# Vulnerabilities published in 2021


- [CVE-2021-41035](https://insights.sbomify.com/CVE-2021-41035/): Security feature bypass in Eclipse OMR (critical 9.8)
- [CVE-2021-41034](https://insights.sbomify.com/CVE-2021-41034/): Supply chain in Eclipse Che (high 8.1)
- [CVE-2021-41033](https://insights.sbomify.com/CVE-2021-41033/): Supply chain in Eclipse Equinox (high 8.1)
- [CVE-2021-41032](https://insights.sbomify.com/CVE-2021-41032/): Missing authorization in Fortinet FortiOS (medium 6.3)
- [CVE-2021-41031](https://insights.sbomify.com/CVE-2021-41031/): Path traversal in Fortinet FortiClientWindows (high 7.8)
- [CVE-2021-41030](https://insights.sbomify.com/CVE-2021-41030/): Auth bypass in Fortinet FortiClientEMS (medium 5.4)
- [CVE-2021-4103](https://insights.sbomify.com/CVE-2021-4103/): Cross-site Scripting (XSS) - Stored in vanessa219/vditor (medium 6.8)
- [CVE-2021-41029](https://insights.sbomify.com/CVE-2021-41029/): Cross-site scripting in Fortinet FortiWLM (medium 6.4)
- [CVE-2021-41028](https://insights.sbomify.com/CVE-2021-41028/): Hardcoded credentials in Fortinet FortiClientEMS, FortiClientWindows, FortiClientLinux, FortiClientMac (high 8.2)
- [CVE-2021-41027](https://insights.sbomify.com/CVE-2021-41027/): Memory corruption in Fortinet FortiWeb (high 7.3)
- [CVE-2021-41026](https://insights.sbomify.com/CVE-2021-41026/): Path traversal in Fortinet FortiWeb (medium 6.5)
- [CVE-2021-41025](https://insights.sbomify.com/CVE-2021-41025/): Auth bypass in Fortinet FortiWeb (high 7.3)
- [CVE-2021-41024](https://insights.sbomify.com/CVE-2021-41024/): Path traversal in Fortinet FortiOS (high 7.5)
- [CVE-2021-41023](https://insights.sbomify.com/CVE-2021-41023/): Information disclosure in Fortinet FortiSIEMWindowsAgent (medium 5.5)
- [CVE-2021-41022](https://insights.sbomify.com/CVE-2021-41022/): Privilege escalation in Fortinet FortiSIEMWindowsAgent (high 7.8)
- [CVE-2021-41021](https://insights.sbomify.com/CVE-2021-41021/): Privilege escalation in Fortinet FortiNAC (high 7.8)
- [CVE-2021-41020](https://insights.sbomify.com/CVE-2021-41020/): Missing authorization in Fortinet FortiIsolator (high 8.8)
- [CVE-2021-4102](https://insights.sbomify.com/CVE-2021-4102/): Google Chromium V8 Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2021-41019](https://insights.sbomify.com/CVE-2021-41019/): Security feature bypass in Fortinet FortiOS (low 3.5)
- [CVE-2021-41018](https://insights.sbomify.com/CVE-2021-41018/): Command injection in fortinet:fortiweb (high 8.8)
- [CVE-2021-41017](https://insights.sbomify.com/CVE-2021-41017/): Memory corruption in Fortinet FortiWeb (high 8.8)
- [CVE-2021-41016](https://insights.sbomify.com/CVE-2021-41016/): Command injection in fortinet:fortiextender firmware (high 7.8)
- [CVE-2021-41015](https://insights.sbomify.com/CVE-2021-41015/): Cross-site scripting in Fortinet FortiWeb (medium 6.1)
- [CVE-2021-41014](https://insights.sbomify.com/CVE-2021-41014/): Denial of service in Fortinet FortiWeb (high 7.5)
- [CVE-2021-41013](https://insights.sbomify.com/CVE-2021-41013/): Missing authorization in Fortinet FortiWeb (medium 5.3)
- [CVE-2021-41011](https://insights.sbomify.com/CVE-2021-41011/): Information disclosure in LINE client for iOS (high 7.5)
- [CVE-2021-4101](https://insights.sbomify.com/CVE-2021-4101/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-41005](https://insights.sbomify.com/CVE-2021-41005/): Other in Aruba Instant On 1930 Switch Series (medium 6.5)
- [CVE-2021-41004](https://insights.sbomify.com/CVE-2021-41004/): Other in Aruba Instant On 1930 Switch Series (high 7.5)
- [CVE-2021-41003](https://insights.sbomify.com/CVE-2021-41003/): Command injection in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series (medium 6.1)
- [CVE-2021-41002](https://insights.sbomify.com/CVE-2021-41002/): Path traversal in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series (high 8.1)
- [CVE-2021-41001](https://insights.sbomify.com/CVE-2021-41001/): Command injection in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series (high 8.8)
- [CVE-2021-41000](https://insights.sbomify.com/CVE-2021-41000/): Command injection in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series (high 8.8)
