# Vulnerabilities published in 2021


- [CVE-2021-4039](https://insights.sbomify.com/CVE-2021-4039/): Command injection in NWA1100-NH firmware (critical 9.8)
- [CVE-2021-40389](https://insights.sbomify.com/CVE-2021-40389/): Privilege escalation in advantech:deviceon\/iedge (high 8.8)
- [CVE-2021-40388](https://insights.sbomify.com/CVE-2021-40388/): Privilege escalation in advantech:sq manager (high 8.8)
- [CVE-2021-40387](https://insights.sbomify.com/CVE-2021-40387/): Other in kaseya:unitrends backup software (high 8.8)
- [CVE-2021-40386](https://insights.sbomify.com/CVE-2021-40386/): Other in kaseya:unitrends backup (critical 9.8)
- [CVE-2021-40385](https://insights.sbomify.com/CVE-2021-40385/): Privilege escalation in kaseya:unitrends backup software (high 8.8)
- [CVE-2021-40382](https://insights.sbomify.com/CVE-2021-40382/): Missing authorization in comprotech:ip570 firmware (high 7.5)
- [CVE-2021-40381](https://insights.sbomify.com/CVE-2021-40381/): Missing authorization in comprotech:ip570 firmware (high 7.5)
- [CVE-2021-40380](https://insights.sbomify.com/CVE-2021-40380/): Information disclosure in comprotech:ip570 firmware (high 7.5)
- [CVE-2021-4038](https://insights.sbomify.com/CVE-2021-4038/): NSM vulnerable to XSS (medium 4.8)
- [CVE-2021-40379](https://insights.sbomify.com/CVE-2021-40379/): Missing authorization in comprotech:ip570 firmware (high 7.5)
- [CVE-2021-40378](https://insights.sbomify.com/CVE-2021-40378/): Missing authorization in comprotech:ip570 firmware (high 8.1)
- [CVE-2021-40377](https://insights.sbomify.com/CVE-2021-40377/): Cross-site scripting in smartertools:smartermail (medium 5.4)
- [CVE-2021-40376](https://insights.sbomify.com/CVE-2021-40376/): Auth bypass in otris:update manager (high 7.8)
- [CVE-2021-40375](https://insights.sbomify.com/CVE-2021-40375/): Information disclosure in apperta:openeyes (medium 6.5)
- [CVE-2021-40374](https://insights.sbomify.com/CVE-2021-40374/): Cross-site scripting in apperta:openeye (medium 5.4)
- [CVE-2021-40373](https://insights.sbomify.com/CVE-2021-40373/): Code injection in playsms:playsms (critical 9.8)
- [CVE-2021-40371](https://insights.sbomify.com/CVE-2021-40371/): Path traversal in gridprosoftware:request management (critical 9.8)
- [CVE-2021-4037](https://insights.sbomify.com/CVE-2021-4037/): Kernel: security regression for cve-2018-13405 (medium 4.4)
- [CVE-2021-40369](https://insights.sbomify.com/CVE-2021-40369/): XSS vulnerability on Denounce plugin (medium 6.1)
- [CVE-2021-40368](https://insights.sbomify.com/CVE-2021-40368/): Memory corruption in SIMATIC S7-400 CPU 412-1 DP V7 (high 7.5)
- [CVE-2021-40367](https://insights.sbomify.com/CVE-2021-40367/): Memory corruption in syngo fastView (high 7.8)
- [CVE-2021-40366](https://insights.sbomify.com/CVE-2021-40366/): Weak cryptography in Climatix POL909 (AWB module) (high 7.4)
- [CVE-2021-40365](https://insights.sbomify.com/CVE-2021-40365/): Denial of service in SIMATIC Drive Controller CPU 1504D TF (high 7.5)
- [CVE-2021-40364](https://insights.sbomify.com/CVE-2021-40364/): Information disclosure in SIMATIC PCS 7 V8.2 (medium 5.5)
- [CVE-2021-40363](https://insights.sbomify.com/CVE-2021-40363/): Weak cryptography in SIMATIC PCS 7 V8.2 (high 7.8)
- [CVE-2021-40360](https://insights.sbomify.com/CVE-2021-40360/): Information disclosure in SIMATIC PCS 7 V8.2 (high 8.8)
- [CVE-2021-40359](https://insights.sbomify.com/CVE-2021-40359/): Path traversal in OpenPCS 7 V8.2 (high 7.7)
- [CVE-2021-40358](https://insights.sbomify.com/CVE-2021-40358/): Path traversal in SIMATIC PCS 7 V8.2 (critical 9.9)
- [CVE-2021-40357](https://insights.sbomify.com/CVE-2021-40357/): Path traversal in Teamcenter Active Workspace V4.3 (medium 4.9)
- [CVE-2021-40356](https://insights.sbomify.com/CVE-2021-40356/): XML external entity in Teamcenter V12.4 (high 7.5)
- [CVE-2021-40355](https://insights.sbomify.com/CVE-2021-40355/): Missing authorization in Teamcenter V12.4 (high 8.8)
- [CVE-2021-40354](https://insights.sbomify.com/CVE-2021-40354/): Missing authorization in Teamcenter V12.4 (high 7.1)
- [CVE-2021-40353](https://insights.sbomify.com/CVE-2021-40353/): SQL injection in os4ed:opensis (critical 9.8)
