CVEs published July 6, 2021
26 CVEs were published on July 6, 2021: 0 critical, 1 high.
- Published
- 26
- Critical
- 0
- High
- 1
- Medium
- 6
- Low
- 1
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- GitLab
- 5
- Chimpstudio WP Foodbakery · Chimpstudio FoodBakery
- 1
- Contempoinc WP Pro Real Estate
- 1
- Delicious Brains WP Offload SES Lite
- 1
- E4J s.r.l. VikRentCar Car Rental Management System
- 1
- Export Users With Meta
- 1
- Fortinet FortiAuthenticator
- 1
- gVectors Team wpForo Forum
- 1
- IZSoft Easy Cookies Policy
- 1
- JoomSport – for Sports: Team & League, Football, Hockey & m…
- 1
High 1
Medium, low and unrated 25
- CVE-2021-22223Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT GitLab
- CVE-2021-22228An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versiGitLab
- CVE-2021-22226Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since versiGitLab
- CVE-2020-23697Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
- CVE-2021-22232HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CEGitLab
- CVE-2021-22229An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8.GitLab
- CVE-2020-22249Remote Code Execution vulnerability in phplist 3.5.1.
- CVE-2020-22251Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
- CVE-2021-34190A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbit
- CVE-2021-35440Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS).smashing
- CVE-2021-27930Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated (or compromised) user to inject malicious Java
- CVE-2021-32559An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that wpywin32
- CVE-2021-24494WP Offload SES Lite < 1.4.5 - Stored Cross-Site Scripting (XSS)Delicious Brains WP Offload SES Lite
- CVE-2021-24451Export Users With Meta < 0.6.5 - Authenticated SQL InjectionExport Users With Meta
- CVE-2021-24407Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)TieLabs Jannah
- CVE-2021-24406wpForo Forum < 1.9.7 - Open RedirectgVectors Team wpForo Forum
- CVE-2021-24405Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site ScriptingIZSoft Easy Cookies Policy
- CVE-2021-24389FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)Chimpstudio WP Foodbakery · Chimpstudio FoodBakery
- CVE-2021-24387Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)Contempoinc WP Pro Real Estate
- CVE-2021-24388Vik Rent Car < 1.1.7 - CSRF to Stored XSSE4J s.r.l. VikRentCar Car Rental Management System
- CVE-2021-24386WP SVG Images < 3.4 - Authenticated (author+) Stored XSS via SVGKubiQ WP SVG images
- CVE-2021-24384JoomSport < 5.1.8 - Unauthenticated PHP Object InjectionJoomSport – for Sports: Team & League, Football, Hockey & m…
- CVE-2021-24375Motor theme < 3.1.0 - Local File InclusionStockware Motor
- CVE-2021-24005Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow aFortinet FortiAuthenticator
- CVE-2021-3598There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5.OpenEXR