CVEs published September 6, 2021
37 CVEs were published on September 6, 2021: 0 critical, 3 high.
- Published
- 37
- Critical
- 0
- High
- 3
- Medium
- 10
- Low
- 1
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- 4
- bookstackapp/bookstack
- 2
- Kubernetes · k8s.io/kubernetes
- 2
- AddToAny Share Buttons
- 1
- Cashtomer
- 1
- Comment Highlighter
- 1
- Cookie Notice & Consent Banner for GDPR & CCPA Compliance
- 1
- Easy Testimonial Manager
- 1
- Email Encoder – Protect Email Addresses
- 1
- Embed Youtube Video
- 1
High 3
Medium, low and unrated 34
- CVE-2021-40532Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.
- CVE-2021-40531Sketch before 75 allows library feeds to be used to bypass file quarantine.
- CVE-2021-24006An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user Fortinet FortiManager
- CVE-2021-40529The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during int
- CVE-2021-40530The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries
- CVE-2020-15939An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, Fortinet FortiSandbox
- CVE-2021-36096Support Bundle includes S/Mime and PGP secret or PINOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-36095User enumeration issue using "lost password" featureOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-36094XSS attack in appointment edit popup screenOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-36093DoS attack using PostMaster filtersOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2021-36744Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit Trend Micro Security
- CVE-2021-25737Holes in EndpointSlice Validation Enable Host Network HijackKubernetes · k8s.io/kubernetes
- CVE-2021-25735Validating Admission Webhook does not observe some previous fieldsKubernetes · k8s.io/kubernetes
- CVE-2021-3768Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackbookstackapp/bookstack
- CVE-2021-3767Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackbookstackapp/bookstack
- CVE-2021-24611Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)Keyword Meta
- CVE-2021-24603Site Reviews < 5.13.1 - Authenticated Stored XSSSite Reviews
- CVE-2021-24601WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSSWPFront Notification Bar
- CVE-2021-24599Email Encoder < 2.1.2 - Reflected Cross Site ScriptingEmail Encoder – Protect Email Addresses
- CVE-2021-24591Highlight < 0.9.3 - Authenticated Stored Cross-Site ScriptingHighlight
- CVE-2021-24590Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.2 - Authenticated Stored XSSCookie Notice & Consent Banner for GDPR & CCPA Compliance
- CVE-2021-24588SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site ScriptingSMS Alert Order Notifications – WooCommerce
- CVE-2021-24568AddToAny < 1.7.46 - Authenticated Stored XSSAddToAny Share Buttons
- CVE-2021-24517Stop Spammers Security < 2021.18 - Authenticated Stored XSSStop Spammers Security | Block Spam Users, Comments, Forms
- CVE-2021-24513Form Builder < 1.9.8.4 - Authenticated Stored Cross-Site ScriptingForm Builder | Create Responsive Contact Forms
- CVE-2021-24435Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)Titan Framework
- CVE-2021-24395Embed Youtube Video <= 1.0 - Authenticated SQL InjectionEmbed Youtube Video
- CVE-2021-24393Comment Highlighter <= 0.13 - Authenticated SQL InjectionComment Highlighter
- CVE-2021-24394Easy Testimonial Manager <= 1.2.0 - Authenticated SQL InjectionEasy Testimonial Manager
- CVE-2021-24392WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL InjectionWordPress Membership SwiftCloud.io
- CVE-2021-24391Cashtomer <= 1.0.0 - Authenticated SQL InjectionCashtomer
- CVE-2021-24390Alipay <= 3.7.2 - Authenticated SQL InjectionWordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
- CVE-2021-24303JiangQie Official Website Mini Program < 1.1.1 - Authenticated SQL InjectionJiangQie Official Website Mini Program
- CVE-2021-40528The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic librari