- [CVE-2021-4100](https://insights.sbomify.com/CVE-2021-4100/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40999](https://insights.sbomify.com/CVE-2021-40999/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-40998](https://insights.sbomify.com/CVE-2021-40998/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-40997](https://insights.sbomify.com/CVE-2021-40997/): Auth bypass in Aruba ClearPass Policy Manager (critical 9.8)
- [CVE-2021-40996](https://insights.sbomify.com/CVE-2021-40996/): Auth bypass in Aruba ClearPass Policy Manager (critical 9.8)
- [CVE-2021-40995](https://insights.sbomify.com/CVE-2021-40995/): Command injection in Aruba ClearPass Policy Manager (medium 6.3)
- [CVE-2021-40994](https://insights.sbomify.com/CVE-2021-40994/): Command injection in Aruba ClearPass Policy Manager (medium 6.3)
- [CVE-2021-40993](https://insights.sbomify.com/CVE-2021-40993/): SQL injection in Aruba ClearPass Policy Manager (high 8.1)
- [CVE-2021-40992](https://insights.sbomify.com/CVE-2021-40992/): SQL injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-40991](https://insights.sbomify.com/CVE-2021-40991/): Information disclosure in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-40990](https://insights.sbomify.com/CVE-2021-40990/): Information disclosure in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2021-4099](https://insights.sbomify.com/CVE-2021-4099/): Use after free in Chrome (high 8.8)
- [CVE-2021-40989](https://insights.sbomify.com/CVE-2021-40989/): Privilege escalation in Aruba ClearPass Policy Manager (high 7.8)
- [CVE-2021-40988](https://insights.sbomify.com/CVE-2021-40988/): Path traversal in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-40987](https://insights.sbomify.com/CVE-2021-40987/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-40986](https://insights.sbomify.com/CVE-2021-40986/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2021-40985](https://insights.sbomify.com/CVE-2021-40985/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2021-40981](https://insights.sbomify.com/CVE-2021-40981/): Privilege escalation in asus:armoury crate lite service (high 7.3)
- [CVE-2021-4098](https://insights.sbomify.com/CVE-2021-4098/): Memory corruption in Chrome (high 7.4)
- [CVE-2021-40978](https://insights.sbomify.com/CVE-2021-40978/): Directory traversal in mkdocs (high 7.5)
- [CVE-2021-40975](https://insights.sbomify.com/CVE-2021-40975/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2021-40973](https://insights.sbomify.com/CVE-2021-40973/): Cross-site scripting in spotweb project:spotweb (medium 6.1)
- [CVE-2021-40972](https://insights.sbomify.com/CVE-2021-40972/): Cross-site scripting in spotweb project:spotweb (medium 6.1)
- [CVE-2021-40971](https://insights.sbomify.com/CVE-2021-40971/): Cross-site scripting in spotweb project:spotweb (medium 6.1)
- [CVE-2021-40970](https://insights.sbomify.com/CVE-2021-40970/): Cross-site scripting in spotweb project:spotweb (medium 6.1)
- [CVE-2021-4097](https://insights.sbomify.com/CVE-2021-4097/): CRLF Injection in phpservermon/phpservermon (medium 6.3)
- [CVE-2021-40969](https://insights.sbomify.com/CVE-2021-40969/): Cross-site scripting in spotweb project:spotweb (medium 6.1)
- [CVE-2021-40968](https://insights.sbomify.com/CVE-2021-40968/): Cross-site scripting in spotweb project:spotweb (medium 6.1)
- [CVE-2021-40966](https://insights.sbomify.com/CVE-2021-40966/): Cross-site scripting in prasathmani:tiny file manager (medium 5.4)
- [CVE-2021-40965](https://insights.sbomify.com/CVE-2021-40965/): Cross-site request forgery in prasathmani:tiny file manager (high 8.8)
- [CVE-2021-40964](https://insights.sbomify.com/CVE-2021-40964/): Path traversal in prasathmani:tiny file manager (medium 6.5)
- [CVE-2021-40961](https://insights.sbomify.com/CVE-2021-40961/): SQL injection in cmsmadesimple:cms made simple (high 8.8)
- [CVE-2021-40960](https://insights.sbomify.com/CVE-2021-40960/): Path traversal in galera:galera webtemplate (critical 9.8)
- [CVE-2021-4096](https://insights.sbomify.com/CVE-2021-4096/): Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2021-40959](https://insights.sbomify.com/CVE-2021-40959/): A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) <= 4.1.6 and <=5.0 was ide (medium 6.1)
