# Vulnerabilities published in 2021


- [CVE-2021-41151](https://insights.sbomify.com/CVE-2021-41151/): Path Traversal in @backstage/plugin-scaffolder-backend (medium 6.8)
- [CVE-2021-41150](https://insights.sbomify.com/CVE-2021-41150/): Improper sanitization of delegated role names in tough (high 8.2)
- [CVE-2021-4115](https://insights.sbomify.com/CVE-2021-4115/): Denial of service in polkitd (medium 5.5)
- [CVE-2021-41149](https://insights.sbomify.com/CVE-2021-41149/): Improper sanitization of target names in tough (high 8.2)
- [CVE-2021-41148](https://insights.sbomify.com/CVE-2021-41148/): The update of the CI job targeted by a widget is vulnerable to blind SQL injections (high 8.8)
- [CVE-2021-41147](https://insights.sbomify.com/CVE-2021-41147/): SQL injection in the planning edition panel (high 7.2)
- [CVE-2021-41146](https://insights.sbomify.com/CVE-2021-41146/): Arbitrary command execution on Windows in qutebrowser (high 8.8)
- [CVE-2021-41145](https://insights.sbomify.com/CVE-2021-41145/): FreeSWITCH susceptible to Denial of Service via SIP flooding (high 8.6)
- [CVE-2021-41144](https://insights.sbomify.com/CVE-2021-41144/): OpenMage LTS authenticated remote code execution through layout update (high 8.8)
- [CVE-2021-41143](https://insights.sbomify.com/CVE-2021-41143/): OpenMage LTS arbitrary file deletion in customer media allows for remote code execution (high 7.2)
- [CVE-2021-41142](https://insights.sbomify.com/CVE-2021-41142/): XSS via the name of a deleted attachment (medium 5.4)
- [CVE-2021-41141](https://insights.sbomify.com/CVE-2021-41141/): Missing release of locks in PJSIP (medium 5.9)
- [CVE-2021-41140](https://insights.sbomify.com/CVE-2021-41140/): Reactions leak for secure category topics and private messages (medium 5.3)
- [CVE-2021-41139](https://insights.sbomify.com/CVE-2021-41139/): Reflected XSS vulnerability in time.php (high 8.1)
- [CVE-2021-41138](https://insights.sbomify.com/CVE-2021-41138/): Validity check for signed Frontier-specific extrinsic not called in block execution (medium 5.3)
- [CVE-2021-41137](https://insights.sbomify.com/CVE-2021-41137/): Bypassing policy restrictions on regular users (high 8.8)
- [CVE-2021-41136](https://insights.sbomify.com/CVE-2021-41136/): Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma (low 3.7)
- [CVE-2021-41135](https://insights.sbomify.com/CVE-2021-41135/): Authz Module Non-Determinism (medium 6.5)
- [CVE-2021-41134](https://insights.sbomify.com/CVE-2021-41134/): Stored XSS in Jupyter nbdime (high 8.7)
- [CVE-2021-41133](https://insights.sbomify.com/CVE-2021-41133/): Sandbox bypass via recent VFS-manipulating syscalls (high 8.8)
- [CVE-2021-41132](https://insights.sbomify.com/CVE-2021-41132/): Inconsistent input sanitisation leads to XSS vectors (critical 9.8)
- [CVE-2021-41131](https://insights.sbomify.com/CVE-2021-41131/): Client metadata path-traversal in python-tuf (high 7.5)
- [CVE-2021-41130](https://insights.sbomify.com/CVE-2021-41130/): X-Endpoint-API-UserInfo can be spoofed in cloudendpoints Extensible Service Proxy (medium 6.4)
- [CVE-2021-41129](https://insights.sbomify.com/CVE-2021-41129/): Authentication bypass in Pterodactyl (high 8.1)
- [CVE-2021-41128](https://insights.sbomify.com/CVE-2021-41128/): CSV Injection Vulnerability in Hygeia (critical 9.1)
- [CVE-2021-41127](https://insights.sbomify.com/CVE-2021-41127/): Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa (high 7.3)
- [CVE-2021-41126](https://insights.sbomify.com/CVE-2021-41126/): Deleted Admin Can Sign In to Admin Interface (high 7.2)
- [CVE-2021-41125](https://insights.sbomify.com/CVE-2021-41125/): HTTP authentication credential leak to target websites in scrapy (medium 5.7)
- [CVE-2021-41124](https://insights.sbomify.com/CVE-2021-41124/): Splash authentication credentials potentially leaked to target websites in scrapy-splash (high 7.4)
- [CVE-2021-41123](https://insights.sbomify.com/CVE-2021-41123/): Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll (medium 5.3)
- [CVE-2021-41122](https://insights.sbomify.com/CVE-2021-41122/): Bounds check missing for decimal args in Vyper (medium 4.3)
- [CVE-2021-41121](https://insights.sbomify.com/CVE-2021-41121/): Memory corruption in Vyper (high 7.5)
- [CVE-2021-41120](https://insights.sbomify.com/CVE-2021-41120/): Unauthorized access to Credit card form in sylius/paypal-plugin (high 7.5)
