# Vulnerabilities published in 2021


- [CVE-2021-41347](https://insights.sbomify.com/CVE-2021-41347/): Windows AppX Deployment Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41346](https://insights.sbomify.com/CVE-2021-41346/): Console Window Host Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2021-41345](https://insights.sbomify.com/CVE-2021-41345/): Storage Spaces Controller Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41344](https://insights.sbomify.com/CVE-2021-41344/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2021-41343](https://insights.sbomify.com/CVE-2021-41343/): Windows Fast FAT File System Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-41342](https://insights.sbomify.com/CVE-2021-41342/): Windows MSHTML Platform Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2021-41340](https://insights.sbomify.com/CVE-2021-41340/): Windows Graphics Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-4134](https://insights.sbomify.com/CVE-2021-4134/): Fancy Product Designer <= 4.7.4 Admin+ SQL Injection (high 7.2)
- [CVE-2021-41339](https://insights.sbomify.com/CVE-2021-41339/): Microsoft DWM Core Library Elevation of Privilege Vulnerability (medium 4.7)
- [CVE-2021-41338](https://insights.sbomify.com/CVE-2021-41338/): Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2021-41337](https://insights.sbomify.com/CVE-2021-41337/): Active Directory Security Feature Bypass Vulnerability (medium 4.9)
- [CVE-2021-41336](https://insights.sbomify.com/CVE-2021-41336/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-41335](https://insights.sbomify.com/CVE-2021-41335/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41334](https://insights.sbomify.com/CVE-2021-41334/): Windows Desktop Bridge Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2021-41333](https://insights.sbomify.com/CVE-2021-41333/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2021-41332](https://insights.sbomify.com/CVE-2021-41332/): Windows Print Spooler Information Disclosure Vulnerability (medium 6.5)
- [CVE-2021-41331](https://insights.sbomify.com/CVE-2021-41331/): Windows Media Audio Decoder Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-41330](https://insights.sbomify.com/CVE-2021-41330/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-4133](https://insights.sbomify.com/CVE-2021-4133/): Improper Authorization in Keycloak (high 8.8)
- [CVE-2021-41329](https://insights.sbomify.com/CVE-2021-41329/): Information disclosure in datalust:seq (medium 6.5)
- [CVE-2021-41326](https://insights.sbomify.com/CVE-2021-41326/): Command injection in misp-project:misp (critical 9.8)
- [CVE-2021-41325](https://insights.sbomify.com/CVE-2021-41325/): Missing authorization in pydio:cells (medium 6.5)
- [CVE-2021-41324](https://insights.sbomify.com/CVE-2021-41324/): Path traversal in pydio:cells (medium 6.5)
- [CVE-2021-41323](https://insights.sbomify.com/CVE-2021-41323/): Path traversal in pydio:cells (medium 6.5)
- [CVE-2021-41322](https://insights.sbomify.com/CVE-2021-41322/): Business logic in polycom:vvx 400 firmware (high 8.8)
- [CVE-2021-41320](https://insights.sbomify.com/CVE-2021-41320/): Hardcoded credentials in iongroup:wallstreet suite (medium 5.5)
- [CVE-2021-4132](https://insights.sbomify.com/CVE-2021-4132/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (high 7.3)
- [CVE-2021-41318](https://insights.sbomify.com/CVE-2021-41318/): Cross-site scripting in progress:whatsup gold (medium 6.1)
- [CVE-2021-41317](https://insights.sbomify.com/CVE-2021-41317/): Auth bypass in xss hunter express project:xss hunter express (critical 9.8)
- [CVE-2021-41316](https://insights.sbomify.com/CVE-2021-41316/): Command injection in device42:device42 (high 8.1)
- [CVE-2021-41315](https://insights.sbomify.com/CVE-2021-41315/): Command injection in device42:remote collector (high 8.8)
- [CVE-2021-41314](https://insights.sbomify.com/CVE-2021-41314/): Auth bypass in netgear:gc108p firmware (high 8.8)
- [CVE-2021-41313](https://insights.sbomify.com/CVE-2021-41313/): Missing authorization in Jira Data Center (medium 4.3)
- [CVE-2021-41312](https://insights.sbomify.com/CVE-2021-41312/): Auth bypass in Jira Data Center (high 7.5)
