# CVEs published 2021-09-06

37 CVEs were published on September 6, 2021: 0 critical, 3 high. Days are UTC.

- [CVE-2021-40532](https://cve.now/CVE-2021-40532.md): Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension. (no CVSS)
- [CVE-2021-40531](https://cve.now/CVE-2021-40531.md): Sketch before 75 allows library feeds to be used to bypass file quarantine. (no CVSS)
- [CVE-2021-24006](https://cve.now/CVE-2021-24006.md): An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user (CVSS 6.3, Fortinet FortiManager)
- [CVE-2021-40529](https://cve.now/CVE-2021-40529.md): The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during int (no CVSS)
- [CVE-2021-40530](https://cve.now/CVE-2021-40530.md): The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries (no CVSS)
- [CVE-2020-15939](https://cve.now/CVE-2020-15939.md): An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, (CVSS 4.3, Fortinet FortiSandbox)
- [CVE-2021-36096](https://cve.now/CVE-2021-36096.md): Support Bundle includes S/Mime and PGP secret or PIN (CVSS 5.2, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2021-36095](https://cve.now/CVE-2021-36095.md): User enumeration issue using "lost password" feature (CVSS 5.3, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2021-36094](https://cve.now/CVE-2021-36094.md): XSS attack in appointment edit popup screen (CVSS 5.7, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2021-36093](https://cve.now/CVE-2021-36093.md): DoS attack using PostMaster filters (CVSS 5.3, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2021-36744](https://cve.now/CVE-2021-36744.md): Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit (no CVSS, Trend Micro Security)
- [CVE-2021-25737](https://cve.now/CVE-2021-25737.md): Holes in EndpointSlice Validation Enable Host Network Hijack (CVSS 2.7, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-25735](https://cve.now/CVE-2021-25735.md): Validating Admission Webhook does not observe some previous fields (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-3768](https://cve.now/CVE-2021-3768.md): Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack (CVSS 5.4, bookstackapp/bookstack)
- [CVE-2021-3767](https://cve.now/CVE-2021-3767.md): Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack (CVSS 5.4, bookstackapp/bookstack)
- [CVE-2021-3766](https://cve.now/CVE-2021-3766.md): Prototype Pollution in vincit/objection.js (CVSS 7.5, vincit/objection.js · objection)
- [CVE-2021-32568](https://cve.now/CVE-2021-32568.md): Deserialization of Untrusted Data in zmister2016/mrdoc (CVSS 7.5, zmister2016/mrdoc)
- [CVE-2021-24611](https://cve.now/CVE-2021-24611.md): Keywords & Meta \<= 3.0 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, Keyword Meta)
- [CVE-2021-24603](https://cve.now/CVE-2021-24603.md): Site Reviews \< 5.13.1 - Authenticated Stored XSS (no CVSS, Site Reviews)
- [CVE-2021-24601](https://cve.now/CVE-2021-24601.md): WPFront Notification Bar \< 2.1.0.08087 - Authenticated Stored XSS (no CVSS, WPFront Notification Bar)
- [CVE-2021-24599](https://cve.now/CVE-2021-24599.md): Email Encoder \< 2.1.2 - Reflected Cross Site Scripting (no CVSS, Email Encoder – Protect Email Addresses)
- [CVE-2021-24591](https://cve.now/CVE-2021-24591.md): Highlight \< 0.9.3 - Authenticated Stored Cross-Site Scripting (no CVSS, Highlight)
- [CVE-2021-24590](https://cve.now/CVE-2021-24590.md): Cookie Notice & Consent Banner for GDPR & CCPA Compliance \< 1.7.2 - Authenticated Stored XSS (no CVSS, Cookie Notice & Consent Banner for GDPR & CCPA Compliance)
- [CVE-2021-24588](https://cve.now/CVE-2021-24588.md): SMS Alert Order Notifications – WooCommerce \< 3.4.7 Authenticated Cross Site Scripting (no CVSS, SMS Alert Order Notifications – WooCommerce)
- [CVE-2021-24568](https://cve.now/CVE-2021-24568.md): AddToAny \< 1.7.46 - Authenticated Stored XSS (no CVSS, AddToAny Share Buttons)
- [CVE-2021-24517](https://cve.now/CVE-2021-24517.md): Stop Spammers Security \< 2021.18 - Authenticated Stored XSS (no CVSS, Stop Spammers Security | Block Spam Users, Comments, Forms)
- [CVE-2021-24513](https://cve.now/CVE-2021-24513.md): Form Builder \< 1.9.8.4 - Authenticated Stored Cross-Site Scripting (no CVSS, Form Builder | Create Responsive Contact Forms)
- [CVE-2021-24435](https://cve.now/CVE-2021-24435.md): Titan Framework \<= 1.12.1 - Reflected Cross-Site Scripting (XSS) (no CVSS, Titan Framework)
- [CVE-2021-24395](https://cve.now/CVE-2021-24395.md): Embed Youtube Video \<= 1.0 - Authenticated SQL Injection (no CVSS, Embed Youtube Video)
- [CVE-2021-24393](https://cve.now/CVE-2021-24393.md): Comment Highlighter \<= 0.13 - Authenticated SQL Injection (no CVSS, Comment Highlighter)
- [CVE-2021-24394](https://cve.now/CVE-2021-24394.md): Easy Testimonial Manager \<= 1.2.0 - Authenticated SQL Injection (no CVSS, Easy Testimonial Manager)
- [CVE-2021-24392](https://cve.now/CVE-2021-24392.md): WordPress Membership SwiftCloud.io \<= 1.0 - Authenticated SQL Injection (no CVSS, WordPress Membership SwiftCloud.io)
- [CVE-2021-24391](https://cve.now/CVE-2021-24391.md): Cashtomer \<= 1.0.0 - Authenticated SQL Injection (no CVSS, Cashtomer)
- [CVE-2021-24390](https://cve.now/CVE-2021-24390.md): Alipay \<= 3.7.2 - Authenticated SQL Injection (no CVSS, WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件)
- [CVE-2021-24303](https://cve.now/CVE-2021-24303.md): JiangQie Official Website Mini Program \< 1.1.1 - Authenticated SQL Injection (no CVSS, JiangQie Official Website Mini Program)
- [CVE-2021-3770](https://cve.now/CVE-2021-3770.md): Heap-based Buffer Overflow in vim/vim (CVSS 8.6, vim/vim)
- [CVE-2021-40528](https://cve.now/CVE-2021-40528.md): The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic librari (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.