# Vulnerabilities published in 2021


- [CVE-2021-40899](https://insights.sbomify.com/CVE-2021-40899/): Denial of service in repo-git-downloader project:repo-git-downloader (high 7.5)
- [CVE-2021-40898](https://insights.sbomify.com/CVE-2021-40898/): Denial of service in scaffold-helper project:scaffold-helper (high 7.5)
- [CVE-2021-40897](https://insights.sbomify.com/CVE-2021-40897/): Denial of service in split-html-to-chars project:split-html-to-chars (high 7.5)
- [CVE-2021-40896](https://insights.sbomify.com/CVE-2021-40896/): Denial of service in that-value project:that-value (high 7.5)
- [CVE-2021-40895](https://insights.sbomify.com/CVE-2021-40895/): Denial of service in todo-regex project:todo-regex (high 7.5)
- [CVE-2021-40894](https://insights.sbomify.com/CVE-2021-40894/): Denial of service in underscore-99xp project:underscore-99xp (high 7.5)
- [CVE-2021-40893](https://insights.sbomify.com/CVE-2021-40893/): Denial of service in validate data project:validate data (high 7.5)
- [CVE-2021-40892](https://insights.sbomify.com/CVE-2021-40892/): Denial of service in validate color project:validate color (high 7.5)
- [CVE-2021-4089](https://insights.sbomify.com/CVE-2021-4089/): Improper Access Control in snipe/snipe-it (medium 4.3)
- [CVE-2021-40889](https://insights.sbomify.com/CVE-2021-40889/): Code injection in cmsuno project:cmsuno (critical 9.8)
- [CVE-2021-40888](https://insights.sbomify.com/CVE-2021-40888/): Cross-site scripting in projectsend:projectsend (medium 5.4)
- [CVE-2021-40887](https://insights.sbomify.com/CVE-2021-40887/): Path traversal in projectsend:projectsend (critical 9.8)
- [CVE-2021-40886](https://insights.sbomify.com/CVE-2021-40886/): Path traversal in projectsend:projectsend (medium 6.5)
- [CVE-2021-40884](https://insights.sbomify.com/CVE-2021-40884/): Missing authorization in projectsend:projectsend (high 8.1)
- [CVE-2021-40883](https://insights.sbomify.com/CVE-2021-40883/): File upload in emlog:emlog (critical 9.8)
- [CVE-2021-40882](https://insights.sbomify.com/CVE-2021-40882/): Cross-site scripting in piwigo:piwigo (medium 6.1)
- [CVE-2021-40881](https://insights.sbomify.com/CVE-2021-40881/): Code injection in publiccms:publiccms (critical 9.8)
- [CVE-2021-4088](https://insights.sbomify.com/CVE-2021-4088/): Blind SQL injection in DLP ePO extension (high 8.4)
- [CVE-2021-40875](https://insights.sbomify.com/CVE-2021-40875/): Information disclosure in gurock:testrail (high 7.5)
- [CVE-2021-40874](https://insights.sbomify.com/CVE-2021-40874/): Auth bypass in debian:debian linux (critical 9.8)
- [CVE-2021-40873](https://insights.sbomify.com/CVE-2021-40873/): Memory corruption in softing:datafeed opc suite (high 7.5)
- [CVE-2021-40872](https://insights.sbomify.com/CVE-2021-40872/): Denial of service in softing:smartlink hw-dp (high 7.5)
- [CVE-2021-40871](https://insights.sbomify.com/CVE-2021-40871/): Denial of service in softing:datafeed opc suite (high 7.5)
- [CVE-2021-40870](https://insights.sbomify.com/CVE-2021-40870/): Aviatrix Controller Unrestricted Upload of File (critical 9.8, exploited in the wild)
- [CVE-2021-40868](https://insights.sbomify.com/CVE-2021-40868/): Cross-site scripting in cloudron:cloudron (medium 6.1)
- [CVE-2021-40867](https://insights.sbomify.com/CVE-2021-40867/): Auth bypass in netgear:gc108p firmware (high 7.8)
- [CVE-2021-40866](https://insights.sbomify.com/CVE-2021-40866/): Auth bypass in netgear:gc108p firmware (critical 9.8)
- [CVE-2021-40865](https://insights.sbomify.com/CVE-2021-40865/): Unsafe Pre-Authentication Deserialization In Workers (critical 9.8)
- [CVE-2021-40864](https://insights.sbomify.com/CVE-2021-40864/): Cross-site scripting in onlyoffice:google translate (critical 9.8)
- [CVE-2021-40862](https://insights.sbomify.com/CVE-2021-40862/): Information disclosure in hashicorp:terraform enterprise (high 8.8)
- [CVE-2021-40861](https://insights.sbomify.com/CVE-2021-40861/): SQL injection in genesys:intelligent workload distribution manager (high 7.2)
- [CVE-2021-40860](https://insights.sbomify.com/CVE-2021-40860/): SQL injection in genesys:intelligent workload distribution manager (high 7.2)
- [CVE-2021-40859](https://insights.sbomify.com/CVE-2021-40859/): Hardcoded credentials in auerswald:compact 5500r firmware (critical 9.8)
