# Vulnerabilities published in 2021


- [CVE-2021-41987](https://insights.sbomify.com/CVE-2021-41987/): Memory corruption in mikrotik:routeros (high 8.1)
- [CVE-2021-4198](https://insights.sbomify.com/CVE-2021-4198/): messaging_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016) (medium 6.1)
- [CVE-2021-41976](https://insights.sbomify.com/CVE-2021-41976/): Tad Uploader - Improper Authorization (medium 5.3)
- [CVE-2021-41975](https://insights.sbomify.com/CVE-2021-41975/): Tad TadTools - Improper Authorization (high 7.5)
- [CVE-2021-41974](https://insights.sbomify.com/CVE-2021-41974/): Tad Book3 - Improper Authorization (critical 9.1)
- [CVE-2021-41973](https://insights.sbomify.com/CVE-2021-41973/): Apache MINA HTTP listener DOS (medium 6.5)
- [CVE-2021-41972](https://insights.sbomify.com/CVE-2021-41972/): Credentials leak (medium 6.5)
- [CVE-2021-41971](https://insights.sbomify.com/CVE-2021-41971/): Possible SQL Injection when template processing is enabled (high 8.8)
- [CVE-2021-4197](https://insights.sbomify.com/CVE-2021-4197/): Privilege escalation in kernel (high 7.8)
- [CVE-2021-41965](https://insights.sbomify.com/CVE-2021-41965/): SQL injection in churchcrm:churchcrm (high 8.8)
- [CVE-2021-41962](https://insights.sbomify.com/CVE-2021-41962/): Cross-site scripting in vehicle service management system project:vehicle service management system (medium 4.8)
- [CVE-2021-41959](https://insights.sbomify.com/CVE-2021-41959/): Denial of service in jerryscript:jerryscript (high 7.5)
- [CVE-2021-41952](https://insights.sbomify.com/CVE-2021-41952/): Cross-site Scripting in Zenario CMS (medium 4.8)
- [CVE-2021-41951](https://insights.sbomify.com/CVE-2021-41951/): Cross-site scripting in montala:resourcespace (medium 6.1)
- [CVE-2021-41950](https://insights.sbomify.com/CVE-2021-41950/): Path traversal in montala:resourcespace (critical 9.1)
- [CVE-2021-4195](https://insights.sbomify.com/CVE-2021-4195/): XSS in Firmanet Software and Technology Customer Relation Manager (medium 6.1)
- [CVE-2021-41948](https://insights.sbomify.com/CVE-2021-41948/): Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin (medium 5.4)
- [CVE-2021-41947](https://insights.sbomify.com/CVE-2021-41947/): SQL injection in intelliants:subrion cms (high 7.2)
- [CVE-2021-41946](https://insights.sbomify.com/CVE-2021-41946/): Cross-site scripting in fiberhome:hg150-ub firmware (medium 5.4)
- [CVE-2021-41945](https://insights.sbomify.com/CVE-2021-41945/): Improper Input Validation in httpx (critical 9.1)
- [CVE-2021-41943](https://insights.sbomify.com/CVE-2021-41943/): Cross-site scripting in logrhythm:logrhythm (medium 6.1)
- [CVE-2021-41942](https://insights.sbomify.com/CVE-2021-41942/): SQL injection in msvod:msvod cms (high 7.5)
- [CVE-2021-4194](https://insights.sbomify.com/CVE-2021-4194/): Improper Access Control in bookstackapp/bookstack (medium 4.3)
- [CVE-2021-41938](https://insights.sbomify.com/CVE-2021-41938/): Arbitrary file upload in ShopXO (high 7.2)
- [CVE-2021-41932](https://insights.sbomify.com/CVE-2021-41932/): SQL injection in wolterskluwer:teammate\+ audit (high 8.8)
- [CVE-2021-41931](https://insights.sbomify.com/CVE-2021-41931/): SQL injection in recruitment management system project:recruitment management system (critical 9.8)
- [CVE-2021-41930](https://insights.sbomify.com/CVE-2021-41930/): Cross-site scripting in online covid vaccination scheduler system project:online covid vaccination scheduler system (medium 6.1)
- [CVE-2021-4193](https://insights.sbomify.com/CVE-2021-4193/): Out-of-bounds Read in vim/vim (medium 5.5)
- [CVE-2021-41929](https://insights.sbomify.com/CVE-2021-41929/): Cross-site scripting in the electric billing management system project:the electric billing management system (medium 6.1)
- [CVE-2021-41928](https://insights.sbomify.com/CVE-2021-41928/): SQL injection in try my recipe project:try my recipe (critical 9.8)
- [CVE-2021-41924](https://insights.sbomify.com/CVE-2021-41924/): Cross-site Scripting in krayin/laravel-crm (medium 6.1)
- [CVE-2021-41921](https://insights.sbomify.com/CVE-2021-41921/): File upload in xxyopen:novel-plus (critical 9.8)
