# Vulnerabilities published in 2021


- [CVE-2021-41801](https://insights.sbomify.com/CVE-2021-41801/): Missing authorization in mediawiki:mediawiki (high 8.8)
- [CVE-2021-41800](https://insights.sbomify.com/CVE-2021-41800/): MediaWiki allows a denial of service (medium 5.3)
- [CVE-2021-4180](https://insights.sbomify.com/CVE-2021-4180/): Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates (medium 4.3)
- [CVE-2021-41799](https://insights.sbomify.com/CVE-2021-41799/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2021-41798](https://insights.sbomify.com/CVE-2021-41798/): Cross-site scripting in fedoraproject:fedora (medium 6.1)
- [CVE-2021-41795](https://insights.sbomify.com/CVE-2021-41795/): Security feature bypass in 1password:1password (medium 6.5)
- [CVE-2021-41794](https://insights.sbomify.com/CVE-2021-41794/): Memory corruption in open5gs:open5gs (high 7.5)
- [CVE-2021-41792](https://insights.sbomify.com/CVE-2021-41792/): Server-side request forgery in alfresco:alfresco content services (medium 5.3)
- [CVE-2021-41791](https://insights.sbomify.com/CVE-2021-41791/): Cross-site scripting in alfresco:community share (medium 5.4)
- [CVE-2021-41790](https://insights.sbomify.com/CVE-2021-41790/): Code injection in alfresco:alfresco content services (high 8.8)
- [CVE-2021-4179](https://insights.sbomify.com/CVE-2021-4179/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.6)
- [CVE-2021-41789](https://insights.sbomify.com/CVE-2021-41789/): Denial of service in mediatek:mt7615 firmware (medium 6.5)
- [CVE-2021-41788](https://insights.sbomify.com/CVE-2021-41788/): Denial of service in mediatek:mt7603e firmware (medium 6.5)
- [CVE-2021-41785](https://insights.sbomify.com/CVE-2021-41785/): Use after free in foxit:pdf editor (high 7.8)
- [CVE-2021-41784](https://insights.sbomify.com/CVE-2021-41784/): Use after free in foxit:pdf editor (high 7.8)
- [CVE-2021-41783](https://insights.sbomify.com/CVE-2021-41783/): Use after free in foxit:pdf editor (high 7.8)
- [CVE-2021-41782](https://insights.sbomify.com/CVE-2021-41782/): Use after free in foxit:pdf editor (high 7.8)
- [CVE-2021-41781](https://insights.sbomify.com/CVE-2021-41781/): Use after free in foxit:pdf editor (high 7.8)
- [CVE-2021-41780](https://insights.sbomify.com/CVE-2021-41780/): Use after free in foxit:pdf editor (high 7.8)
- [CVE-2021-4178](https://insights.sbomify.com/CVE-2021-4178/): fabric8 kubernetes-client vulnerable (medium 6.7)
- [CVE-2021-41773](https://insights.sbomify.com/CVE-2021-41773/): Apache HTTP Server Path Traversal (high 7.5, exploited in the wild)
- [CVE-2021-41772](https://insights.sbomify.com/CVE-2021-41772/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2021-41771](https://insights.sbomify.com/CVE-2021-41771/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2021-41770](https://insights.sbomify.com/CVE-2021-41770/): XML external entity in pingidentity:pingfederate (high 7.5)
- [CVE-2021-4177](https://insights.sbomify.com/CVE-2021-4177/): Generation of Error Message Containing Sensitive Information in livehelperchat/livehelperchat (medium 4.3)
- [CVE-2021-41769](https://insights.sbomify.com/CVE-2021-41769/): Other in SIPROTEC 5 6MD85 devices (CPU variant CP300) (high 7.5)
- [CVE-2021-41767](https://insights.sbomify.com/CVE-2021-41767/): Private tunnel identifier may be included in the non-private details of active connections (medium 6.5)
- [CVE-2021-41766](https://insights.sbomify.com/CVE-2021-41766/): Insecure Java Deserialization in Apache Karaf (high 8.1)
- [CVE-2021-41765](https://insights.sbomify.com/CVE-2021-41765/): SQL injection in montala:resourcespace (critical 9.8)
- [CVE-2021-41764](https://insights.sbomify.com/CVE-2021-41764/): Cross-site request forgery in streama project:streama (high 8.8)
- [CVE-2021-4176](https://insights.sbomify.com/CVE-2021-4176/): Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat (medium 5.4)
- [CVE-2021-41756](https://insights.sbomify.com/CVE-2021-41756/): SQL injection in dynamicvision:dynamicmarkt (critical 9.8)
- [CVE-2021-41755](https://insights.sbomify.com/CVE-2021-41755/): SQL injection in dynamicvision:dynamicmarkt (critical 9.8)
- [CVE-2021-41754](https://insights.sbomify.com/CVE-2021-41754/): SQL injection in dynamicvision:dynamicmarkt (critical 9.8)
