Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-27708 State: PUBLISHED Published: 2021-04-14T15:01:49 Last Updated: 2024-08-03T21:26:10.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "command" parameter is directly passed to the attacker, allowing them to control the "command" field to attack the OS. Additional Analyst Notes: - CVE Program Container: References: - http
m to control the "command" field to attack the OS. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/7FtB06f-SJ-SCfkMYcXYxA - https://hackmd.io/mDgIBvoxSPCZrZiZjfQGhw
CVE ID: CVE-2021-27710 State: PUBLISHED Published: 2021-04-14T17:07:11 Last Updated: 2024-08-03T21:26:10.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "ip" parameter is directly passed to the attacker, allowing them to control the "ip" field to attack the OS. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd
control the "ip" field to attack the OS. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/KjXzQdjDRjOuRjoZZXQo_A - https://hackmd.io/Hy3oVgtcQiuqAtv9FdylHw
CVE ID: CVE-2021-27715 State: PUBLISHED Published: 2023-09-08T00:00:00 Last Updated: 2024-09-26T18:19:26.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://mofi.com - https://www.nagarro.com/services/security/mofi-cve-security-advisory
CVE ID: CVE-2021-27722 State: PUBLISHED Published: 2021-11-02T10:44:26 Last Updated: 2024-08-03T21:26:10.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5. The program can be crashed by entering 300 bytes char data into the "Key" or "Name" field while registering. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49590 - https://www.exploit-db.com/exploits/49638
CVE ID: CVE-2021-27723 State: REJECTED Published: 2021-11-02T10:27:19 Last Updated: 2021-11-03T21:09:14 Description: No description available.
CVE ID: CVE-2021-27730 State: PUBLISHED Published: 2021-03-02T01:03:03 Last Updated: 2024-08-03T21:26:10.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA_9_12_444 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/accellion/CVEs/blob/main/CVE-2021-27730.txt
CVE ID: CVE-2021-27731 State: PUBLISHED Published: 2021-03-02T01:00:48 Last Updated: 2024-08-03T21:26:10.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/accellion/CVEs/blob/main/CVE-2021-27731.txt
CVE ID: CVE-2021-27733 State: PUBLISHED Published: 2021-05-11T11:35:36 Last Updated: 2024-08-03T21:26:10.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021/
CVE ID: CVE-2021-27734 State: PUBLISHED Published: 2021-05-17T14:28:42 Last Updated: 2024-08-03T21:26:10.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users. Additional Analyst Notes: - CVE Program Container: References: - https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=12914&mediaformatid=50063&destinationid=10016
CVE ID: CVE-2021-27736 State: PUBLISHED Published: 2021-04-22T13:14:54 Last Updated: 2024-08-03T21:26:10.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FusionAuth/fusionauth-samlv2/compare/0.5.3...0.5.4 - https://github.com/FusionAuth/fusionauth-samlv2/commit/c66fb689d50010662f705d5b585c6388ce555dbd - https://www.compass-security.com/fileadmin/Research/Advisories/2021-03_CSNC-2021-004_FusionAuth_SAML_Library_XML_
5dbd - https://www.compass-security.com/fileadmin/Research/Advisories/2021-03_CSNC-2021-004_FusionAuth_SAML_Library_XML_External_Entity.txt
CVE ID: CVE-2021-27737 State: PUBLISHED Published: 2021-05-14T20:39:39 Last Updated: 2024-08-03T21:26:10.829Z Vendors: n/a Products: Apache Traffic Server Problem Types: Information Disclosure Description: Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r74f72650c3590478f028ea3a1b8cab2a33d20ad9ff407e894ca70525%40%3Cannounce.trafficserver.apache.org%3E - https://lists.apache.org/thread.html/r74f72650c3590478f028ea3a1b8cab2a33d20ad9ff407e894ca70525%40%3Cdev.trafficserver.apache.org%3E - https://lists.apache.org/thread.html/r74f72650c3590478f0
33d20ad9ff407e894ca70525%40%3Cdev.trafficserver.apache.org%3E - https://lists.apache.org/thread.html/r74f72650c3590478f028ea3a1b8cab2a33d20ad9ff407e894ca70525%40%3Cusers.trafficserver.apache.org%3E - https://lists.apache.org/thread.html/r74f72650c3590478f028ea3a1b8cab2a33d20ad9ff407e894ca70525%40%3Cannounce.trafficserver.apache.org%3E
CVE ID: CVE-2021-27738 State: PUBLISHED Published: 2022-01-06T12:35:17 Last Updated: 2024-08-03T21:26:10.756Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CWE-918 Description: All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achie
cepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70 - http://www.openwall.com/lists/oss-security/2022/01/06/6
CVE ID: CVE-2021-27741 State: PUBLISHED Published: 2021-08-13T13:20:44 Last Updated: 2024-08-03T21:26:10.806Z Vendors: n/a Products: Commerce Problem Types: "XML external entity (XXE) injection" Description: " Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection" Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0089834
