# Vulnerabilities published in 2021


- [CVE-2021-40222](https://insights.sbomify.com/CVE-2021-40222/): Command injection in rittal:cmc pu iii 7030.000 firmware (high 7.2)
- [CVE-2021-4022](https://insights.sbomify.com/CVE-2021-4022/): Use after free in rizin (medium 5.5)
- [CVE-2021-40219](https://insights.sbomify.com/CVE-2021-40219/): Code Injection in Bolt CMS (high 8.8)
- [CVE-2021-40214](https://insights.sbomify.com/CVE-2021-40214/): Cross-site scripting in gibbonedu:gibbon (medium 5.4)
- [CVE-2021-40212](https://insights.sbomify.com/CVE-2021-40212/): Memory corruption in daum:potplayer (critical 9.8)
- [CVE-2021-40211](https://insights.sbomify.com/CVE-2021-40211/): Denial of service in imagemagick:imagemagick (high 7.5)
- [CVE-2021-4021](https://insights.sbomify.com/CVE-2021-4021/): Denial of service in radare2 (high 7.5)
- [CVE-2021-4020](https://insights.sbomify.com/CVE-2021-4020/): Cross-site Scripting (XSS) - Stored in meetecho/janus-gateway (high 8.8)
- [CVE-2021-40191](https://insights.sbomify.com/CVE-2021-40191/): Cross-site scripting in dzzoffice:dzzoffice (medium 5.4)
- [CVE-2021-4019](https://insights.sbomify.com/CVE-2021-4019/): Heap-based Buffer Overflow in vim/vim (high 7.1)
- [CVE-2021-40189](https://insights.sbomify.com/CVE-2021-40189/): File upload in php-fusion:phpfusion (high 7.2)
- [CVE-2021-40188](https://insights.sbomify.com/CVE-2021-40188/): File upload in php-fusion:phpfusion (high 7.2)
- [CVE-2021-40186](https://insights.sbomify.com/CVE-2021-40186/): DNN CMS Server-Side Request Forgery (SSRF) (medium 6.5)
- [CVE-2021-40180](https://insights.sbomify.com/CVE-2021-40180/): Information disclosure in tencent:wechat (high 7.5)
- [CVE-2021-4018](https://insights.sbomify.com/CVE-2021-4018/): Cross-site Scripting (XSS) - Stored in snipe/snipe-it (medium 6.3)
- [CVE-2021-40178](https://insights.sbomify.com/CVE-2021-40178/): Cross-site scripting in zohocorp:manageengine log360 (medium 6.1)
- [CVE-2021-40177](https://insights.sbomify.com/CVE-2021-40177/): Code injection in zohocorp:manageengine log360 (critical 9.8)
- [CVE-2021-40176](https://insights.sbomify.com/CVE-2021-40176/): Cross-site scripting in zohocorp:manageengine log360 (medium 6.1)
- [CVE-2021-40175](https://insights.sbomify.com/CVE-2021-40175/): File upload in zohocorp:manageengine log360 (critical 9.8)
- [CVE-2021-40174](https://insights.sbomify.com/CVE-2021-40174/): Cross-site request forgery in zohocorp:manageengine log360 (high 8.8)
- [CVE-2021-40173](https://insights.sbomify.com/CVE-2021-40173/): Cross-site request forgery in zohocorp:manageengine cloud security plus (high 8.8)
- [CVE-2021-40172](https://insights.sbomify.com/CVE-2021-40172/): Cross-site request forgery in zohocorp:manageengine log360 (high 8.8)
- [CVE-2021-40171](https://insights.sbomify.com/CVE-2021-40171/): Other in securitashome:securitashome alarm system firmware (medium 5.3)
- [CVE-2021-40170](https://insights.sbomify.com/CVE-2021-40170/): Auth bypass in securitashome:securitashome alarm system firmware (medium 6.8)
- [CVE-2021-4017](https://insights.sbomify.com/CVE-2021-4017/): Cross-Site Request Forgery (CSRF) in star7th/showdoc (high 7.3)
- [CVE-2021-40167](https://insights.sbomify.com/CVE-2021-40167/): Memory corruption in Autodesk® Design Review (high 7.8)
- [CVE-2021-40166](https://insights.sbomify.com/CVE-2021-40166/): Use after free in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2021-40165](https://insights.sbomify.com/CVE-2021-40165/): Memory corruption in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2021-40164](https://insights.sbomify.com/CVE-2021-40164/): Memory corruption in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2021-40163](https://insights.sbomify.com/CVE-2021-40163/): Memory corruption in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2021-40162](https://insights.sbomify.com/CVE-2021-40162/): Memory corruption in Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2021-40161](https://insights.sbomify.com/CVE-2021-40161/): Memory corruption in Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac (high 7.8)
- [CVE-2021-40160](https://insights.sbomify.com/CVE-2021-40160/): Memory corruption in Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac (high 7.8)
- [CVE-2021-4016](https://insights.sbomify.com/CVE-2021-4016/): Rapid7 Insight Agent Improper Access Control (medium 4.0)
