# Vulnerabilities published in 2021


- [CVE-2021-40654](https://insights.sbomify.com/CVE-2021-40654/): Information disclosure in dlink:dir-615 firmware (medium 6.5)
- [CVE-2021-40651](https://insights.sbomify.com/CVE-2021-40651/): Path traversal in os4ed:opensis (medium 6.5)
- [CVE-2021-40650](https://insights.sbomify.com/CVE-2021-40650/): Misconfiguration in softwareag:connx (medium 6.5)
- [CVE-2021-4065](https://insights.sbomify.com/CVE-2021-4065/): Use after free in Chrome (high 8.8)
- [CVE-2021-40649](https://insights.sbomify.com/CVE-2021-40649/): Misconfiguration in softwareag:connx (medium 6.5)
- [CVE-2021-40648](https://insights.sbomify.com/CVE-2021-40648/): Memory corruption in man2html project:man2html (medium 5.5)
- [CVE-2021-40647](https://insights.sbomify.com/CVE-2021-40647/): Memory corruption in man2html project:man2html (medium 5.5)
- [CVE-2021-40645](https://insights.sbomify.com/CVE-2021-40645/): SQL injection in jfinaloa project:jfinaloa (medium 6.5)
- [CVE-2021-40644](https://insights.sbomify.com/CVE-2021-40644/): SQL injection in oasys project:oasys (medium 6.5)
- [CVE-2021-40643](https://insights.sbomify.com/CVE-2021-40643/): Command injection in eyesofnetwork:eyesofnetwork (critical 9.8)
- [CVE-2021-40642](https://insights.sbomify.com/CVE-2021-40642/): Information disclosure in textpattern:textpattern (medium 4.3)
- [CVE-2021-4064](https://insights.sbomify.com/CVE-2021-4064/): Use after free in Chrome (high 8.8)
- [CVE-2021-40639](https://insights.sbomify.com/CVE-2021-40639/): Missing authorization in jflyfox:jfinal cms (high 7.5)
- [CVE-2021-40637](https://insights.sbomify.com/CVE-2021-40637/): Cross-site scripting in os4ed:opensis (medium 6.1)
- [CVE-2021-40636](https://insights.sbomify.com/CVE-2021-40636/): SQL injection in os4ed:opensis (high 7.5)
- [CVE-2021-40635](https://insights.sbomify.com/CVE-2021-40635/): SQL injection in os4ed:opensis (high 7.5)
- [CVE-2021-40633](https://insights.sbomify.com/CVE-2021-40633/): Denial of service in giflib project:giflib (high 8.8)
- [CVE-2021-4063](https://insights.sbomify.com/CVE-2021-4063/): Use after free in Chrome (high 8.8)
- [CVE-2021-4062](https://insights.sbomify.com/CVE-2021-4062/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40618](https://insights.sbomify.com/CVE-2021-40618/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-40617](https://insights.sbomify.com/CVE-2021-40617/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-40616](https://insights.sbomify.com/CVE-2021-40616/): Incorrect Authorization in thinkcmf (medium 6.5)
- [CVE-2021-40612](https://insights.sbomify.com/CVE-2021-40612/): Command injection in opmantek:open-audit (critical 9.8)
- [CVE-2021-40610](https://insights.sbomify.com/CVE-2021-40610/): Cross-site scripting in emlog pro project:emlog pro (medium 5.4)
- [CVE-2021-4061](https://insights.sbomify.com/CVE-2021-4061/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40609](https://insights.sbomify.com/CVE-2021-40609/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-40608](https://insights.sbomify.com/CVE-2021-40608/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-40607](https://insights.sbomify.com/CVE-2021-40607/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-40606](https://insights.sbomify.com/CVE-2021-40606/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-40604](https://insights.sbomify.com/CVE-2021-40604/): Server-side request forgery in invisioncommunity:ips community suite (critical 9.1)
- [CVE-2021-40597](https://insights.sbomify.com/CVE-2021-40597/): Hardcoded credentials in edimax:ic-3140w firmware (critical 9.8)
- [CVE-2021-40596](https://insights.sbomify.com/CVE-2021-40596/): SQL injection in oretnom23:online learning system (critical 9.8)
- [CVE-2021-40595](https://insights.sbomify.com/CVE-2021-40595/): SQL injection in online leave management system project:online leave management system (critical 9.8)
