# Vulnerabilities published in 2021


- [CVE-2021-41641](https://insights.sbomify.com/CVE-2021-41641/): Link Following in Deno (high 8.4)
- [CVE-2021-4164](https://insights.sbomify.com/CVE-2021-4164/): Cross-Site Request Forgery (CSRF) in janeczku/calibre-web (high 7.6)
- [CVE-2021-41639](https://insights.sbomify.com/CVE-2021-41639/): Information disclosure in melag:ftp server (medium 5.5)
- [CVE-2021-41638](https://insights.sbomify.com/CVE-2021-41638/): Auth bypass in melag:ftp server (high 7.5)
- [CVE-2021-41637](https://insights.sbomify.com/CVE-2021-41637/): Misconfiguration in melag:ftp server (high 7.1)
- [CVE-2021-41636](https://insights.sbomify.com/CVE-2021-41636/): Path traversal in melag:ftp server (medium 6.5)
- [CVE-2021-41635](https://insights.sbomify.com/CVE-2021-41635/): Misconfiguration in melag:ftp server (high 8.8)
- [CVE-2021-41634](https://insights.sbomify.com/CVE-2021-41634/): Information disclosure in melag:ftp server (medium 5.3)
- [CVE-2021-4162](https://insights.sbomify.com/CVE-2021-4162/): Cross-Site Request Forgery (CSRF) in archivy/archivy (medium 4.3)
- [CVE-2021-41619](https://insights.sbomify.com/CVE-2021-41619/): Code injection in gradle:enterprise (high 7.2)
- [CVE-2021-41617](https://insights.sbomify.com/CVE-2021-41617/): Privilege escalation in fedoraproject:fedora (high 7.0)
- [CVE-2021-41616](https://insights.sbomify.com/CVE-2021-41616/): Apache ddlutils 1.0 readobject vulnerability (critical 9.8)
- [CVE-2021-41615](https://insights.sbomify.com/CVE-2021-41615/): Weak cryptography in embedthis:goahead (critical 9.8)
- [CVE-2021-41614](https://insights.sbomify.com/CVE-2021-41614/): Privilege escalation in openrisc:mor1kx firmware (high 7.8)
- [CVE-2021-41613](https://insights.sbomify.com/CVE-2021-41613/): Other in openrisc:mor1kx firmware (medium 4.3)
- [CVE-2021-41612](https://insights.sbomify.com/CVE-2021-41612/): Other in openrisc:mor1kx firmware (high 8.8)
- [CVE-2021-41611](https://insights.sbomify.com/CVE-2021-41611/): Security feature bypass in fedoraproject:fedora (high 7.5)
- [CVE-2021-4161](https://insights.sbomify.com/CVE-2021-4161/): ICSA-21-357-01 Moxa MGate Protocol Gateways (critical 9.8)
- [CVE-2021-41609](https://insights.sbomify.com/CVE-2021-41609/): SQL injection in classapps:selectsurvey.net (critical 9.8)
- [CVE-2021-41608](https://insights.sbomify.com/CVE-2021-41608/): Missing authorization in classapps:selectsurvey.net (high 7.5)
- [CVE-2021-4160](https://insights.sbomify.com/CVE-2021-4160/): BN_mod_exp may produce incorrect results on MIPS (medium 5.9)
- [CVE-2021-41599](https://insights.sbomify.com/CVE-2021-41599/): Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution (high 8.8)
- [CVE-2021-41598](https://insights.sbomify.com/CVE-2021-41598/): UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user (high 8.8)
- [CVE-2021-41597](https://insights.sbomify.com/CVE-2021-41597/): Cross-site request forgery in salesagility:suitecrm (high 8.8)
- [CVE-2021-41596](https://insights.sbomify.com/CVE-2021-41596/): Path traversal in salesagility:suitecrm (medium 5.3)
- [CVE-2021-41595](https://insights.sbomify.com/CVE-2021-41595/): Path traversal in salesagility:suitecrm (medium 5.3)
- [CVE-2021-41594](https://insights.sbomify.com/CVE-2021-41594/): Missing authorization in rsa:archer (medium 6.5)
- [CVE-2021-41593](https://insights.sbomify.com/CVE-2021-41593/): Business logic in lightning network daemon project:lightning network daemon (high 8.6)
- [CVE-2021-41592](https://insights.sbomify.com/CVE-2021-41592/): Business logic in elementsproject:c-lightning (critical 9.4)
- [CVE-2021-41591](https://insights.sbomify.com/CVE-2021-41591/): Business logic in acinq:eclair (critical 9.4)
- [CVE-2021-41590](https://insights.sbomify.com/CVE-2021-41590/): Server-side request forgery in gradle:enterprise (medium 5.3)
- [CVE-2021-4159](https://insights.sbomify.com/CVE-2021-4159/): Information disclosure in kernel (medium 4.4)
- [CVE-2021-41589](https://insights.sbomify.com/CVE-2021-41589/): Misconfiguration in gradle:build cache node (critical 9.8)