- [CVE-2021-40159](https://insights.sbomify.com/CVE-2021-40159/): Information disclosure in Inventor (high 7.8)
- [CVE-2021-40158](https://insights.sbomify.com/CVE-2021-40158/): Memory corruption in Inventor (high 7.8)
- [CVE-2021-40157](https://insights.sbomify.com/CVE-2021-40157/): Memory corruption in Autodesk FBX Review (high 7.8)
- [CVE-2021-40156](https://insights.sbomify.com/CVE-2021-40156/): Memory corruption in Autodesk Navisworks (high 7.8)
- [CVE-2021-40155](https://insights.sbomify.com/CVE-2021-40155/): Memory corruption in Autodesk Navisworks (high 7.8)
- [CVE-2021-40154](https://insights.sbomify.com/CVE-2021-40154/): Memory corruption in nxp:lpc55s69jbd100 firmware (medium 6.1)
- [CVE-2021-40153](https://insights.sbomify.com/CVE-2021-40153/): Path traversal in debian:debian linux (high 8.1)
- [CVE-2021-40150](https://insights.sbomify.com/CVE-2021-40150/): Information disclosure in reolink:e1 zoom firmware (high 7.5)
- [CVE-2021-4015](https://insights.sbomify.com/CVE-2021-4015/): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (medium 4.3)
- [CVE-2021-40149](https://insights.sbomify.com/CVE-2021-40149/): Information disclosure in reolink:e1 zoom firmware (medium 5.9)
- [CVE-2021-40148](https://insights.sbomify.com/CVE-2021-40148/): Information disclosure in mediatek:l9 (high 7.5)
- [CVE-2021-40147](https://insights.sbomify.com/CVE-2021-40147/): Other in emtec:zoc (critical 9.8)
- [CVE-2021-40146](https://insights.sbomify.com/CVE-2021-40146/): A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java (critical 9.8)
- [CVE-2021-40145](https://insights.sbomify.com/CVE-2021-40145/): Memory corruption in libgd:libgd (high 7.5)
- [CVE-2021-40143](https://insights.sbomify.com/CVE-2021-40143/): HTTP header injection in Sonatype Nexus Repository (high 8.2)
- [CVE-2021-40142](https://insights.sbomify.com/CVE-2021-40142/): Memory corruption in opcfoundation:local discover server (high 7.5)
- [CVE-2021-40131](https://insights.sbomify.com/CVE-2021-40131/): Cisco Common Services Platform Collector Stored Cross-Site Scripting Vulnerability (medium 5.5)
- [CVE-2021-40130](https://insights.sbomify.com/CVE-2021-40130/): Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability (medium 4.9)
- [CVE-2021-40129](https://insights.sbomify.com/CVE-2021-40129/): Cisco Common Services Platform Collector SQL Injection Vulnerability (medium 4.9)
- [CVE-2021-40128](https://insights.sbomify.com/CVE-2021-40128/): Cisco Webex Meetings Email Content Injection Vulnerability (medium 5.3)
- [CVE-2021-40127](https://insights.sbomify.com/CVE-2021-40127/): Cisco Small Business 200, 300, and 500 Series Switches Web-Based Management Interface Denial of Service Vulnerability (medium 5.3)
- [CVE-2021-40126](https://insights.sbomify.com/CVE-2021-40126/): Cisco Umbrella Email Enumeration Vulnerability (medium 4.3)
- [CVE-2021-40125](https://insights.sbomify.com/CVE-2021-40125/): Denial of service in Cisco Adaptive Security Appliance (ASA) Software (medium 5.3)
- [CVE-2021-40124](https://insights.sbomify.com/CVE-2021-40124/): Privilege escalation in Cisco AnyConnect Secure Mobility Client (medium 6.7)
- [CVE-2021-40123](https://insights.sbomify.com/CVE-2021-40123/): Cisco Identity Services Engine File Download Vulnerability (medium 4.3)
- [CVE-2021-40122](https://insights.sbomify.com/CVE-2021-40122/): Cisco Meeting Server Call Bridge Denial of Service Vulnerability (medium 5.9)
- [CVE-2021-40121](https://insights.sbomify.com/CVE-2021-40121/): Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities (medium 6.1)
- [CVE-2021-40120](https://insights.sbomify.com/CVE-2021-40120/): Cisco Small Business RV Series Routers Command Injection Vulnerability (medium 6.5)
- [CVE-2021-40119](https://insights.sbomify.com/CVE-2021-40119/): Cisco Policy Suite Static SSH Keys Vulnerability (critical 9.8)
- [CVE-2021-40118](https://insights.sbomify.com/CVE-2021-40118/): Memory corruption in Cisco Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2021-40117](https://insights.sbomify.com/CVE-2021-40117/): Denial of service in Cisco Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2021-40116](https://insights.sbomify.com/CVE-2021-40116/): Multiple Cisco Products Snort Rule Denial of Service Vulnerability (high 8.6)