- [CVE-2021-41753](https://insights.sbomify.com/CVE-2021-41753/): Denial of service in dlink:dir-x1560 firmware (high 7.5)
- [CVE-2021-41752](https://insights.sbomify.com/CVE-2021-41752/): Denial of service in jerryscript:jerryscript (critical 9.8)
- [CVE-2021-41751](https://insights.sbomify.com/CVE-2021-41751/): Memory corruption in jerryscript:jerryscript (critical 9.8)
- [CVE-2021-41750](https://insights.sbomify.com/CVE-2021-41750/): Cross-site Scripting in SEOmatic plugin (medium 6.1)
- [CVE-2021-4175](https://insights.sbomify.com/CVE-2021-4175/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.6)
- [CVE-2021-41749](https://insights.sbomify.com/CVE-2021-41749/): Code Injection in SEOmatic (critical 9.8)
- [CVE-2021-41747](https://insights.sbomify.com/CVE-2021-41747/): Cross-site scripting in csdn:csdn app (medium 6.1)
- [CVE-2021-41746](https://insights.sbomify.com/CVE-2021-41746/): SQL injection in yonyou:turbocrm (high 7.5)
- [CVE-2021-41745](https://insights.sbomify.com/CVE-2021-41745/): Showdoc File Upload Vulnerability (critical 9.8)
- [CVE-2021-41744](https://insights.sbomify.com/CVE-2021-41744/): Command injection in yonyou:ufida product lifecycle management (critical 9.8)
- [CVE-2021-41739](https://insights.sbomify.com/CVE-2021-41739/): Command injection in articatech:artica proxy (critical 9.8)
- [CVE-2021-41738](https://insights.sbomify.com/CVE-2021-41738/): Command injection in zeroshell:zeroshell (high 8.8)
- [CVE-2021-41737](https://insights.sbomify.com/CVE-2021-41737/): In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(333333333333333 (high 7.5)
- [CVE-2021-41736](https://insights.sbomify.com/CVE-2021-41736/): Memory corruption in grame:faust (critical 9.8)
- [CVE-2021-41733](https://insights.sbomify.com/CVE-2021-41733/): Open redirect in oppia:oppia (medium 6.1)
- [CVE-2021-41732](https://insights.sbomify.com/CVE-2021-41732/): Other in zeek:zeek (high 8.2)
- [CVE-2021-41731](https://insights.sbomify.com/CVE-2021-41731/): Cross-site scripting in news247 news magazine \(cms\) project:news247 news magazine \(cms\) (medium 4.8)
- [CVE-2021-4173](https://insights.sbomify.com/CVE-2021-4173/): Use After Free in vim/vim (medium 6.8)
- [CVE-2021-41729](https://insights.sbomify.com/CVE-2021-41729/): Missing authorization in baicloud-cms project:baicloud-cms (critical 9.1)
- [CVE-2021-41728](https://insights.sbomify.com/CVE-2021-41728/): Cross-site scripting in sourcecodester:news247 cms (medium 6.1)
- [CVE-2021-4172](https://insights.sbomify.com/CVE-2021-4172/): Cross-site Scripting (XSS) - Stored in star7th/showdoc (medium 6.5)
- [CVE-2021-41719](https://insights.sbomify.com/CVE-2021-41719/): Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using (high 7.5)
- [CVE-2021-41716](https://insights.sbomify.com/CVE-2021-41716/): Auth bypass in mahadiscom:mahavitaran (critical 9.8)
- [CVE-2021-41715](https://insights.sbomify.com/CVE-2021-41715/): Use after free in libsixel:libsixel (high 8.8)
- [CVE-2021-41714](https://insights.sbomify.com/CVE-2021-41714/): Path traversal in tipask:tipask (high 7.7)
- [CVE-2021-4171](https://insights.sbomify.com/CVE-2021-4171/): Business Logic Errors in janeczku/calibre-web (high 7.7)
- [CVE-2021-4170](https://insights.sbomify.com/CVE-2021-4170/): Cross-site Scripting (XSS) - Stored in janeczku/calibre-web (high 7.3)
- [CVE-2021-41697](https://insights.sbomify.com/CVE-2021-41697/): Cross-site scripting in globaldatingsoftware:premiumdatingscript (medium 6.1)
- [CVE-2021-41696](https://insights.sbomify.com/CVE-2021-41696/): Auth bypass in globaldatingsoftware:premiumdatingscript (medium 6.5)
- [CVE-2021-41695](https://insights.sbomify.com/CVE-2021-41695/): SQL injection in globaldatingsoftware:premiumdatingscript (critical 9.8)
- [CVE-2021-41694](https://insights.sbomify.com/CVE-2021-41694/): Weak cryptography in globaldatingsoftware:premiumdatingscript (critical 9.8)
- [CVE-2021-41691](https://insights.sbomify.com/CVE-2021-41691/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-41690](https://insights.sbomify.com/CVE-2021-41690/): Denial of service in offis:dcmtk (high 7.5)
- [CVE-2021-4169](https://insights.sbomify.com/CVE-2021-4169/): Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat (medium 5.4)