- [CVE-2021-4112](https://insights.sbomify.com/CVE-2021-4112/): Privilege escalation in ansible-tower (high 8.8)
- [CVE-2021-41119](https://insights.sbomify.com/CVE-2021-41119/): DoS vulnerabiliity in wire-server json parser (medium 5.3)
- [CVE-2021-41118](https://insights.sbomify.com/CVE-2021-41118/): ReDoS in DynamicPageList3 (medium 5.3)
- [CVE-2021-41117](https://insights.sbomify.com/CVE-2021-41117/): Insecure random number generation (high 8.7)
- [CVE-2021-41116](https://insights.sbomify.com/CVE-2021-41116/): Command injection in composer on Windows (high 8.2)
- [CVE-2021-41115](https://insights.sbomify.com/CVE-2021-41115/): Regular expression denial-of-service in Zulip (medium 4.3)
- [CVE-2021-41114](https://insights.sbomify.com/CVE-2021-41114/): HTTP Host Header Injection in Request Handling in Typo3 (medium 4.8)
- [CVE-2021-41113](https://insights.sbomify.com/CVE-2021-41113/): Cross-Site-Request-Forgery in Backend URI Handling in Typo3 (high 8.8)
- [CVE-2021-41112](https://insights.sbomify.com/CVE-2021-41112/): Missing Authorization in Rundeck (high 8.1)
- [CVE-2021-41111](https://insights.sbomify.com/CVE-2021-41111/): Authorization Bypass Through User-Controlled Key in Rundeck (medium 6.4)
- [CVE-2021-41110](https://insights.sbomify.com/CVE-2021-41110/): CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker (critical 9.1)
- [CVE-2021-4111](https://insights.sbomify.com/CVE-2021-4111/): Business Logic Errors in yetiforcecompany/yetiforcecrm (high 7.3)
- [CVE-2021-41109](https://insights.sbomify.com/CVE-2021-41109/): LiveQuery publishes user session tokens (high 7.5)
- [CVE-2021-41106](https://insights.sbomify.com/CVE-2021-41106/): File reference keys leads to incorrect hashes on HMAC algorithms (medium 4.4)
- [CVE-2021-41105](https://insights.sbomify.com/CVE-2021-41105/): FreeSWITCH susceptible to Denial of Service via invalid SRTP packets (high 7.5)
- [CVE-2021-41104](https://insights.sbomify.com/CVE-2021-41104/): web_server allows OTA update without checking user defined basic auth username & password (high 7.5)
- [CVE-2021-41103](https://insights.sbomify.com/CVE-2021-41103/): Insufficiently restricted permissions on plugin directories (medium 5.9)
- [CVE-2021-41101](https://insights.sbomify.com/CVE-2021-41101/): CORS `Access-Control-Allow-Origin` settings are too lenient (medium 5.7)
- [CVE-2021-41100](https://insights.sbomify.com/CVE-2021-41100/): Account takeover when having only access to a user's short lived token in wire-server (high 7.4)
- [CVE-2021-4110](https://insights.sbomify.com/CVE-2021-4110/): NULL Pointer Dereference in mruby/mruby (critical 9.1)
- [CVE-2021-41099](https://insights.sbomify.com/CVE-2021-41099/): Integer overflow issue with strings in Redis (high 7.5)
- [CVE-2021-41098](https://insights.sbomify.com/CVE-2021-41098/): Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby (high 7.5)
- [CVE-2021-41097](https://insights.sbomify.com/CVE-2021-41097/): Prototype pollution in aurelia-path (critical 9.1)
- [CVE-2021-41096](https://insights.sbomify.com/CVE-2021-41096/): Use of a Broken or Risky Cryptographic Algorithm in com.mayank.rucky (high 7.5)
- [CVE-2021-41095](https://insights.sbomify.com/CVE-2021-41095/): XSS via blocked watched word in error message (medium 4.2)
- [CVE-2021-41094](https://insights.sbomify.com/CVE-2021-41094/): Mandatory encryption at rest can be bypassed (UI) in Wire app (medium 4.2)
- [CVE-2021-41093](https://insights.sbomify.com/CVE-2021-41093/): Account takeover when having only access to a user's short lived token (high 7.4)
- [CVE-2021-41092](https://insights.sbomify.com/CVE-2021-41092/): Docker CLI leaks private registry credentials to registry-1.docker.io (medium 5.4)
- [CVE-2021-41091](https://insights.sbomify.com/CVE-2021-41091/): Insufficiently restricted permissions on data directory in Docker Engine (medium 6.3)
- [CVE-2021-41090](https://insights.sbomify.com/CVE-2021-41090/): Instance config inline secret exposure (medium 6.5)
- [CVE-2021-41089](https://insights.sbomify.com/CVE-2021-41089/): `docker cp` allows unexpected chmod of host files (low 2.8)
- [CVE-2021-41088](https://insights.sbomify.com/CVE-2021-41088/): Remote code execution via the web UI backend of Elvish (high 8.0)
- [CVE-2021-41087](https://insights.sbomify.com/CVE-2021-41087/): Improperly Implemented path matching for in-toto-golang (medium 5.6)