- [CVE-2021-40592](https://insights.sbomify.com/CVE-2021-40592/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-4059](https://insights.sbomify.com/CVE-2021-4059/): Information disclosure in Chrome (medium 6.5)
- [CVE-2021-40589](https://insights.sbomify.com/CVE-2021-40589/): Integer overflow in zangband-data project:zangband-data (critical 9.8)
- [CVE-2021-4058](https://insights.sbomify.com/CVE-2021-4058/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40579](https://insights.sbomify.com/CVE-2021-40579/): Missing authorization in online enrollment management system project:online enrollment management system (medium 6.5)
- [CVE-2021-40578](https://insights.sbomify.com/CVE-2021-40578/): SQL injection in online enrollment management system project:online enrollment management system (high 7.2)
- [CVE-2021-40577](https://insights.sbomify.com/CVE-2021-40577/): Cross-site scripting in online enrollment management system project:online enrollment management system (medium 5.4)
- [CVE-2021-40576](https://insights.sbomify.com/CVE-2021-40576/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-40575](https://insights.sbomify.com/CVE-2021-40575/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-40574](https://insights.sbomify.com/CVE-2021-40574/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-40573](https://insights.sbomify.com/CVE-2021-40573/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-40572](https://insights.sbomify.com/CVE-2021-40572/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-40571](https://insights.sbomify.com/CVE-2021-40571/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-40570](https://insights.sbomify.com/CVE-2021-40570/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-4057](https://insights.sbomify.com/CVE-2021-4057/): Use after free in Chrome (high 8.8)
- [CVE-2021-40569](https://insights.sbomify.com/CVE-2021-40569/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-40568](https://insights.sbomify.com/CVE-2021-40568/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2021-40567](https://insights.sbomify.com/CVE-2021-40567/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2021-40566](https://insights.sbomify.com/CVE-2021-40566/): Use after free in gpac:gpac (medium 5.5)
- [CVE-2021-40565](https://insights.sbomify.com/CVE-2021-40565/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-40564](https://insights.sbomify.com/CVE-2021-40564/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-40563](https://insights.sbomify.com/CVE-2021-40563/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-40562](https://insights.sbomify.com/CVE-2021-40562/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2021-4056](https://insights.sbomify.com/CVE-2021-4056/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40559](https://insights.sbomify.com/CVE-2021-40559/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2021-40556](https://insights.sbomify.com/CVE-2021-40556/): Memory corruption in asus:rt-ax56u firmware (high 8.8)
- [CVE-2021-40555](https://insights.sbomify.com/CVE-2021-40555/): Cross-site scripting in flatcore:flatcore (medium 5.4)
- [CVE-2021-40553](https://insights.sbomify.com/CVE-2021-40553/): Code injection in piwigo:piwigo (high 8.8)
- [CVE-2021-4055](https://insights.sbomify.com/CVE-2021-4055/): Memory corruption in Chrome (high 8.8)
- [CVE-2021-40546](https://insights.sbomify.com/CVE-2021-40546/): Denial of service in tenda:ac6 firmware (medium 4.9)
- [CVE-2021-40543](https://insights.sbomify.com/CVE-2021-40543/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-40542](https://insights.sbomify.com/CVE-2021-40542/): Cross-site scripting in os4ed:opensis (medium 6.1)
- [CVE-2021-40541](https://insights.sbomify.com/CVE-2021-40541/): Cross-site scripting in php-fusion:phpfusion (medium 6.1)
- [CVE-2021-40540](https://insights.sbomify.com/CVE-2021-40540/): Null dereference in ulfius project:ulfius (critical 9.8)