- [CVE-2021-41311](https://insights.sbomify.com/CVE-2021-41311/): Auth bypass in Jira Data Center (high 7.5)
- [CVE-2021-41310](https://insights.sbomify.com/CVE-2021-41310/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2021-4131](https://insights.sbomify.com/CVE-2021-4131/): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (medium 6.5)
- [CVE-2021-41309](https://insights.sbomify.com/CVE-2021-41309/): Auth bypass in Jira Data Center (medium 5.3)
- [CVE-2021-41308](https://insights.sbomify.com/CVE-2021-41308/): Missing authorization in Jira Data Center (medium 6.5)
- [CVE-2021-41307](https://insights.sbomify.com/CVE-2021-41307/): Missing authorization in Jira Data Center (high 7.5)
- [CVE-2021-41306](https://insights.sbomify.com/CVE-2021-41306/): Missing authorization in Jira Data Center (high 7.5)
- [CVE-2021-41305](https://insights.sbomify.com/CVE-2021-41305/): Missing authorization in Jira Data Center (high 7.5)
- [CVE-2021-41304](https://insights.sbomify.com/CVE-2021-41304/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2021-41303](https://insights.sbomify.com/CVE-2021-41303/): Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass (critical 9.8)
- [CVE-2021-41302](https://insights.sbomify.com/CVE-2021-41302/): ECOA BAS controller - Missing Encryption of Sensitive Data (high 7.3)
- [CVE-2021-41301](https://insights.sbomify.com/CVE-2021-41301/): ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor (critical 9.8)
- [CVE-2021-41300](https://insights.sbomify.com/CVE-2021-41300/): ECOA BAS controller - Insufficiently Protected Credentials-2 (critical 9.8)
- [CVE-2021-4130](https://insights.sbomify.com/CVE-2021-4130/): Cross-Site Request Forgery (CSRF) in snipe/snipe-it (medium 4.3)
- [CVE-2021-41299](https://insights.sbomify.com/CVE-2021-41299/): ECOA BAS controller - Use of Hard-coded Credentials (critical 9.8)
- [CVE-2021-41298](https://insights.sbomify.com/CVE-2021-41298/): ECOA BAS controller - Improper Access Control (high 8.8)
- [CVE-2021-41297](https://insights.sbomify.com/CVE-2021-41297/): ECOA BAS controller - Insufficiently Protected Credentials-1 (high 8.8)
- [CVE-2021-41296](https://insights.sbomify.com/CVE-2021-41296/): ECOA BAS controller - Weak Password Requirements (critical 9.8)
- [CVE-2021-41295](https://insights.sbomify.com/CVE-2021-41295/): ECOA BAS controller - Cross-Site Request Forgery (CSRF) (high 8.8)
- [CVE-2021-41294](https://insights.sbomify.com/CVE-2021-41294/): ECOA BAS controller - Path Traversal-4 (critical 9.1)
- [CVE-2021-41293](https://insights.sbomify.com/CVE-2021-41293/): ECOA BAS controller - Path Traversal-3 (high 7.5)
- [CVE-2021-41292](https://insights.sbomify.com/CVE-2021-41292/): ECOA BAS controller - Broken Authentication (critical 9.8)
- [CVE-2021-41291](https://insights.sbomify.com/CVE-2021-41291/): ECOA BAS controller - Path Traversal-1 (high 7.5)
- [CVE-2021-41290](https://insights.sbomify.com/CVE-2021-41290/): ECOA BAS controller - Path Traversal-1 (critical 9.8)
- [CVE-2021-4129](https://insights.sbomify.com/CVE-2021-4129/): Memory corruption in Firefox (critical 9.8)
- [CVE-2021-41289](https://insights.sbomify.com/CVE-2021-41289/): ASUS P453UJ - Improper Restriction of Operations within the Bounds of a Memory Buffer (medium 6.3)
- [CVE-2021-41288](https://insights.sbomify.com/CVE-2021-41288/): SQL injection in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2021-41286](https://insights.sbomify.com/CVE-2021-41286/): Auth bypass in omikron:multicash (high 7.8)
- [CVE-2021-41285](https://insights.sbomify.com/CVE-2021-41285/): Privilege escalation in micron:ballistix memory overview display utility (high 7.8)
- [CVE-2021-41282](https://insights.sbomify.com/CVE-2021-41282/): Code injection in pfsense:pfsense (high 8.8)
- [CVE-2021-41281](https://insights.sbomify.com/CVE-2021-41281/): Path traversal in Matrix Synapse (high 7.5)
- [CVE-2021-41280](https://insights.sbomify.com/CVE-2021-41280/): OS command injection in Sharetribe Go (critical 9.8)
- [CVE-2021-4128](https://insights.sbomify.com/CVE-2021-4128/): Use after free in Firefox (medium 6.5)
- [CVE-2021-41279](https://insights.sbomify.com/CVE-2021-41279/): Zip Slip Vulnerability in BaserCMS (high 7.7)