- [CVE-2021-41086](https://insights.sbomify.com/CVE-2021-41086/): Clipboard-based XSS in jsuites (high 8.7)
- [CVE-2021-41084](https://insights.sbomify.com/CVE-2021-41084/): Response Splitting from unsanitized headers in http4s (high 8.7)
- [CVE-2021-41083](https://insights.sbomify.com/CVE-2021-41083/): CSRF Vulnerability in dada-mail 11.15.1 and below (high 8.0)
- [CVE-2021-41082](https://insights.sbomify.com/CVE-2021-41082/): Private message title and participating users leaked in discourse (high 7.5)
- [CVE-2021-41081](https://insights.sbomify.com/CVE-2021-41081/): SQL injection in zohocorp:manageengine network configuration manager (critical 9.8)
- [CVE-2021-41080](https://insights.sbomify.com/CVE-2021-41080/): SQL injection in zohocorp:manageengine network configuration manager (critical 9.8)
- [CVE-2021-4108](https://insights.sbomify.com/CVE-2021-4108/): Cross-site Scripting (XSS) - Stored in snipe/snipe-it (medium 6.4)
- [CVE-2021-41079](https://insights.sbomify.com/CVE-2021-41079/): Apache Tomcat DoS with unexpected TLS packet (high 7.5)
- [CVE-2021-41078](https://insights.sbomify.com/CVE-2021-41078/): Nameko Arbitrary code execution due to YAML deserialization (high 7.8)
- [CVE-2021-41077](https://insights.sbomify.com/CVE-2021-41077/): Information disclosure in travis-ci:travis ci (high 7.5)
- [CVE-2021-41075](https://insights.sbomify.com/CVE-2021-41075/): SQL injection in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2021-41074](https://insights.sbomify.com/CVE-2021-41074/): Cross-site request forgery in webkul:qloapps (medium 5.4)
- [CVE-2021-41073](https://insights.sbomify.com/CVE-2021-41073/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2021-41072](https://insights.sbomify.com/CVE-2021-41072/): Path traversal in debian:debian linux (high 8.1)
- [CVE-2021-4107](https://insights.sbomify.com/CVE-2021-4107/): Cross-site Scripting (XSS) - Reflected in yetiforcecompany/yetiforcecrm (medium 5.3)
- [CVE-2021-41067](https://insights.sbomify.com/CVE-2021-41067/): Supply chain in listary:listary (high 7.5)
- [CVE-2021-41066](https://insights.sbomify.com/CVE-2021-41066/): Missing authorization in bopsoft:listary (high 7.5)
- [CVE-2021-41065](https://insights.sbomify.com/CVE-2021-41065/): Privilege escalation in bopsoft:listary (high 7.3)
- [CVE-2021-41063](https://insights.sbomify.com/CVE-2021-41063/): SQL injection in xylem:aanderaa geoview (critical 9.8)
- [CVE-2021-41061](https://insights.sbomify.com/CVE-2021-41061/): Weak cryptography in riot-os:riot (medium 5.5)
- [CVE-2021-4106](https://insights.sbomify.com/CVE-2021-4106/): Vulnerability in Snow Inventory Java Scanner (high 7.8)
- [CVE-2021-41057](https://insights.sbomify.com/CVE-2021-41057/): Path traversal in siemens:pss cape (high 7.1)
- [CVE-2021-41055](https://insights.sbomify.com/CVE-2021-41055/): Denial of service in gajim:gajim (high 7.5)
- [CVE-2021-41054](https://insights.sbomify.com/CVE-2021-41054/): Memory corruption in atftp project:atftp (high 7.5)
- [CVE-2021-4105](https://insights.sbomify.com/CVE-2021-4105/): Unauthenticated Remote Code Execution on COSLAT Firewall (critical 9.8)
- [CVE-2021-41043](https://insights.sbomify.com/CVE-2021-41043/): Use after free in tcpslice (medium 5.5)
- [CVE-2021-41042](https://insights.sbomify.com/CVE-2021-41042/): XML External Entity Reference in Eclipse Lyo (medium 5.3)
- [CVE-2021-41041](https://insights.sbomify.com/CVE-2021-41041/): Security feature bypass in Eclipse OpenJ9 (medium 5.3)
- [CVE-2021-41040](https://insights.sbomify.com/CVE-2021-41040/): Memory corruption in eclipse:wakaama (high 7.5)
- [CVE-2021-4104](https://insights.sbomify.com/CVE-2021-4104/): Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 (high 7.5)
- [CVE-2021-41039](https://insights.sbomify.com/CVE-2021-41039/): Denial of service in Eclipse Mosquitto (high 7.5)
- [CVE-2021-41038](https://insights.sbomify.com/CVE-2021-41038/): Improper Verification of Communication Channel in @theia/plugin-ext (medium 6.1)
- [CVE-2021-41037](https://insights.sbomify.com/CVE-2021-41037/): Security feature bypass in Eclipse Equinox p2 (critical 10.0)
- [CVE-2021-41036](https://insights.sbomify.com/CVE-2021-41036/): Memory corruption in Eclipse Paho MQTT C Client (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/92/