- [CVE-2021-4054](https://insights.sbomify.com/CVE-2021-4054/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2021-40539](https://insights.sbomify.com/CVE-2021-40539/): Zoho ManageEngine ADSelfService Plus Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2021-40537](https://insights.sbomify.com/CVE-2021-40537/): Server-side request forgery in owncloud:user ldap (low 2.7)
- [CVE-2021-40532](https://insights.sbomify.com/CVE-2021-40532/): Other in telegram:web k alpha (critical 9.8)
- [CVE-2021-40531](https://insights.sbomify.com/CVE-2021-40531/): Security feature bypass in sketch:sketch (critical 9.8)
- [CVE-2021-40530](https://insights.sbomify.com/CVE-2021-40530/): Weak cryptography in cryptopp:crypto\+\+ (medium 5.9)
- [CVE-2021-4053](https://insights.sbomify.com/CVE-2021-4053/): Use after free in Chrome (high 8.8)
- [CVE-2021-40529](https://insights.sbomify.com/CVE-2021-40529/): Weak cryptography in botan project:botan (medium 5.9)
- [CVE-2021-40528](https://insights.sbomify.com/CVE-2021-40528/): Weak cryptography in gnupg:libgcrypt (medium 5.9)
- [CVE-2021-40527](https://insights.sbomify.com/CVE-2021-40527/): Information disclosure in onepeloton:peloton (high 8.6)
- [CVE-2021-40526](https://insights.sbomify.com/CVE-2021-40526/): Memory corruption in onepeloton:ttr01 firmware (medium 4.8)
- [CVE-2021-40525](https://insights.sbomify.com/CVE-2021-40525/): Sieve file storage vulnerable to path traversal attacks (critical 9.1)
- [CVE-2021-40524](https://insights.sbomify.com/CVE-2021-40524/): Denial of service in pureftpd:pure-ftpd (high 7.5)
- [CVE-2021-40523](https://insights.sbomify.com/CVE-2021-40523/): Denial of service in contiki-os:contiki (high 7.5)
- [CVE-2021-40521](https://insights.sbomify.com/CVE-2021-40521/): Other in airangel:hsmx-app-1000 firmware (critical 9.8)
- [CVE-2021-40520](https://insights.sbomify.com/CVE-2021-40520/): Hardcoded credentials in airangel:hsmx-app-1000 firmware (critical 9.8)
- [CVE-2021-4052](https://insights.sbomify.com/CVE-2021-4052/): Use after free in Chrome (high 8.8)
- [CVE-2021-40519](https://insights.sbomify.com/CVE-2021-40519/): Hardcoded credentials in airangel:hsmx-app-1000 firmware (critical 10.0)
- [CVE-2021-40518](https://insights.sbomify.com/CVE-2021-40518/): Cross-site request forgery in airangel:hsmx-app-1000 firmware (medium 6.5)
- [CVE-2021-40517](https://insights.sbomify.com/CVE-2021-40517/): Cross-site scripting in airangel:hsmx-app-1000 firmware (medium 5.4)
- [CVE-2021-40516](https://insights.sbomify.com/CVE-2021-40516/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2021-40511](https://insights.sbomify.com/CVE-2021-40511/): XML external entity in obdasystems:mastro (high 7.5)
- [CVE-2021-40510](https://insights.sbomify.com/CVE-2021-40510/): XML external entity in obdasystems:mastro (high 7.5)
- [CVE-2021-40509](https://insights.sbomify.com/CVE-2021-40509/): Cross-site scripting in jforum:jforum (medium 5.4)
- [CVE-2021-40507](https://insights.sbomify.com/CVE-2021-40507/): Other in openrisc:or1200 firmware (critical 9.8)
- [CVE-2021-40506](https://insights.sbomify.com/CVE-2021-40506/): Other in openrisc:or1200 firmware (critical 9.8)
- [CVE-2021-40504](https://insights.sbomify.com/CVE-2021-40504/): Missing authorization in SAP NetWeaver AS for ABAP and ABAP Platform (medium 4.9)
- [CVE-2021-40503](https://insights.sbomify.com/CVE-2021-40503/): Information disclosure in SAP GUI for Windows (high 7.8)
- [CVE-2021-40502](https://insights.sbomify.com/CVE-2021-40502/): Missing authorization in SAP Commerce (high 8.8)
- [CVE-2021-40501](https://insights.sbomify.com/CVE-2021-40501/): Missing authorization in SAP ABAP Platform Kernel (high 8.1)
- [CVE-2021-40500](https://insights.sbomify.com/CVE-2021-40500/): XML external entity in SAP BusinessObjects Business Intelligence Platform (Crystal Reports) (high 7.5)
- [CVE-2021-4050](https://insights.sbomify.com/CVE-2021-4050/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.1)
- [CVE-2021-40499](https://insights.sbomify.com/CVE-2021-40499/): Code injection in SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint) (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/96/