- [CVE-2021-40858](https://insights.sbomify.com/CVE-2021-40858/): Path traversal in auerswald:commander 6000r ip firmware (medium 4.9)
- [CVE-2021-40857](https://insights.sbomify.com/CVE-2021-40857/): Privilege escalation in auerswald:commander 6000r ip firmware (high 8.8)
- [CVE-2021-40856](https://insights.sbomify.com/CVE-2021-40856/): Auth bypass in auerswald:comfortel 1400 ip firmware (high 7.5)
- [CVE-2021-40855](https://insights.sbomify.com/CVE-2021-40855/): Security feature bypass in europa:technical specifications for digital covid certificates (critical 9.8)
- [CVE-2021-40854](https://insights.sbomify.com/CVE-2021-40854/): Privilege escalation in anydesk:anydesk (high 7.8)
- [CVE-2021-40853](https://insights.sbomify.com/CVE-2021-40853/): TCMAN GIM missing authorization vulnerability (high 7.2)
- [CVE-2021-40852](https://insights.sbomify.com/CVE-2021-40852/): TCMAN GIM open redirect vulnerability (medium 6.1)
- [CVE-2021-40851](https://insights.sbomify.com/CVE-2021-40851/): TCMAN GIM SQL injection vulnerability (high 7.5)
- [CVE-2021-40850](https://insights.sbomify.com/CVE-2021-40850/): TCMAN GIM SQL injection vulnerability (critical 10.0)
- [CVE-2021-40849](https://insights.sbomify.com/CVE-2021-40849/): Auth bypass in mahara:mahara (critical 9.8)
- [CVE-2021-40848](https://insights.sbomify.com/CVE-2021-40848/): Code injection in mahara:mahara (high 7.8)
- [CVE-2021-40847](https://insights.sbomify.com/CVE-2021-40847/): Weak cryptography in netgear:r6400v2 firmware (high 8.1)
- [CVE-2021-40846](https://insights.sbomify.com/CVE-2021-40846/): Weak cryptography in tradingpaints:trading paints (high 7.5)
- [CVE-2021-40845](https://insights.sbomify.com/CVE-2021-40845/): File upload in zenitel:alphacom xe audio server (high 8.8)
- [CVE-2021-40843](https://insights.sbomify.com/CVE-2021-40843/): Deserialization in proofpoint:insider threat management server (high 7.3)
- [CVE-2021-40842](https://insights.sbomify.com/CVE-2021-40842/): SQL injection in proofpoint:insider threat management server (critical 9.8)
- [CVE-2021-40841](https://insights.sbomify.com/CVE-2021-40841/): Path traversal in liveconfig:liveconfig (medium 6.5)
- [CVE-2021-40840](https://insights.sbomify.com/CVE-2021-40840/): Cross-site scripting in liveconfig:liveconfig (medium 5.4)
- [CVE-2021-4084](https://insights.sbomify.com/CVE-2021-4084/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (high 7.4)
- [CVE-2021-40839](https://insights.sbomify.com/CVE-2021-40839/): Infinite Loop in rencode (high 7.5)
- [CVE-2021-40837](https://insights.sbomify.com/CVE-2021-40837/): Denial-of-Service (DoS) Vulnerability (medium 4.6)
- [CVE-2021-40836](https://insights.sbomify.com/CVE-2021-40836/): Denial-of-Service (DoS) Vulnerability (medium 4.6)
- [CVE-2021-40835](https://insights.sbomify.com/CVE-2021-40835/): URL Address Bar Spoofing in F-Secure SAFE Browser for iOS (medium 4.6)
- [CVE-2021-40834](https://insights.sbomify.com/CVE-2021-40834/): User interface Spoofing in F-Secure SAFE browser for Android (medium 4.3)
- [CVE-2021-40833](https://insights.sbomify.com/CVE-2021-40833/): Denial-of-Service (DoS) Vulnerability (medium 5.5)
- [CVE-2021-40832](https://insights.sbomify.com/CVE-2021-40832/): Denial-of-Service (DoS) Vulnerability (medium 5.5)
- [CVE-2021-40831](https://insights.sbomify.com/CVE-2021-40831/): Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices (medium 6.3)
- [CVE-2021-40830](https://insights.sbomify.com/CVE-2021-40830/): Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems (medium 6.3)
- [CVE-2021-4083](https://insights.sbomify.com/CVE-2021-4083/): Use after free in kernel (high 7.0)
- [CVE-2021-40829](https://insights.sbomify.com/CVE-2021-40829/): TLS hostname validation issues within AWS IoT Device SDKs on macOS (medium 6.3)
- [CVE-2021-40828](https://insights.sbomify.com/CVE-2021-40828/): TLS hostname validation issues within AWS IoT Device SDKs on Windows (medium 6.3)
- [CVE-2021-40827](https://insights.sbomify.com/CVE-2021-40827/): Memory corruption in clementine-player:clementine (high 7.8)
- [CVE-2021-40826](https://insights.sbomify.com/CVE-2021-40826/): Memory corruption in clementine-player:clementine (high 7.8)
- [CVE-2021-40825](https://insights.sbomify.com/CVE-2021-40825/): Hardcoded credentials in acuitybrands:nlight eclypse system controller firmware (high 8.6)