- [CVE-2021-40352](https://insights.sbomify.com/CVE-2021-40352/): Missing authorization in open-emr:openemr (medium 6.5)
- [CVE-2021-40350](https://insights.sbomify.com/CVE-2021-40350/): Auth bypass in christiedigital:dwu850-gs firmware (critical 9.8)
- [CVE-2021-4035](https://insights.sbomify.com/CVE-2021-4035/): Wocu Monitoring stored Cross-Site Scripting (XSS) (low 3.5)
- [CVE-2021-40349](https://insights.sbomify.com/CVE-2021-40349/): Path traversal in speed test project:speed test (medium 5.3)
- [CVE-2021-40348](https://insights.sbomify.com/CVE-2021-40348/): Code injection in spacewalk project:spacewalk (high 8.8)
- [CVE-2021-40347](https://insights.sbomify.com/CVE-2021-40347/): GNU Mailman Postorius Access Control Issues (medium 5.4)
- [CVE-2021-40346](https://insights.sbomify.com/CVE-2021-40346/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2021-40345](https://insights.sbomify.com/CVE-2021-40345/): Command injection in nagios:nagios xi (high 7.2)
- [CVE-2021-40344](https://insights.sbomify.com/CVE-2021-40344/): File upload in nagios:nagios xi (high 7.2)
- [CVE-2021-40343](https://insights.sbomify.com/CVE-2021-40343/): Privilege escalation in nagios:nagios xi (high 7.8)
- [CVE-2021-40342](https://insights.sbomify.com/CVE-2021-40342/): Use of default key for encryption (high 7.1)
- [CVE-2021-40341](https://insights.sbomify.com/CVE-2021-40341/): Weak DES encryption (high 7.1)
- [CVE-2021-40340](https://insights.sbomify.com/CVE-2021-40340/): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (low 3.7)
- [CVE-2021-4034](https://insights.sbomify.com/CVE-2021-4034/): Red Hat Polkit Out-of-Bounds Read and Write (high 7.8, exploited in the wild)
- [CVE-2021-40339](https://insights.sbomify.com/CVE-2021-40339/): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (low 3.7)
- [CVE-2021-40338](https://insights.sbomify.com/CVE-2021-40338/): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (low 3.7)
- [CVE-2021-40337](https://insights.sbomify.com/CVE-2021-40337/): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (medium 4.2)
- [CVE-2021-40336](https://insights.sbomify.com/CVE-2021-40336/): HTTP Response Splitting in Hitachi Energy’s MSM Product (medium 5.0)
- [CVE-2021-40335](https://insights.sbomify.com/CVE-2021-40335/): Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product (medium 5.0)
- [CVE-2021-40334](https://insights.sbomify.com/CVE-2021-40334/): SSH activation problem in the proprietary management protocol (port TCP 5558) (high 8.6)
- [CVE-2021-40333](https://insights.sbomify.com/CVE-2021-40333/): Weak default credential associated with TCP port 26 (critical 9.0)
- [CVE-2021-40331](https://insights.sbomify.com/CVE-2021-40331/): Permissions problem in the Apache Ranger Hive Plugin (high 8.1)
- [CVE-2021-40330](https://insights.sbomify.com/CVE-2021-40330/): Other in debian:debian linux (high 7.5)
- [CVE-2021-4033](https://insights.sbomify.com/CVE-2021-4033/): Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2 (medium 6.5)
- [CVE-2021-40329](https://insights.sbomify.com/CVE-2021-40329/): Auth bypass in PingFederate (critical 9.8)
- [CVE-2021-40327](https://insights.sbomify.com/CVE-2021-40327/): Missing authorization in trustedfirmware:trusted firmware-m (medium 5.9)
- [CVE-2021-40326](https://insights.sbomify.com/CVE-2021-40326/): Security feature bypass in foxit:pdf editor (medium 5.5)
- [CVE-2021-40325](https://insights.sbomify.com/CVE-2021-40325/): Cobbler before 3.3.0 allows authorization bypass for modification of settings. (high 7.5)
- [CVE-2021-40324](https://insights.sbomify.com/CVE-2021-40324/): Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. (high 7.5)
- [CVE-2021-40323](https://insights.sbomify.com/CVE-2021-40323/): Cobbler before 3.3.0 allows log poisoning (critical 9.8)
- [CVE-2021-4032](https://insights.sbomify.com/CVE-2021-4032/): Denial of service in kernel (medium 4.4)
- [CVE-2021-40317](https://insights.sbomify.com/CVE-2021-40317/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2021-40313](https://insights.sbomify.com/CVE-2021-40313/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2021-40310](https://insights.sbomify.com/CVE-2021-40310/): Cross-site scripting in os4ed:opensis (medium 5.4)