- [CVE-2021-41689](https://insights.sbomify.com/CVE-2021-41689/): Null dereference in offis:dcmtk (high 7.5)
- [CVE-2021-41688](https://insights.sbomify.com/CVE-2021-41688/): Memory corruption in offis:dcmtk (high 7.5)
- [CVE-2021-41687](https://insights.sbomify.com/CVE-2021-41687/): Denial of service in offis:dcmtk (high 7.5)
- [CVE-2021-41683](https://insights.sbomify.com/CVE-2021-41683/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2021-41682](https://insights.sbomify.com/CVE-2021-41682/): Use after free in jerryscript:jerryscript (high 7.8)
- [CVE-2021-4168](https://insights.sbomify.com/CVE-2021-4168/): Cross-Site Request Forgery (CSRF) in star7th/showdoc (medium 6.3)
- [CVE-2021-41679](https://insights.sbomify.com/CVE-2021-41679/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-41678](https://insights.sbomify.com/CVE-2021-41678/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-41677](https://insights.sbomify.com/CVE-2021-41677/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-41676](https://insights.sbomify.com/CVE-2021-41676/): SQL injection in pharmacy point of sale system project:pharmacy point of sale system (critical 9.8)
- [CVE-2021-41675](https://insights.sbomify.com/CVE-2021-41675/): File upload in e-negosyo system project:e-negosyo system (high 7.2)
- [CVE-2021-41674](https://insights.sbomify.com/CVE-2021-41674/): SQL injection in e-negosyo system project:e-negosyo system (critical 9.8)
- [CVE-2021-41672](https://insights.sbomify.com/CVE-2021-41672/): SQL injection in peel:peel shopping (medium 6.5)
- [CVE-2021-41663](https://insights.sbomify.com/CVE-2021-41663/): Cross-site scripting in 1234n:minicms (medium 6.1)
- [CVE-2021-41662](https://insights.sbomify.com/CVE-2021-41662/): SQL injection in south gate inn online reservation system project:south gate inn online reservation system (critical 9.8)
- [CVE-2021-41661](https://insights.sbomify.com/CVE-2021-41661/): File upload in church management system project:church management system (critical 9.8)
- [CVE-2021-41660](https://insights.sbomify.com/CVE-2021-41660/): SQL injection in patient appointment scheduler system project:patient appointment scheduler system (critical 9.8)
- [CVE-2021-4166](https://insights.sbomify.com/CVE-2021-4166/): Out-of-bounds Read in vim/vim (high 7.1)
- [CVE-2021-41659](https://insights.sbomify.com/CVE-2021-41659/): SQL injection in oretnom23:banking system (critical 9.8)
- [CVE-2021-41658](https://insights.sbomify.com/CVE-2021-41658/): Cross-site scripting in student quarterly grading system project:student quarterly grading system (medium 5.4)
- [CVE-2021-41657](https://insights.sbomify.com/CVE-2021-41657/): Other in smartbear:collaborator (medium 6.1)
- [CVE-2021-41654](https://insights.sbomify.com/CVE-2021-41654/): SQL injection in wuzhicms:wuzhicms (critical 9.8)
- [CVE-2021-41653](https://insights.sbomify.com/CVE-2021-41653/): Code injection in tp-link:tl-wr840n firmware (critical 9.8)
- [CVE-2021-41652](https://insights.sbomify.com/CVE-2021-41652/): Misconfiguration in batflat:batflat (high 7.5)
- [CVE-2021-41651](https://insights.sbomify.com/CVE-2021-41651/): SQL injection in hotel management system project:hotel management system (high 7.5)
- [CVE-2021-41649](https://insights.sbomify.com/CVE-2021-41649/): SQL injection in online-shopping-system-advanced project:online-shopping-system-advanced (critical 9.8)
- [CVE-2021-41648](https://insights.sbomify.com/CVE-2021-41648/): SQL injection in online-shopping-system-advanced project:online-shopping-system-advanced (high 7.5)
- [CVE-2021-41647](https://insights.sbomify.com/CVE-2021-41647/): SQL injection in online food ordering web app project:online food ordering web app (critical 9.1)
- [CVE-2021-41646](https://insights.sbomify.com/CVE-2021-41646/): File upload in janobe:online reviewer system (critical 9.8)
- [CVE-2021-41645](https://insights.sbomify.com/CVE-2021-41645/): File upload in oretnom23:budget and expense tracker system (high 8.8)
- [CVE-2021-41644](https://insights.sbomify.com/CVE-2021-41644/): File upload in oretnom23:online food ordering system (critical 9.8)
- [CVE-2021-41643](https://insights.sbomify.com/CVE-2021-41643/): File upload in church management system project:church management system (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/87/