- [CVE-2021-40115](https://insights.sbomify.com/CVE-2021-40115/): Cisco Webex Video Mesh Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2021-40114](https://insights.sbomify.com/CVE-2021-40114/): Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability (medium 6.8)
- [CVE-2021-40113](https://insights.sbomify.com/CVE-2021-40113/): Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities (critical 10.0)
- [CVE-2021-40112](https://insights.sbomify.com/CVE-2021-40112/): Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities (critical 10.0)
- [CVE-2021-40111](https://insights.sbomify.com/CVE-2021-40111/): Apache James IMAP parsing Denial Of Service (medium 6.5)
- [CVE-2021-40110](https://insights.sbomify.com/CVE-2021-40110/): Apache James IMAP vulnerable to a ReDoS (high 7.5)
- [CVE-2021-4011](https://insights.sbomify.com/CVE-2021-4011/): Memory corruption in xorg-x11-server (high 7.8)
- [CVE-2021-40109](https://insights.sbomify.com/CVE-2021-40109/): Server-side request forgery in concretecms:concrete cms (medium 6.4)
- [CVE-2021-40108](https://insights.sbomify.com/CVE-2021-40108/): Cross-site request forgery in concretecms:concrete cms (high 8.8)
- [CVE-2021-40106](https://insights.sbomify.com/CVE-2021-40106/): Cross-site scripting in concretecms:concrete cms (medium 6.1)
- [CVE-2021-40105](https://insights.sbomify.com/CVE-2021-40105/): Cross-site scripting in concretecms:concrete cms (medium 6.1)
- [CVE-2021-40104](https://insights.sbomify.com/CVE-2021-40104/): Security feature bypass in concretecms:concrete cms (high 7.5)
- [CVE-2021-40103](https://insights.sbomify.com/CVE-2021-40103/): Path traversal in concretecms:concrete cms (high 7.5)
- [CVE-2021-40102](https://insights.sbomify.com/CVE-2021-40102/): Deserialization in concretecms:concrete cms (critical 9.1)
- [CVE-2021-40101](https://insights.sbomify.com/CVE-2021-40101/): Auth bypass in concretecms:concrete cms (high 7.2)
- [CVE-2021-40100](https://insights.sbomify.com/CVE-2021-40100/): Cross-site scripting in concretecms:concrete cms (medium 5.4)
- [CVE-2021-4010](https://insights.sbomify.com/CVE-2021-4010/): Memory corruption in xorg-x11-server (high 7.8)
- [CVE-2021-40099](https://insights.sbomify.com/CVE-2021-40099/): Code injection in concretecms:concrete cms (high 7.2)
- [CVE-2021-40098](https://insights.sbomify.com/CVE-2021-40098/): Path traversal in concretecms:concrete cms (critical 9.8)
- [CVE-2021-40097](https://insights.sbomify.com/CVE-2021-40097/): Path traversal in concretecms:concrete cms (high 8.8)
- [CVE-2021-40096](https://insights.sbomify.com/CVE-2021-40096/): Cross-site scripting in squaredup:squaredup (medium 5.4)
- [CVE-2021-40095](https://insights.sbomify.com/CVE-2021-40095/): Path traversal in squaredup:squaredup (medium 4.9)
- [CVE-2021-40094](https://insights.sbomify.com/CVE-2021-40094/): Cross-site scripting in squaredup:squaredup (medium 5.4)
- [CVE-2021-40093](https://insights.sbomify.com/CVE-2021-40093/): Cross-site scripting in squaredup:squaredup (medium 5.4)
- [CVE-2021-40092](https://insights.sbomify.com/CVE-2021-40092/): Cross-site scripting in squaredup:squaredup (medium 5.4)
- [CVE-2021-40091](https://insights.sbomify.com/CVE-2021-40091/): Server-side request forgery in squaredup:squaredup (critical 9.8)
- [CVE-2021-4009](https://insights.sbomify.com/CVE-2021-4009/): Memory corruption in xorg-x11-server (high 7.8)
- [CVE-2021-40089](https://insights.sbomify.com/CVE-2021-40089/): Security feature bypass in primekey:ejbca (low 2.3)
- [CVE-2021-40088](https://insights.sbomify.com/CVE-2021-40088/): Missing authorization in primekey:ejbca (medium 5.4)
- [CVE-2021-40087](https://insights.sbomify.com/CVE-2021-40087/): Information disclosure in primekey:ejbca (low 2.7)
- [CVE-2021-40086](https://insights.sbomify.com/CVE-2021-40086/): Information disclosure in primekey:ejbca (low 2.2)
- [CVE-2021-40085](https://insights.sbomify.com/CVE-2021-40085/): OpenStack Neutron vulnerable to authenticated attackers reconfiguring dnsmasq via crafted extra_dhcp_opts value (medium 6.5)
- [CVE-2021-40084](https://insights.sbomify.com/CVE-2021-40084/): Code injection in artixlinux:opensysusers (critical 9.8)
- [CVE-2021-40083](https://insights.sbomify.com/CVE-2021-40083/): Denial of service in nic:knot resolver (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/99/