- [CVE-2021-41588](https://insights.sbomify.com/CVE-2021-41588/): Deserialization in gradle:gradle (high 8.1)
- [CVE-2021-41587](https://insights.sbomify.com/CVE-2021-41587/): Server-side request forgery in gradle:gradle (high 7.5)
- [CVE-2021-41586](https://insights.sbomify.com/CVE-2021-41586/): Server-side request forgery in gradle:gradle (high 7.5)
- [CVE-2021-41585](https://insights.sbomify.com/CVE-2021-41585/): ATS stops accepting connections on FreeBSD (high 7.5)
- [CVE-2021-41584](https://insights.sbomify.com/CVE-2021-41584/): Information disclosure in gradle:gradle (high 7.5)
- [CVE-2021-41583](https://insights.sbomify.com/CVE-2021-41583/): Command injection in eduvpn:vpn-user-portal (medium 6.5)
- [CVE-2021-41581](https://insights.sbomify.com/CVE-2021-41581/): Memory corruption in openbsd:libressl (medium 5.5)
- [CVE-2021-41580](https://insights.sbomify.com/CVE-2021-41580/): Improper Access Control in passport-oauth2 (medium 5.3)
- [CVE-2021-4158](https://insights.sbomify.com/CVE-2021-4158/): Null dereference in QEMU (medium 6.0)
- [CVE-2021-41579](https://insights.sbomify.com/CVE-2021-41579/): Path traversal in laquisscada:scada (high 7.8)
- [CVE-2021-41578](https://insights.sbomify.com/CVE-2021-41578/): Path traversal in myscada:mydesigner (high 7.8)
- [CVE-2021-41573](https://insights.sbomify.com/CVE-2021-41573/): Information disclosure in hitachi:content platform anywhere (high 7.5)
- [CVE-2021-41571](https://insights.sbomify.com/CVE-2021-41571/): Pulsar Admin API allows access to data from other tenants using getMessageById API (medium 6.5)
- [CVE-2021-41570](https://insights.sbomify.com/CVE-2021-41570/): Cross-site scripting in veritas:netbackup (medium 5.4)
- [CVE-2021-4157](https://insights.sbomify.com/CVE-2021-4157/): Memory corruption in kernel (high 8.0)
- [CVE-2021-41569](https://insights.sbomify.com/CVE-2021-41569/): Code injection in sas:sas\/intrnet (high 7.5)
- [CVE-2021-41568](https://insights.sbomify.com/CVE-2021-41568/): Tad Web - Improper Authorization (medium 5.3)
- [CVE-2021-41567](https://insights.sbomify.com/CVE-2021-41567/): Tad Uploader - Stored XSS (medium 6.1)
- [CVE-2021-41566](https://insights.sbomify.com/CVE-2021-41566/): Tad TadTools - Arbitrary File Upload (critical 9.8)
- [CVE-2021-41565](https://insights.sbomify.com/CVE-2021-41565/): Tad TadTools - Reflected XSS (medium 6.1)
- [CVE-2021-41564](https://insights.sbomify.com/CVE-2021-41564/): Tad Honor - Improper Authorization (medium 5.3)
- [CVE-2021-41563](https://insights.sbomify.com/CVE-2021-41563/): Tad Book3 - Stored XSS (medium 6.1)
- [CVE-2021-41562](https://insights.sbomify.com/CVE-2021-41562/): Deletion of arbitrary files vulnerability in Snow Agent for Windows (medium 6.1)
- [CVE-2021-41561](https://insights.sbomify.com/CVE-2021-41561/): Apache Parquet-MR potential DoS in case of malicious Parquet file (high 7.5)
- [CVE-2021-41560](https://insights.sbomify.com/CVE-2021-41560/): File upload in opencats:opencats (critical 9.8)
- [CVE-2021-4156](https://insights.sbomify.com/CVE-2021-4156/): Memory corruption in libsndfile (high 7.1)
- [CVE-2021-41559](https://insights.sbomify.com/CVE-2021-41559/): Quadratic blowup in Convert::xml2array() (medium 6.5)
- [CVE-2021-41558](https://insights.sbomify.com/CVE-2021-41558/): Security feature bypass in set user project:set user (critical 9.8)
- [CVE-2021-41557](https://insights.sbomify.com/CVE-2021-41557/): Cross-site scripting in sofico:miles rich internet application (medium 5.4)
- [CVE-2021-41556](https://insights.sbomify.com/CVE-2021-41556/): Memory corruption in fedoraproject:fedora (critical 10.0)
- [CVE-2021-41555](https://insights.sbomify.com/CVE-2021-41555/): Cross-site scripting in archibus:web central (medium 6.1)
- [CVE-2021-41554](https://insights.sbomify.com/CVE-2021-41554/): Missing authorization in archibus:web central (high 8.8)
- [CVE-2021-41553](https://insights.sbomify.com/CVE-2021-41553/): Auth bypass in archibus:web central (critical 9.8)
- [CVE-2021-41552](https://insights.sbomify.com/CVE-2021-41552/): Command injection in commscope:arris surfboard sbg10 firmware (high 8.8)
