# Vulnerabilities published in 2021


- [CVE-2021-4150](https://insights.sbomify.com/CVE-2021-4150/): Use after free in kernel (medium 5.5)
- [CVE-2021-41499](https://insights.sbomify.com/CVE-2021-41499/): Classic Buffer Overflow in pyo (high 7.5)
- [CVE-2021-41498](https://insights.sbomify.com/CVE-2021-41498/): Pyo Buffer Overflow Vulnerability (high 7.5)
- [CVE-2021-41497](https://insights.sbomify.com/CVE-2021-41497/): bounter Null pointer reference (high 7.5)
- [CVE-2021-41496](https://insights.sbomify.com/CVE-2021-41496/): Buffer Copy without Checking Size of Input in NumPy (medium 5.5)
- [CVE-2021-41495](https://insights.sbomify.com/CVE-2021-41495/): NumPy NULL Pointer Dereference (medium 5.3)
- [CVE-2021-41492](https://insights.sbomify.com/CVE-2021-41492/): SQL injection in simple cashiering system project:simple cashiering system (critical 9.8)
- [CVE-2021-41490](https://insights.sbomify.com/CVE-2021-41490/): Denial of service in rice:open motion planning library (high 7.5)
- [CVE-2021-4149](https://insights.sbomify.com/CVE-2021-4149/): Denial of service in kernel (medium 5.5)
- [CVE-2021-41487](https://insights.sbomify.com/CVE-2021-41487/): SQL injection in nokia:vitalsuite (critical 9.8)
- [CVE-2021-4148](https://insights.sbomify.com/CVE-2021-4148/): Denial of service in kernel (medium 5.5)
- [CVE-2021-41472](https://insights.sbomify.com/CVE-2021-41472/): SQL injection in simple membership system using php and ajax project:simple membership system using php and ajax (critical 9.8)
- [CVE-2021-41471](https://insights.sbomify.com/CVE-2021-41471/): SQL injection in south gate inn online reservation system project:south gate inn online reservation system (critical 9.8)
- [CVE-2021-4147](https://insights.sbomify.com/CVE-2021-4147/): Denial of service in libvirt (medium 6.5)
- [CVE-2021-41467](https://insights.sbomify.com/CVE-2021-41467/): Cross-site scripting in application/controllers/dropbox.php in JustWriting (medium 6.1)
- [CVE-2021-41465](https://insights.sbomify.com/CVE-2021-41465/): Cross-site scripting in concrete5-legacy project:concrete5-legacy (medium 6.1)
- [CVE-2021-41464](https://insights.sbomify.com/CVE-2021-41464/): Cross-site scripting in concrete5-legacy project:concrete5-legacy (medium 6.1)
- [CVE-2021-41463](https://insights.sbomify.com/CVE-2021-41463/): Cross-site scripting in concrete5-legacy project:concrete5-legacy (medium 6.1)
- [CVE-2021-41462](https://insights.sbomify.com/CVE-2021-41462/): Cross-site scripting in concrete5-legacy project:concrete5-legacy (medium 6.1)
- [CVE-2021-41461](https://insights.sbomify.com/CVE-2021-41461/): Cross-site scripting in concrete5-legacy project:concrete5-legacy (medium 6.1)
- [CVE-2021-41460](https://insights.sbomify.com/CVE-2021-41460/): SQL injection in shopex:ecshop (high 7.5)
- [CVE-2021-4146](https://insights.sbomify.com/CVE-2021-4146/): Business Logic Errors in pimcore/pimcore (medium 4.3)
- [CVE-2021-41459](https://insights.sbomify.com/CVE-2021-41459/): Memory corruption in gpac:mp4box (high 7.5)
- [CVE-2021-41458](https://insights.sbomify.com/CVE-2021-41458/): Memory corruption in gpac:mp4box (medium 5.5)
- [CVE-2021-41457](https://insights.sbomify.com/CVE-2021-41457/): Memory corruption in gpac:mp4box (high 7.5)
- [CVE-2021-41456](https://insights.sbomify.com/CVE-2021-41456/): Memory corruption in gpac:mp4box (high 7.5)
- [CVE-2021-41451](https://insights.sbomify.com/CVE-2021-41451/): Misconfiguration in tp-link:archer ax10 firmware (high 7.5)
- [CVE-2021-41450](https://insights.sbomify.com/CVE-2021-41450/): Denial of service in tp-link:archer ax10 v1 firmware (high 7.5)
- [CVE-2021-4145](https://insights.sbomify.com/CVE-2021-4145/): Null dereference in QEMU (medium 6.5)
- [CVE-2021-41449](https://insights.sbomify.com/CVE-2021-41449/): Path traversal in netgear:rax35 firmware (high 7.1)
- [CVE-2021-41445](https://insights.sbomify.com/CVE-2021-41445/): Cross-site scripting in dlink:dir-x1860 firmware (medium 6.1)
- [CVE-2021-41442](https://insights.sbomify.com/CVE-2021-41442/): Denial of service in dlink:dir-x1860 firmware (high 7.5)
- [CVE-2021-41441](https://insights.sbomify.com/CVE-2021-41441/): Denial of service in dlink:dir-x1860 firmware (high 7.4)