- [CVE-2021-40824](https://insights.sbomify.com/CVE-2021-40824/): Logic error in Matrix SDK for Android (medium 5.9)
- [CVE-2021-40823](https://insights.sbomify.com/CVE-2021-40823/): matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver (medium 5.9)
- [CVE-2021-40822](https://insights.sbomify.com/CVE-2021-40822/): GeoServer allows SSRF via the option for setting a proxy host (high 7.5)
- [CVE-2021-4082](https://insights.sbomify.com/CVE-2021-4082/): Cross-Site Request Forgery (CSRF) in pimcore/pimcore (medium 4.3)
- [CVE-2021-40818](https://insights.sbomify.com/CVE-2021-40818/): Memory corruption in glewlwyd sso server project:glewlwyd sso server (critical 9.8)
- [CVE-2021-40814](https://insights.sbomify.com/CVE-2021-40814/): SQL injection in mypresta:customer photo gallery (critical 9.8)
- [CVE-2021-40813](https://insights.sbomify.com/CVE-2021-40813/): Cross-site scripting in element-it:http commander (medium 5.4)
- [CVE-2021-40812](https://insights.sbomify.com/CVE-2021-40812/): Memory corruption in libgd:libgd (medium 6.5)
- [CVE-2021-4081](https://insights.sbomify.com/CVE-2021-4081/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 5.5)
- [CVE-2021-40809](https://insights.sbomify.com/CVE-2021-40809/): Auth bypass in jamf:jamf (high 8.8)
- [CVE-2021-4080](https://insights.sbomify.com/CVE-2021-4080/): Unrestricted Upload of File with Dangerous Type in crater-invoice/crater (high 8.8)
- [CVE-2021-40797](https://insights.sbomify.com/CVE-2021-40797/): OpenStack Neutron Denial of Service vulnerability (medium 6.5)
- [CVE-2021-40796](https://insights.sbomify.com/CVE-2021-40796/): Adobe Premiere Pro Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-40795](https://insights.sbomify.com/CVE-2021-40795/): Adobe Premiere Pro 3GP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-40794](https://insights.sbomify.com/CVE-2021-40794/): Adobe Premiere Pro MOV file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-40793](https://insights.sbomify.com/CVE-2021-40793/): Adobe Premiere Pro WAV file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-40792](https://insights.sbomify.com/CVE-2021-40792/): Adobe Premiere Pro WAV file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-40791](https://insights.sbomify.com/CVE-2021-40791/): Adobe Premiere Pro JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-40790](https://insights.sbomify.com/CVE-2021-40790/): Adobe Premiere Pro MOV File Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2021-4079](https://insights.sbomify.com/CVE-2021-4079/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40789](https://insights.sbomify.com/CVE-2021-40789/): Adobe Premiere Elements Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-40788](https://insights.sbomify.com/CVE-2021-40788/): Adobe Premiere Elements Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-40787](https://insights.sbomify.com/CVE-2021-40787/): Adobe Premiere Elements M4A file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-40786](https://insights.sbomify.com/CVE-2021-40786/): Adobe Premiere Elements M4A file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-40785](https://insights.sbomify.com/CVE-2021-40785/): Adobe Premiere Elements Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-40784](https://insights.sbomify.com/CVE-2021-40784/): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-40783](https://insights.sbomify.com/CVE-2021-40783/): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (high 7.8)
- [CVE-2021-40782](https://insights.sbomify.com/CVE-2021-40782/): Adobe Media Encoder Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-40781](https://insights.sbomify.com/CVE-2021-40781/): Adobe Media Encoder Null Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2021-40780](https://insights.sbomify.com/CVE-2021-40780/): Adobe Media Encoder MXF file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-4078](https://insights.sbomify.com/CVE-2021-4078/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40779](https://insights.sbomify.com/CVE-2021-40779/): Adobe Media Encoder WAV file memory corruption vulnerability could lead to arbitrary code execution (high 7.8)
- [CVE-2021-40778](https://insights.sbomify.com/CVE-2021-40778/): Adobe Media Encoder Null Pointer Dereference Application denial-of-service (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/94/