- [CVE-2021-41920](https://insights.sbomify.com/CVE-2021-41920/): SQL injection in webtareas project:webtareas (high 7.5)
- [CVE-2021-4192](https://insights.sbomify.com/CVE-2021-4192/): Use After Free in vim/vim (medium 5.5)
- [CVE-2021-41919](https://insights.sbomify.com/CVE-2021-41919/): File upload in webtareas project:webtareas (high 8.8)
- [CVE-2021-41918](https://insights.sbomify.com/CVE-2021-41918/): Cross-site scripting in webtareas project:webtareas (medium 5.4)
- [CVE-2021-41917](https://insights.sbomify.com/CVE-2021-41917/): Cross-site scripting in webtareas project:webtareas (medium 5.4)
- [CVE-2021-41916](https://insights.sbomify.com/CVE-2021-41916/): Cross-site request forgery in webtareas project:webtareas (high 8.8)
- [CVE-2021-4191](https://insights.sbomify.com/CVE-2021-4191/): Information disclosure in GitLab (medium 5.3)
- [CVE-2021-4190](https://insights.sbomify.com/CVE-2021-4190/): Denial of service in Wireshark (high 7.5)
- [CVE-2021-4189](https://insights.sbomify.com/CVE-2021-4189/): Server-side request forgery in python (medium 5.3)
- [CVE-2021-4188](https://insights.sbomify.com/CVE-2021-4188/): NULL Pointer Dereference in mruby/mruby (medium 6.8)
- [CVE-2021-41878](https://insights.sbomify.com/CVE-2021-41878/): Cross-site scripting in hkurl:i-panel administration system (medium 6.1)
- [CVE-2021-41873](https://insights.sbomify.com/CVE-2021-41873/): Auth bypass in skyworth:penguin aurora box firmware (critical 10.0)
- [CVE-2021-41872](https://insights.sbomify.com/CVE-2021-41872/): Denial of service in skyworthdigital:penguin aurora box 41502 firmware (high 7.5)
- [CVE-2021-41871](https://insights.sbomify.com/CVE-2021-41871/): Cross-site scripting in socomec:remote view pro firmware (medium 5.4)
- [CVE-2021-41870](https://insights.sbomify.com/CVE-2021-41870/): File upload in socomec:remote view pro firmware (high 8.8)
- [CVE-2021-4187](https://insights.sbomify.com/CVE-2021-4187/): Use After Free in vim/vim (medium 6.8)
- [CVE-2021-41869](https://insights.sbomify.com/CVE-2021-41869/): Privilege escalation in salesagility:suitecrm (high 8.8)
- [CVE-2021-41868](https://insights.sbomify.com/CVE-2021-41868/): Remote unauthenticated attackers able to upload files in Onionshare (critical 9.8)
- [CVE-2021-41867](https://insights.sbomify.com/CVE-2021-41867/): Information disclosure vulnerability in OnionShare (medium 5.3)
- [CVE-2021-41866](https://insights.sbomify.com/CVE-2021-41866/): Cross-site scripting in mybb:mybb (medium 5.4)
- [CVE-2021-41865](https://insights.sbomify.com/CVE-2021-41865/): Denial of service in hashicorp:nomad (medium 6.5)
- [CVE-2021-41864](https://insights.sbomify.com/CVE-2021-41864/): Integer overflow in debian:debian linux (high 7.8)
- [CVE-2021-41862](https://insights.sbomify.com/CVE-2021-41862/): Expression injection in AviatorScript (critical 9.8)
- [CVE-2021-41861](https://insights.sbomify.com/CVE-2021-41861/): Security feature bypass in telegram:telegram (low 3.3)
- [CVE-2021-4186](https://insights.sbomify.com/CVE-2021-4186/): Null dereference in Wireshark (medium 6.3)
- [CVE-2021-41850](https://insights.sbomify.com/CVE-2021-41850/): Information disclosure in bluproducts:g90 firmware (high 7.8)
- [CVE-2021-4185](https://insights.sbomify.com/CVE-2021-4185/): Denial of service in Wireshark (high 7.5)
- [CVE-2021-41849](https://insights.sbomify.com/CVE-2021-41849/): Information disclosure in bluproducts:g90 firmware (medium 5.5)
- [CVE-2021-41848](https://insights.sbomify.com/CVE-2021-41848/): Hardcoded credentials in bluproducts:g90 firmware (high 7.8)
- [CVE-2021-41847](https://insights.sbomify.com/CVE-2021-41847/): Missing authorization in 3xlogic:infinias access control (high 8.8)
- [CVE-2021-41845](https://insights.sbomify.com/CVE-2021-41845/): SQL injection in thycotic:secret server (medium 6.5)
- [CVE-2021-41844](https://insights.sbomify.com/CVE-2021-41844/): Other in crocoblock:jetengine (critical 9.8)
- [CVE-2021-41843](https://insights.sbomify.com/CVE-2021-41843/): SQL injection in open-emr:openemr (medium 6.5)
- [CVE-2021-41842](https://insights.sbomify.com/CVE-2021-41842/): Memory corruption in insyde:insydeh2o (critical 9.8)