- [CVE-2021-4144](https://insights.sbomify.com/CVE-2021-4144/): Command injection in TL-WR802N V4(JP) (high 8.8)
- [CVE-2021-41437](https://insights.sbomify.com/CVE-2021-41437/): Other in asus:rt-ax88u firmware (medium 6.5)
- [CVE-2021-41436](https://insights.sbomify.com/CVE-2021-41436/): Denial of service in asus:gt-ax11000 firmware (high 7.5)
- [CVE-2021-41435](https://insights.sbomify.com/CVE-2021-41435/): Security feature bypass in asus:gt-ax11000 firmware (critical 9.8)
- [CVE-2021-41434](https://insights.sbomify.com/CVE-2021-41434/): Cross-site scripting in oretnom23:expense management system (medium 5.4)
- [CVE-2021-41433](https://insights.sbomify.com/CVE-2021-41433/): SQL injection in resumes management and job application website application project:resumes management and job application website application (critical 9.8)
- [CVE-2021-41432](https://insights.sbomify.com/CVE-2021-41432/): Cross-site scripting in flatpress:flatpress (medium 5.4)
- [CVE-2021-4143](https://insights.sbomify.com/CVE-2021-4143/): Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton (high 8.1)
- [CVE-2021-41427](https://insights.sbomify.com/CVE-2021-41427/): Cross-site scripting in beeline:smart box firmware (medium 6.1)
- [CVE-2021-41426](https://insights.sbomify.com/CVE-2021-41426/): Cross-site request forgery in beeline:smart box firmware (high 8.8)
- [CVE-2021-41421](https://insights.sbomify.com/CVE-2021-41421/): Code injection in maianmedia:maianaffiliate (medium 4.8)
- [CVE-2021-41420](https://insights.sbomify.com/CVE-2021-41420/): Cross-site scripting in maianmedia:maianaffiliate (medium 5.4)
- [CVE-2021-4142](https://insights.sbomify.com/CVE-2021-4142/): Auth bypass in candlepin (medium 5.5)
- [CVE-2021-41419](https://insights.sbomify.com/CVE-2021-41419/): Deserialization in qvis:dvr firmware (critical 9.8)
- [CVE-2021-41418](https://insights.sbomify.com/CVE-2021-41418/): Missing authorization in ariang project:ariang (critical 9.8)
- [CVE-2021-41415](https://insights.sbomify.com/CVE-2021-41415/): Cross-site scripting in subscription-manager project:subscription-manager (medium 6.1)
- [CVE-2021-41413](https://insights.sbomify.com/CVE-2021-41413/): Memory corruption in ok-file-formats project:ok-file-formats (high 7.8)
- [CVE-2021-41411](https://insights.sbomify.com/CVE-2021-41411/): XML External Entity Reference in drools (critical 9.8)
- [CVE-2021-41408](https://insights.sbomify.com/CVE-2021-41408/): SQL injection in voipmonitor:voipmonitor (critical 9.8)
- [CVE-2021-41403](https://insights.sbomify.com/CVE-2021-41403/): Server-side request forgery in flatcore:flatcore-cms (critical 9.8)
- [CVE-2021-41402](https://insights.sbomify.com/CVE-2021-41402/): Code injection in flatcore:flatcore-cms (high 8.8)
- [CVE-2021-4140](https://insights.sbomify.com/CVE-2021-4140/): Security feature bypass in Firefox (critical 9.8)
- [CVE-2021-41396](https://insights.sbomify.com/CVE-2021-41396/): Memory corruption in live555:live555 (high 7.5)
- [CVE-2021-41395](https://insights.sbomify.com/CVE-2021-41395/): Other in goteleport:teleport (medium 6.5)
- [CVE-2021-41394](https://insights.sbomify.com/CVE-2021-41394/): Other in goteleport:teleport (medium 5.3)
- [CVE-2021-41393](https://insights.sbomify.com/CVE-2021-41393/): Security feature bypass in goteleport:teleport (critical 9.8)
- [CVE-2021-41392](https://insights.sbomify.com/CVE-2021-41392/): Code injection in boostnote:boostnote (critical 9.8)
- [CVE-2021-41391](https://insights.sbomify.com/CVE-2021-41391/): Cross-site scripting in ericsson:enterprise content management (medium 5.4)
- [CVE-2021-41390](https://insights.sbomify.com/CVE-2021-41390/): Code injection in ericsson:enterprise content management (high 8.0)
- [CVE-2021-4139](https://insights.sbomify.com/CVE-2021-4139/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.6)
- [CVE-2021-41388](https://insights.sbomify.com/CVE-2021-41388/): Privilege escalation in netskope:netskope (high 7.8)
- [CVE-2021-41387](https://insights.sbomify.com/CVE-2021-41387/): Privilege escalation in seatd project:seatd (high 8.8)
- [CVE-2021-41385](https://insights.sbomify.com/CVE-2021-41385/): Server-side request forgery in securonix:snypr (medium 6.5)