- [CVE-2021-41278](https://insights.sbomify.com/CVE-2021-41278/): Broken encryption in EdgeX Foundry (medium 5.4)
- [CVE-2021-41277](https://insights.sbomify.com/CVE-2021-41277/): Metabase GeoJSON API Local File Inclusion (critical 10.0, exploited in the wild)
- [CVE-2021-41276](https://insights.sbomify.com/CVE-2021-41276/): Indirect LDAP injection in Tuleap (medium 6.7)
- [CVE-2021-41275](https://insights.sbomify.com/CVE-2021-41275/): Authentication Bypass by CSRF Weakness (critical 9.3)
- [CVE-2021-41274](https://insights.sbomify.com/CVE-2021-41274/): Authentication Bypass by CSRF Weakness (critical 9.3)
- [CVE-2021-41273](https://insights.sbomify.com/CVE-2021-41273/): Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys (medium 4.3)
- [CVE-2021-41272](https://insights.sbomify.com/CVE-2021-41272/): SHL, SHR, and SAR operations trigger native exception at key values in besu (high 7.5)
- [CVE-2021-41271](https://insights.sbomify.com/CVE-2021-41271/): Cache poisoning via maliciously-formed request in discourse (medium 4.8)
- [CVE-2021-41270](https://insights.sbomify.com/CVE-2021-41270/): CSV Injection in Symfony (medium 6.5)
- [CVE-2021-4127](https://insights.sbomify.com/CVE-2021-4127/): Memory corruption in Firefox ESR (critical 9.8)
- [CVE-2021-41269](https://insights.sbomify.com/CVE-2021-41269/): Unauthenticated remote code injection in cron-utils (critical 10.0)
- [CVE-2021-41268](https://insights.sbomify.com/CVE-2021-41268/): Cookie persistence in Symfony (medium 6.5)
- [CVE-2021-41267](https://insights.sbomify.com/CVE-2021-41267/): Webcache Poisoning in Symfony (medium 6.5)
- [CVE-2021-41266](https://insights.sbomify.com/CVE-2021-41266/): Authentication bypass issue in the Operator Console (high 8.6)
- [CVE-2021-41265](https://insights.sbomify.com/CVE-2021-41265/): Improper Authentication in Flask-AppBuilder (high 8.1)
- [CVE-2021-41264](https://insights.sbomify.com/CVE-2021-41264/): UUPSUpgradeable vulnerability in OpenZeppelin Contracts (critical 9.8)
- [CVE-2021-41263](https://insights.sbomify.com/CVE-2021-41263/): Secure/signed cookies share secrets between sites in rails_multisite (high 8.3)
- [CVE-2021-41262](https://insights.sbomify.com/CVE-2021-41262/): SQL Injection in Galette (high 8.8)
- [CVE-2021-41261](https://insights.sbomify.com/CVE-2021-41261/): Stored Cross-site Scripting in Galette (high 8.1)
- [CVE-2021-41260](https://insights.sbomify.com/CVE-2021-41260/): Missing CSRF checks in Galette (high 8.2)
- [CVE-2021-4126](https://insights.sbomify.com/CVE-2021-4126/): Security feature bypass in Thunderbird (medium 6.5)
- [CVE-2021-41258](https://insights.sbomify.com/CVE-2021-41258/): Cross-site scripting (XSS) from image block content in the site frontend (high 7.3)
- [CVE-2021-41256](https://insights.sbomify.com/CVE-2021-41256/): Intent URI permissions manipulation in nextcloud news-android (medium 5.8)
- [CVE-2021-41254](https://insights.sbomify.com/CVE-2021-41254/): Privilege escalation to cluster admin on multi-tenant environments (high 8.8)
- [CVE-2021-41253](https://insights.sbomify.com/CVE-2021-41253/): Possible heap buffer overflow when using zycore string functions in formatter hooks (medium 5.9)
- [CVE-2021-41252](https://insights.sbomify.com/CVE-2021-41252/): Cross-site scripting (XSS) from writer field content in the site frontend (high 7.3)
- [CVE-2021-41251](https://insights.sbomify.com/CVE-2021-41251/): Possibility to elevate privileges or get unauthorized access to data (medium 5.9)
- [CVE-2021-41250](https://insights.sbomify.com/CVE-2021-41250/): Presence of non-blacklisted URL bypasses all other filters (medium 4.3)
- [CVE-2021-4125](https://insights.sbomify.com/CVE-2021-4125/): Deserialization in kube-reporting/hive (high 8.1)
- [CVE-2021-41249](https://insights.sbomify.com/CVE-2021-41249/): XSS vulnerability in GraphQL Playground (high 7.1)
- [CVE-2021-41248](https://insights.sbomify.com/CVE-2021-41248/): XSS vulnerability in GraphiQL (high 7.1)
- [CVE-2021-41247](https://insights.sbomify.com/CVE-2021-41247/): incomplete logout in JupyterHub (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/90/