- [CVE-2021-4031](https://insights.sbomify.com/CVE-2021-4031/): Syltek Insufficient Verification of Data Authenticity (high 7.5)
- [CVE-2021-40309](https://insights.sbomify.com/CVE-2021-40309/): SQL injection in os4ed:opensis (high 8.8)
- [CVE-2021-40303](https://insights.sbomify.com/CVE-2021-40303/): Cross-site scripting in perfexcrm:perfex crm (medium 5.4)
- [CVE-2021-4030](https://insights.sbomify.com/CVE-2021-4030/): Cross-site request forgery in ARMOR Z1 (NBG6816) firmware (high 8.0)
- [CVE-2021-40292](https://insights.sbomify.com/CVE-2021-40292/): Cross-site scripting in dzzoffice:dzzoffice (medium 5.4)
- [CVE-2021-4029](https://insights.sbomify.com/CVE-2021-4029/): Command injection in ARMOR Z1 (NBG6816) firmware (high 8.8)
- [CVE-2021-40289](https://insights.sbomify.com/CVE-2021-40289/): mm-wiki is vulnerable to Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-40288](https://insights.sbomify.com/CVE-2021-40288/): Denial of service in tp-link:archer ax10 firmware (high 7.5)
- [CVE-2021-40285](https://insights.sbomify.com/CVE-2021-40285/): Path traversal in htmly:htmly (high 8.1)
- [CVE-2021-40284](https://insights.sbomify.com/CVE-2021-40284/): Memory corruption in dlink:dsl-3782 firmware (medium 6.5)
- [CVE-2021-40282](https://insights.sbomify.com/CVE-2021-40282/): SQL injection in zzcms:zzcms (high 8.8)
- [CVE-2021-40281](https://insights.sbomify.com/CVE-2021-40281/): SQL injection in zzcms:zzcms (high 8.8)
- [CVE-2021-40280](https://insights.sbomify.com/CVE-2021-40280/): SQL injection in zzcms:zzcms (high 7.2)
- [CVE-2021-4028](https://insights.sbomify.com/CVE-2021-4028/): Use after free in kernel (high 7.8)
- [CVE-2021-40279](https://insights.sbomify.com/CVE-2021-40279/): SQL injection in zzcms:zzcms (high 7.2)
- [CVE-2021-40272](https://insights.sbomify.com/CVE-2021-40272/): Cross-site scripting in op5:monitor (medium 6.1)
- [CVE-2021-40266](https://insights.sbomify.com/CVE-2021-40266/): Null dereference in freeimage project:freeimage (medium 6.5)
- [CVE-2021-40265](https://insights.sbomify.com/CVE-2021-40265/): Memory corruption in freeimage project:freeimage (high 8.8)
- [CVE-2021-40264](https://insights.sbomify.com/CVE-2021-40264/): Null dereference in freeimage project:freeimage (medium 6.5)
- [CVE-2021-40263](https://insights.sbomify.com/CVE-2021-40263/): Memory corruption in freeimage project:freeimage (high 8.8)
- [CVE-2021-40262](https://insights.sbomify.com/CVE-2021-40262/): Denial of service in freeimage project:freeimage (medium 6.5)
- [CVE-2021-40261](https://insights.sbomify.com/CVE-2021-40261/): Cross-site scripting in casap automated enrollment system project:casap automated enrollment system (medium 6.1)
- [CVE-2021-40260](https://insights.sbomify.com/CVE-2021-40260/): Cross-site scripting in tailor management system project:tailor management system (medium 6.1)
- [CVE-2021-4026](https://insights.sbomify.com/CVE-2021-4026/): Improper Access Control in bookstackapp/bookstack (medium 6.5)
- [CVE-2021-40247](https://insights.sbomify.com/CVE-2021-40247/): SQL injection in oretnom23:budget and expense tracker system (critical 9.8)
- [CVE-2021-40241](https://insights.sbomify.com/CVE-2021-40241/): Memory corruption in xfig project:xfig (critical 9.8)
- [CVE-2021-4024](https://insights.sbomify.com/CVE-2021-4024/): Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman (medium 6.5)
- [CVE-2021-40239](https://insights.sbomify.com/CVE-2021-40239/): Memory corruption in miniftpd project:miniftpd (critical 9.8)
- [CVE-2021-40238](https://insights.sbomify.com/CVE-2021-40238/): Cross-site scripting in webuzo:webuzo (medium 6.1)
- [CVE-2021-4023](https://insights.sbomify.com/CVE-2021-4023/): Denial of service in kernel (medium 5.5)
- [CVE-2021-40226](https://insights.sbomify.com/CVE-2021-40226/): Memory corruption in glyphandcog:xpdfreader (high 7.5)
- [CVE-2021-40223](https://insights.sbomify.com/CVE-2021-40223/): Cross-site scripting in rittal:cmc pu iii 7030.000 firmware (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/98/