CVEs published October 8, 2021
59 CVEs were published on October 8, 2021: 4 critical, 4 high. 5 are now in CISA KEV.
- Published
- 59
- Critical
- 4
- High
- 4
- Medium
- 10
- Low
- 2
- Unrated
- 39
- Now in CISA KEV
- 5
- Fix available
- 32
Most affected products
- Google Chrome
- 28
- TadTools
- 3
- F-Secure endpoint protection products on Windows and Mac. F…
- 2
- Tad Book3
- 2
- Tad Uploader
- 2
- flatpak
- 1
- github.com/hashicorp/vault
- 1
- IBM App Connect Enterprise Certified Container
- 1
- IBM Sterling File Gateway
- 1
- limesurvey/limesurvey
- 1
Critical 4
- CVE-2021-37973Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2021-30633Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2021-41974Tad Book3 - Improper AuthorizationTad Book3
- CVE-2021-41566Tad TadTools - Arbitrary File UploadTadTools
High 4
- CVE-2021-41975Tad TadTools - Improper AuthorizationTadTools
- CVE-2021-30632Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2021-37975Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-41133Sandbox bypass via recent VFS-manipulating syscallsflatpak
Medium, low and unrated 51
- CVE-2021-37976Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2021-37974Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2021-37972Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2021-37971Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the OmniboGoogle Chrome
- CVE-2021-37970Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2021-37969Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local Google Chrome
- CVE-2021-37968Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2021-37967Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2021-37966Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contentGoogle Chrome
- CVE-2021-37965Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2021-37964Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireGoogle Chrome
- CVE-2021-37963Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via aGoogle Chrome
- CVE-2021-37962Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2021-37961Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-37959Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user Google Chrome
- CVE-2021-37958Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or Google Chrome
- CVE-2021-37957Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-37956Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2021-30630Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2021-30629Use after free in Permissions in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2021-30628Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via Google Chrome
- CVE-2021-30627Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-30626Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2021-30625Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a maliciouGoogle Chrome
- CVE-2021-42112The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scriptlimesurvey/limesurvey
- CVE-2020-22617Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext
- CVE-2021-42109VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.
- CVE-2021-29906IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it IBM App Connect Enterprise Certified Container
- CVE-2020-4654IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due to improper permissiIBM Sterling File Gateway
- CVE-2021-41802HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accegithub.com/hashicorp/vault
- CVE-2021-32029A flaw was found in postgresql.postgresql
- CVE-2021-20600Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior aMitsubishi Electric MELSEC iQ-R series C Controller Module…
- CVE-2021-41920webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /incl
- CVE-2021-41919webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions.
- CVE-2021-41918webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-
- CVE-2021-41917webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in
- CVE-2021-41916A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrati
- CVE-2021-41976Tad Uploader - Improper AuthorizationTad Uploader
- CVE-2021-41568Tad Web - Improper AuthorizationTad Web
- CVE-2021-41567Tad Uploader - Stored XSSTad Uploader
- CVE-2021-41565Tad TadTools - Reflected XSSTadTools
- CVE-2021-41564Tad Honor - Improper AuthorizationTad Honor
- CVE-2021-41563Tad Book3 - Stored XSSTad Book3
- CVE-2021-41825Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter.
- CVE-2021-3312An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privilegesorg.opencms:opencms-core
- CVE-2021-36767In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making
- CVE-2021-35979An issue was discovered in Digi RealPort through 4.8.488.0.
- CVE-2021-35977An issue was discovered in Digi RealPort for Windows through 4.8.488.0.
- CVE-2021-41947A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode.
- CVE-2021-40832Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows and Mac. F…
- CVE-2021-33603Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows and Mac. F…