- [CVE-2021-40956](https://insights.sbomify.com/CVE-2021-40956/): SQL injection in laiketui:laiketui (high 7.5)
- [CVE-2021-40955](https://insights.sbomify.com/CVE-2021-40955/): SQL injection in laiketui:laiketui (high 7.2)
- [CVE-2021-40954](https://insights.sbomify.com/CVE-2021-40954/): File upload in laiketui:laiketui (critical 9.8)
- [CVE-2021-4095](https://insights.sbomify.com/CVE-2021-4095/): Null dereference in kernel (medium 5.5)
- [CVE-2021-40944](https://insights.sbomify.com/CVE-2021-40944/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-40943](https://insights.sbomify.com/CVE-2021-40943/): Null dereference in axiosys:bento4 (medium 5.5)
- [CVE-2021-40942](https://insights.sbomify.com/CVE-2021-40942/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-40941](https://insights.sbomify.com/CVE-2021-40941/): Denial of service in axiosys:bento4 (high 7.5)
- [CVE-2021-40940](https://insights.sbomify.com/CVE-2021-40940/): File upload in monstra:monstra (critical 9.8)
- [CVE-2021-4093](https://insights.sbomify.com/CVE-2021-4093/): Memory corruption in kernel (high 8.8)
- [CVE-2021-40928](https://insights.sbomify.com/CVE-2021-40928/): Cross-site scripting in glimmrtv:flextv (medium 6.1)
- [CVE-2021-40927](https://insights.sbomify.com/CVE-2021-40927/): Cross-site scripting in alfred-spotify-mini-player:alfred spotify mini player (medium 6.1)
- [CVE-2021-40926](https://insights.sbomify.com/CVE-2021-40926/): Cross-site scripting in demos/demo.mysqli.php in getID3 (medium 6.1)
- [CVE-2021-40925](https://insights.sbomify.com/CVE-2021-40925/): Cross-site scripting in faveohelpdesk:faveo (medium 6.1)
- [CVE-2021-40924](https://insights.sbomify.com/CVE-2021-40924/): Cross-site scripting in pixeline:bugs (medium 6.1)
- [CVE-2021-40923](https://insights.sbomify.com/CVE-2021-40923/): Cross-site scripting in pixeline:bugs (medium 6.1)
- [CVE-2021-40922](https://insights.sbomify.com/CVE-2021-40922/): Cross-site scripting in pixeline:bugs (medium 6.1)
- [CVE-2021-40921](https://insights.sbomify.com/CVE-2021-40921/): Cross-site scripting in detector project:detector (medium 6.1)
- [CVE-2021-4092](https://insights.sbomify.com/CVE-2021-4092/): Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm (medium 4.3)
- [CVE-2021-40910](https://insights.sbomify.com/CVE-2021-40910/): Cross-site scripting in phpcms:phpcms (medium 6.1)
- [CVE-2021-4091](https://insights.sbomify.com/CVE-2021-4091/): Memory corruption in 389-ds-base (high 7.5)
- [CVE-2021-40909](https://insights.sbomify.com/CVE-2021-40909/): Cross-site scripting in php crud without refresh\/reload using ajax and datatables tutorial project:php crud without refresh\/reload using ajax and datatables tutorial (critical 9.6)
- [CVE-2021-40908](https://insights.sbomify.com/CVE-2021-40908/): SQL injection in purchase order management system project:purchase order management system (critical 9.8)
- [CVE-2021-40907](https://insights.sbomify.com/CVE-2021-40907/): SQL injection in storage unit rental management system project:storage unit rental management system (critical 9.8)
- [CVE-2021-40906](https://insights.sbomify.com/CVE-2021-40906/): Cross-site scripting in checkmk:checkmk (medium 6.1)
- [CVE-2021-40905](https://insights.sbomify.com/CVE-2021-40905/): File upload in checkmk:checkmk (high 8.8)
- [CVE-2021-40904](https://insights.sbomify.com/CVE-2021-40904/): Code injection in checkmk:checkmk (high 8.8)
- [CVE-2021-40903](https://insights.sbomify.com/CVE-2021-40903/): Hardcoded credentials in antminer monitor project:antminer monitor (critical 9.8)
- [CVE-2021-40902](https://insights.sbomify.com/CVE-2021-40902/): Cross-site scripting in flatcore:flatcore-cms (medium 5.4)
- [CVE-2021-40901](https://insights.sbomify.com/CVE-2021-40901/): Denial of service in scniro-validator project:scniro-validator (high 7.5)
- [CVE-2021-40900](https://insights.sbomify.com/CVE-2021-40900/): Denial of service in regexfn project:regexfn (high 7.5)
- [CVE-2021-4090](https://insights.sbomify.com/CVE-2021-4090/): Memory corruption in kernel (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/93/