- [CVE-2021-41841](https://insights.sbomify.com/CVE-2021-41841/): Privilege escalation in insyde:insydeh2o (high 8.2)
- [CVE-2021-41840](https://insights.sbomify.com/CVE-2021-41840/): Privilege escalation in insyde:insydeh2o (high 8.2)
- [CVE-2021-4184](https://insights.sbomify.com/CVE-2021-4184/): Denial of service in Wireshark (high 7.5)
- [CVE-2021-41839](https://insights.sbomify.com/CVE-2021-41839/): Memory corruption in insyde:insydeh2o (high 8.2)
- [CVE-2021-41838](https://insights.sbomify.com/CVE-2021-41838/): Memory corruption in insyde:insydeh2o (high 8.2)
- [CVE-2021-41837](https://insights.sbomify.com/CVE-2021-41837/): Memory corruption in insyde:insydeh2o (high 8.2)
- [CVE-2021-41836](https://insights.sbomify.com/CVE-2021-41836/): Fathom Analytics <= 3.0.4 Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-41835](https://insights.sbomify.com/CVE-2021-41835/): Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm (high 7.3)
- [CVE-2021-41834](https://insights.sbomify.com/CVE-2021-41834/): Missing authorization in Artifactory (medium 5.3)
- [CVE-2021-41833](https://insights.sbomify.com/CVE-2021-41833/): File upload in zohocorp:manageengine patch connect plus (critical 9.8)
- [CVE-2021-41832](https://insights.sbomify.com/CVE-2021-41832/): Content Manipulation with Certificate Validation Attack (high 7.5)
- [CVE-2021-41831](https://insights.sbomify.com/CVE-2021-41831/): Timestamp Manipulation with Signature Wrapping (medium 5.3)
- [CVE-2021-41830](https://insights.sbomify.com/CVE-2021-41830/): Double Certificate Attack (high 7.5)
- [CVE-2021-4183](https://insights.sbomify.com/CVE-2021-4183/): Memory corruption in Wireshark (medium 5.5)
- [CVE-2021-41829](https://insights.sbomify.com/CVE-2021-41829/): Weak cryptography in zohocorp:manageengine remote access plus (high 7.5)
- [CVE-2021-41828](https://insights.sbomify.com/CVE-2021-41828/): Hardcoded credentials in zohocorp:manageengine remote access plus (high 7.5)
- [CVE-2021-41827](https://insights.sbomify.com/CVE-2021-41827/): Hardcoded credentials in zohocorp:manageengine remote access plus (high 7.5)
- [CVE-2021-41826](https://insights.sbomify.com/CVE-2021-41826/): Open redirect in place:placeos authentication (medium 6.1)
- [CVE-2021-41825](https://insights.sbomify.com/CVE-2021-41825/): Cross-site scripting in verint:workforce optimization (medium 5.3)
- [CVE-2021-41824](https://insights.sbomify.com/CVE-2021-41824/): CSV Injection Vulnerability (high 8.8)
- [CVE-2021-41823](https://insights.sbomify.com/CVE-2021-41823/): Cross-site scripting in kemptechnologies:web application firewall (medium 6.1)
- [CVE-2021-41821](https://insights.sbomify.com/CVE-2021-41821/): Integer overflow in wazuh:wazuh (medium 6.5)
- [CVE-2021-4182](https://insights.sbomify.com/CVE-2021-4182/): Denial of service in Wireshark (high 7.5)
- [CVE-2021-41819](https://insights.sbomify.com/CVE-2021-41819/): Cookie Prefix Spoofing in CGI::Cookie.parse (high 7.5)
- [CVE-2021-41817](https://insights.sbomify.com/CVE-2021-41817/): Regular expression denial of service vulnerability (ReDoS) in date (high 7.5)
- [CVE-2021-41816](https://insights.sbomify.com/CVE-2021-41816/): Buffer overrun in CGI.escape_html (critical 9.8)
- [CVE-2021-41810](https://insights.sbomify.com/CVE-2021-41810/): Script injection in M-Files Admin (medium 5.2)
- [CVE-2021-4181](https://insights.sbomify.com/CVE-2021-4181/): Memory corruption in Wireshark (high 7.5)
- [CVE-2021-41809](https://insights.sbomify.com/CVE-2021-41809/): SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server. (low 3.5)
- [CVE-2021-41808](https://insights.sbomify.com/CVE-2021-41808/): Information disclosure in M-Files Server (low 2.0)
- [CVE-2021-41807](https://insights.sbomify.com/CVE-2021-41807/): Auth bypass in M-Files Server (high 7.5)
- [CVE-2021-41805](https://insights.sbomify.com/CVE-2021-41805/): Privilege escalation in hashicorp:consul (high 8.8)
- [CVE-2021-41803](https://insights.sbomify.com/CVE-2021-41803/): HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions (high 7.1)
- [CVE-2021-41802](https://insights.sbomify.com/CVE-2021-41802/): Hashicorp Vault Privilege Escalation Vulnerability (low 2.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/86/