- [CVE-2021-41383](https://insights.sbomify.com/CVE-2021-41383/): Command injection in netgear:r6020 firmware (high 7.2)
- [CVE-2021-41382](https://insights.sbomify.com/CVE-2021-41382/): Other in plasticscm:plastic scm (high 7.5)
- [CVE-2021-41381](https://insights.sbomify.com/CVE-2021-41381/): Path traversal in payara:micro community (high 7.5)
- [CVE-2021-41380](https://insights.sbomify.com/CVE-2021-41380/): Denial of service in realvnc:vnc viewer (medium 6.5)
- [CVE-2021-4138](https://insights.sbomify.com/CVE-2021-4138/): Server-side request forgery in geckodriver (medium 5.3)
- [CVE-2021-41379](https://insights.sbomify.com/CVE-2021-41379/): Microsoft Windows Installer Privilege Escalation (medium 5.5, exploited in the wild)
- [CVE-2021-41378](https://insights.sbomify.com/CVE-2021-41378/): Windows NTFS Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-41377](https://insights.sbomify.com/CVE-2021-41377/): Windows Fast FAT File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41376](https://insights.sbomify.com/CVE-2021-41376/): Azure Sphere Information Disclosure Vulnerability (low 2.3)
- [CVE-2021-41375](https://insights.sbomify.com/CVE-2021-41375/): Azure Sphere Information Disclosure Vulnerability (medium 4.4)
- [CVE-2021-41374](https://insights.sbomify.com/CVE-2021-41374/): Azure Sphere Information Disclosure Vulnerability (medium 6.7)
- [CVE-2021-41373](https://insights.sbomify.com/CVE-2021-41373/): FSLogix Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-41372](https://insights.sbomify.com/CVE-2021-41372/): Power BI Report Server Spoofing Vulnerability (high 7.6)
- [CVE-2021-41371](https://insights.sbomify.com/CVE-2021-41371/): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (medium 4.4)
- [CVE-2021-41370](https://insights.sbomify.com/CVE-2021-41370/): NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41368](https://insights.sbomify.com/CVE-2021-41368/): Microsoft Access Remote Code Execution Vulnerability (medium 6.1)
- [CVE-2021-41367](https://insights.sbomify.com/CVE-2021-41367/): NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41366](https://insights.sbomify.com/CVE-2021-41366/): Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41365](https://insights.sbomify.com/CVE-2021-41365/): Microsoft Defender for IoT Remote Code Execution Vulnerability (high 8.8)
- [CVE-2021-41363](https://insights.sbomify.com/CVE-2021-41363/): Intune Management Extension Security Feature Bypass Vulnerability (medium 4.2)
- [CVE-2021-41361](https://insights.sbomify.com/CVE-2021-41361/): Active Directory Federation Server Spoofing Vulnerability (medium 5.4)
- [CVE-2021-41360](https://insights.sbomify.com/CVE-2021-41360/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-4136](https://insights.sbomify.com/CVE-2021-4136/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2021-41357](https://insights.sbomify.com/CVE-2021-41357/): Microsoft Win32k Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2021-41356](https://insights.sbomify.com/CVE-2021-41356/): Windows Denial of Service Vulnerability (high 7.5)
- [CVE-2021-41355](https://insights.sbomify.com/CVE-2021-41355/): .NET Core and Visual Studio Information Disclosure Vulnerability (medium 5.7)
- [CVE-2021-41354](https://insights.sbomify.com/CVE-2021-41354/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2021-41353](https://insights.sbomify.com/CVE-2021-41353/): Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability (medium 5.4)
- [CVE-2021-41352](https://insights.sbomify.com/CVE-2021-41352/): SCOM Information Disclosure Vulnerability (high 7.5)
- [CVE-2021-41351](https://insights.sbomify.com/CVE-2021-41351/): Microsoft Edge (Chrome based) Spoofing on IE Mode (medium 4.3)
- [CVE-2021-41350](https://insights.sbomify.com/CVE-2021-41350/): Microsoft Exchange Server Spoofing Vulnerability (medium 6.5)
- [CVE-2021-4135](https://insights.sbomify.com/CVE-2021-4135/): Information disclosure in kernel (medium 5.5)
- [CVE-2021-41349](https://insights.sbomify.com/CVE-2021-41349/): Microsoft Exchange Server Spoofing Vulnerability (medium 6.5)
- [CVE-2021-41348](https://insights.sbomify.com/CVE-2021-41348/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 8.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/89/