): Use after free in kernel (high 7.0)
- [CVE-2021-42019](https://insights.sbomify.com/CVE-2021-42019/): Integer overflow in RUGGEDCOM M2100 (medium 5.9)
- [CVE-2021-42018](https://insights.sbomify.com/CVE-2021-42018/): Memory corruption in RUGGEDCOM M2100 (medium 5.9)
- [CVE-2021-42017](https://insights.sbomify.com/CVE-2021-42017/): Weak cryptography in RUGGEDCOM M2100 (medium 5.9)
- [CVE-2021-42016](https://insights.sbomify.com/CVE-2021-42016/): Information disclosure in RUGGEDCOM M2100 (high 7.5)
- [CVE-2021-42015](https://insights.sbomify.com/CVE-2021-42015/): Information disclosure in Mendix Applications using Mendix 7 (medium 5.5)
- [CVE-2021-42013](https://insights.sbomify.com/CVE-2021-42013/): Apache HTTP Server Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2021-42012](https://insights.sbomify.com/CVE-2021-42012/): Memory corruption in Trend Micro Apex One (high 7.8)
- [CVE-2021-42011](https://insights.sbomify.com/CVE-2021-42011/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2021-42010](https://insights.sbomify.com/CVE-2021-42010/): CRLF log injection (critical 9.8)
- [CVE-2021-4201](https://insights.sbomify.com/CVE-2021-4201/): Pre-authentication session hijacking (critical 9.6)
- [CVE-2021-42009](https://insights.sbomify.com/CVE-2021-42009/): Apache Traffic Control Traffic Ops Email Injection Vulnerability (medium 4.3)
- [CVE-2021-42008](https://insights.sbomify.com/CVE-2021-42008/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-42006](https://insights.sbomify.com/CVE-2021-42006/): Memory corruption in gclib project:gclib (high 8.8)
- [CVE-2021-42002](https://insights.sbomify.com/CVE-2021-42002/): File upload in zohocorp:manageengine admanager plus (critical 9.8)
- [CVE-2021-42001](https://insights.sbomify.com/CVE-2021-42001/): PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure (high 8.0)
- [CVE-2021-42000](https://insights.sbomify.com/CVE-2021-42000/): Business logic in PingFederate (medium 5.3)
- [CVE-2021-4200](https://insights.sbomify.com/CVE-2021-4200/): Write access to the Catalog for any user when restricted-admin role is enabled (medium 5.4)
- [CVE-2021-41995](https://insights.sbomify.com/CVE-2021-41995/): PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks (high 7.7)
- [CVE-2021-41994](https://insights.sbomify.com/CVE-2021-41994/): PingID iOS mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks (medium 6.6)
- [CVE-2021-41993](https://insights.sbomify.com/CVE-2021-41993/): PingID Android mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks (medium 6.6)
- [CVE-2021-41992](https://insights.sbomify.com/CVE-2021-41992/): PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass (high 7.7)
- [CVE-2021-41991](https://insights.sbomify.com/CVE-2021-41991/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2021-41990](https://insights.sbomify.com/CVE-2021-41990/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2021-4199](https://insights.sbomify.com/CVE-2021-4199/): Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) (high 7.8)
- [CVE-2021-41989](https://insights.sbomify.com/CVE-2021-41989/): Misconfiguration in qlik:qlikview (high 7.8)
- [CVE-2021-41988](https://insights.sbomify.com/CVE-2021-41988/): Misconfiguration in qlik:nprinting designer (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/85/