# CVEs published 2021-10-08

59 CVEs were published on October 8, 2021: 4 critical, 4 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2021-37976](https://cve.now/CVE-2021-37976.md): Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, KEV, Google Chrome)
- [CVE-2021-37974](https://cve.now/CVE-2021-37974.md): Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to (no CVSS, Google Chrome)
- [CVE-2021-37973](https://cve.now/CVE-2021-37973.md): Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to poten (CVSS 9.6, KEV, Google Chrome)
- [CVE-2021-37972](https://cve.now/CVE-2021-37972.md): Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-37971](https://cve.now/CVE-2021-37971.md): Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibo (no CVSS, Google Chrome)
- [CVE-2021-37970](https://cve.now/CVE-2021-37970.md): Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2021-37969](https://cve.now/CVE-2021-37969.md): Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local (no CVSS, Google Chrome)
- [CVE-2021-37968](https://cve.now/CVE-2021-37968.md): Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin d (no CVSS, Google Chrome)
- [CVE-2021-37967](https://cve.now/CVE-2021-37967.md): Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised th (no CVSS, Google Chrome)
- [CVE-2021-37966](https://cve.now/CVE-2021-37966.md): Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the content (no CVSS, Google Chrome)
- [CVE-2021-37965](https://cve.now/CVE-2021-37965.md): Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin d (no CVSS, Google Chrome)
- [CVE-2021-37964](https://cve.now/CVE-2021-37964.md): Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wire (no CVSS, Google Chrome)
- [CVE-2021-37963](https://cve.now/CVE-2021-37963.md): Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a (no CVSS, Google Chrome)
- [CVE-2021-37962](https://cve.now/CVE-2021-37962.md): Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer proc (no CVSS, Google Chrome)
- [CVE-2021-37961](https://cve.now/CVE-2021-37961.md): Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-37959](https://cve.now/CVE-2021-37959.md): Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user (no CVSS, Google Chrome)
- [CVE-2021-37958](https://cve.now/CVE-2021-37958.md): Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or (no CVSS, Google Chrome)
- [CVE-2021-37957](https://cve.now/CVE-2021-37957.md): Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-37956](https://cve.now/CVE-2021-37956.md): Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer p (no CVSS, Google Chrome)
- [CVE-2021-30633](https://cve.now/CVE-2021-30633.md): Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process t (CVSS 9.6, KEV, Google Chrome)
- [CVE-2021-30630](https://cve.now/CVE-2021-30630.md): Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer proc (no CVSS, Google Chrome)
- [CVE-2021-30629](https://cve.now/CVE-2021-30629.md): Use after free in Permissions in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to p (no CVSS, Google Chrome)
- [CVE-2021-30628](https://cve.now/CVE-2021-30628.md): Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via (no CVSS, Google Chrome)
- [CVE-2021-30627](https://cve.now/CVE-2021-30627.md): Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-30626](https://cve.now/CVE-2021-30626.md): Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-30625](https://cve.now/CVE-2021-30625.md): Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a maliciou (no CVSS, Google Chrome)
- [CVE-2021-42112](https://cve.now/CVE-2021-42112.md): The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/script (no CVSS, limesurvey/limesurvey)
- [CVE-2020-22617](https://cve.now/CVE-2020-22617.md): Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext (no CVSS)
- [CVE-2021-42109](https://cve.now/CVE-2021-42109.md): VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root. (no CVSS)
- [CVE-2021-29906](https://cve.now/CVE-2021-29906.md): IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it (CVSS 5.1, IBM App Connect Enterprise Certified Container)
- [CVE-2020-4654](https://cve.now/CVE-2020-4654.md): IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due to improper permissi (CVSS 3.1, IBM Sterling File Gateway)
- [CVE-2021-41802](https://cve.now/CVE-2021-41802.md): HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount acce (CVSS 2.9, github.com/hashicorp/vault)
- [CVE-2021-32029](https://cve.now/CVE-2021-32029.md): A flaw was found in postgresql. (no CVSS, postgresql)
- [CVE-2021-20600](https://cve.now/CVE-2021-20600.md): Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior a (no CVSS, Mitsubishi Electric MELSEC iQ-R series C Controller Module…)
- [CVE-2021-41920](https://cve.now/CVE-2021-41920.md): webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /incl (no CVSS)
- [CVE-2021-41919](https://cve.now/CVE-2021-41919.md): webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. (no CVSS)
- [CVE-2021-41918](https://cve.now/CVE-2021-41918.md): webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user- (no CVSS)
- [CVE-2021-41917](https://cve.now/CVE-2021-41917.md): webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in (no CVSS)
- [CVE-2021-41916](https://cve.now/CVE-2021-41916.md): A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrati (no CVSS)
- [CVE-2021-41976](https://cve.now/CVE-2021-41976.md): Tad Uploader - Improper Authorization (CVSS 5.3, Tad Uploader)
- [CVE-2021-41975](https://cve.now/CVE-2021-41975.md): Tad TadTools - Improper Authorization (CVSS 7.5, TadTools)
- [CVE-2021-41974](https://cve.now/CVE-2021-41974.md): Tad Book3 - Improper Authorization (CVSS 9.1, Tad Book3)
- [CVE-2021-41568](https://cve.now/CVE-2021-41568.md): Tad Web - Improper Authorization (CVSS 5.3, Tad Web)
- [CVE-2021-41567](https://cve.now/CVE-2021-41567.md): Tad Uploader - Stored XSS (CVSS 6.1, Tad Uploader)
- [CVE-2021-41566](https://cve.now/CVE-2021-41566.md): Tad TadTools - Arbitrary File Upload (CVSS 9.8, TadTools)
- [CVE-2021-41565](https://cve.now/CVE-2021-41565.md): Tad TadTools - Reflected XSS (CVSS 6.1, TadTools)
- [CVE-2021-41564](https://cve.now/CVE-2021-41564.md): Tad Honor - Improper Authorization (CVSS 5.3, Tad Honor)
- [CVE-2021-41563](https://cve.now/CVE-2021-41563.md): Tad Book3 - Stored XSS (CVSS 6.1, Tad Book3)
- [CVE-2021-41825](https://cve.now/CVE-2021-41825.md): Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter. (no CVSS)
- [CVE-2021-3312](https://cve.now/CVE-2021-3312.md): An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges (no CVSS, org.opencms:opencms-core)
- [CVE-2021-36767](https://cve.now/CVE-2021-36767.md): In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making (no CVSS)
- [CVE-2021-35979](https://cve.now/CVE-2021-35979.md): An issue was discovered in Digi RealPort through 4.8.488.0. (no CVSS)
- [CVE-2021-35977](https://cve.now/CVE-2021-35977.md): An issue was discovered in Digi RealPort for Windows through 4.8.488.0. (no CVSS)
- [CVE-2021-41947](https://cve.now/CVE-2021-41947.md): A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode. (no CVSS)
- [CVE-2021-40832](https://cve.now/CVE-2021-40832.md): Denial-of-Service (DoS) Vulnerability (CVSS 5.5, F-Secure endpoint protection products on Windows and Mac. F…)
- [CVE-2021-33603](https://cve.now/CVE-2021-33603.md): Denial-of-Service (DoS) Vulnerability (CVSS 5.5, F-Secure endpoint protection products on Windows and Mac. F…)
- [CVE-2021-30632](https://cve.now/CVE-2021-30632.md): Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-37975](https://cve.now/CVE-2021-37975.md): Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted H (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-41133](https://cve.now/CVE-2021-41133.md): Sandbox bypass via recent VFS-manipulating syscalls (CVSS 8.8, flatpak)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.