- [CVE-2021-41551](https://insights.sbomify.com/CVE-2021-41551/): Path traversal in leostream:connection broker (medium 4.9)
- [CVE-2021-41550](https://insights.sbomify.com/CVE-2021-41550/): File upload in leostream:connection broker (high 7.2)
- [CVE-2021-4155](https://insights.sbomify.com/CVE-2021-4155/): Information disclosure in kernel (medium 5.5)
- [CVE-2021-41547](https://insights.sbomify.com/CVE-2021-41547/): Path traversal in Teamcenter Active Workspace V4.3 (high 7.2)
- [CVE-2021-41546](https://insights.sbomify.com/CVE-2021-41546/): Denial of service in RUGGEDCOM ROX MX5000 (high 7.5)
- [CVE-2021-41545](https://insights.sbomify.com/CVE-2021-41545/): Denial of service in Desigo DXR2 (high 7.5)
- [CVE-2021-41544](https://insights.sbomify.com/CVE-2021-41544/): Privilege escalation in Siemens Software Center (high 7.8)
- [CVE-2021-41543](https://insights.sbomify.com/CVE-2021-41543/): Information disclosure in Climatix POL909 (AWB module) (medium 6.5)
- [CVE-2021-41542](https://insights.sbomify.com/CVE-2021-41542/): Cross-site scripting in Climatix POL909 (AWB module) (medium 6.1)
- [CVE-2021-41541](https://insights.sbomify.com/CVE-2021-41541/): Cross-site scripting in Climatix POL909 (AWB module) (medium 6.1)
- [CVE-2021-41540](https://insights.sbomify.com/CVE-2021-41540/): Use after free in Solid Edge SE2021 (high 7.8)
- [CVE-2021-4154](https://insights.sbomify.com/CVE-2021-4154/): Use after free in kernel (high 8.8)
- [CVE-2021-41539](https://insights.sbomify.com/CVE-2021-41539/): Use after free in Solid Edge SE2021 (high 7.8)
- [CVE-2021-41538](https://insights.sbomify.com/CVE-2021-41538/): Information disclosure in NX 1953 Series (low 3.3)
- [CVE-2021-41537](https://insights.sbomify.com/CVE-2021-41537/): Use after free in Solid Edge SE2021 (high 7.8)
- [CVE-2021-41536](https://insights.sbomify.com/CVE-2021-41536/): Use after free in Solid Edge SE2021 (high 7.8)
- [CVE-2021-41535](https://insights.sbomify.com/CVE-2021-41535/): Use after free in NX 1953 Series (high 7.8)
- [CVE-2021-41534](https://insights.sbomify.com/CVE-2021-41534/): Memory corruption in NX 1980 Series (low 3.3)
- [CVE-2021-41533](https://insights.sbomify.com/CVE-2021-41533/): Memory corruption in NX 1980 Series (low 3.3)
- [CVE-2021-41532](https://insights.sbomify.com/CVE-2021-41532/): Unauthenticated access to Ozone Recon HTTP endpoints (medium 5.3)
- [CVE-2021-41531](https://insights.sbomify.com/CVE-2021-41531/): Invalid RPKI data could disable Route Origin Validation on RTR clients. (high 7.5)
- [CVE-2021-41530](https://insights.sbomify.com/CVE-2021-41530/): Denial of service in Forcepoint Next Generation Firewall (high 7.5)
- [CVE-2021-41528](https://insights.sbomify.com/CVE-2021-41528/): Improper authorization related to Import / Export interfaces on RISC Platform (medium 5.3)
- [CVE-2021-41527](https://insights.sbomify.com/CVE-2021-41527/): 2FA bypass on the RISC Platform (low 2.3)
- [CVE-2021-41526](https://insights.sbomify.com/CVE-2021-41526/): Privilege escalation in flexera:revenera installshield (high 7.8)
- [CVE-2021-41525](https://insights.sbomify.com/CVE-2021-41525/): Other in flexera:flexnet inventory agent and beacon (medium 5.5)
- [CVE-2021-41524](https://insights.sbomify.com/CVE-2021-41524/): null pointer dereference in h2 fuzzing (high 7.5)
- [CVE-2021-41511](https://insights.sbomify.com/CVE-2021-41511/): SQL injection in lodging reservation management system project:lodging reservation management system (critical 9.8)
- [CVE-2021-41506](https://insights.sbomify.com/CVE-2021-41506/): Hardcoded credentials in xiongmaitech:ahb7008t-mh-v2 firmware (critical 9.8)
- [CVE-2021-41504](https://insights.sbomify.com/CVE-2021-41504/): Auth bypass in dlink:dcs-5000l firmware (high 8.0)
- [CVE-2021-41503](https://insights.sbomify.com/CVE-2021-41503/): Auth bypass in d-link:dcs-5000l firmware (high 8.0)
- [CVE-2021-41502](https://insights.sbomify.com/CVE-2021-41502/): Cross site scripting in intelliants/subrion (medium 5.4)
- [CVE-2021-41500](https://insights.sbomify.com/CVE-2021-41500/): Incorrect Comparison in cvxopt (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/88/