CVE ID: CVE-2021-27746 State: PUBLISHED Published: 2021-10-21T20:27:43 Last Updated: 2024-08-03T21:26:10.855Z Vendors: n/a Products: "HCL Connections" Problem Types: "Cross-Site Scripting (XSS)" Description: "HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability" Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0094194
CVE ID: CVE-2021-27751 State: PUBLISHED Published: 2022-05-06T18:10:26.603495Z Last Updated: 2024-09-16T22:09:06.365Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: HCL Commerce Problem Types: CWE-613 Description: HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097650
CVE ID: CVE-2021-27753 State: PUBLISHED Published: 2022-02-21T17:49:28 Last Updated: 2024-08-03T21:26:10.807Z Vendors: n/a Products: "HCL Sametime" Problem Types: "Improper Limitation of a Pathname to a Restricted Directory" Description: "Sametime Android PathTraversal Vulnerability" Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096575
CVE ID: CVE-2021-27755 State: PUBLISHED Published: 2022-02-21T17:49:28 Last Updated: 2024-08-03T21:26:10.729Z Vendors: n/a Products: "HCL Sametime" Problem Types: "Relative Path Traversal" Description: "Sametime Android potential path traversal vulnerability when using File class" Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096575
CVE ID: CVE-2021-27756 State: PUBLISHED Published: 2022-03-04T21:18:06 Last Updated: 2024-08-03T21:26:10.871Z Vendors: n/a Products: "BigFix Compliance Server" Problem Types: "Sensitive Data Exposure" Description: "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it." Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096977
CVE ID: CVE-2021-27757 State: PUBLISHED Published: 2022-03-04T18:53:06 Last Updated: 2024-08-03T21:26:10.859Z Vendors: n/a Products: "BigFix Insights" Problem Types: "Sensitive Data Exposure" Description: " Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Since the information is stored in cleartext, attackers could potentially read it and gain access to sensitive information." Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095303
CVE ID: CVE-2021-27758 State: PUBLISHED Published: 2022-05-06T18:10:27.962959Z Last Updated: 2024-09-16T20:12:17.004Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:U/RC:C/CR:L/IR:L/AR:L/MAV:A/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:L) Vendors: HCL Software Products: HCL BigFix Inventory Problem Types: CWE-352 Description: There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006
CVE ID: CVE-2021-27759 State: PUBLISHED Published: 2022-05-06T18:10:29.374854Z Last Updated: 2024-09-17T04:19:25.489Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C/CR:L/IR:L/AR:L/MAV:A/MAC:H/MPR:L/MUI:R/MS:U/MC:X/MI:N/MA:N) Vendors: HCL Software Products: HCL BigFix Inventory Problem Types: CWE-352 Description: This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltec
rbitrary URL in the application. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006
CVE ID: CVE-2021-27760 State: PUBLISHED Published: 2022-05-06T18:10:30.931261Z Last Updated: 2024-09-17T04:19:12.658Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: HCL Software Products: HCL Notes Problem Types: CWE-20 Description: An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670
CVE ID: CVE-2021-27761 State: PUBLISHED Published: 2022-05-06T18:10:32.571551Z Last Updated: 2024-09-16T17:14:24.541Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: BigFix Platform Problem Types: weak TLS Description: Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116
CVE ID: CVE-2021-27762 State: PUBLISHED Published: 2022-05-06T18:10:33.990070Z Last Updated: 2024-09-16T23:16:12.139Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: HCL Software Products: BigFix Platform Problem Types: Missing Headers Description: Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116
CVE ID: CVE-2021-27764 State: PUBLISHED Published: 2022-05-06T18:10:35.347152Z Last Updated: 2024-09-16T19:09:03.206Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: HCL Software Products: HCL BigFix WebUI Problem Types: CWE-614 Description: Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097778
CVE ID: CVE-2021-27765 State: PUBLISHED Published: 2022-05-06T18:10:36.862723Z Last Updated: 2024-09-16T22:15:59.470Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: HCL Software Products: BigFix Platform Problem Types: CWE-269 Description: The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=K
Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0023/MNDT-2022-0023.md
CVE ID: CVE-2021-27766 State: PUBLISHED Published: 2022-05-06T18:10:38.317312Z Last Updated: 2024-09-17T03:52:58.363Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: HCL Software Products: BigFix Platform Problem Types: CWE-269 Description: The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB009
lyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0024/MNDT-2022-0024.md
CVE ID: CVE-2021-27767 State: PUBLISHED Published: 2022-05-06T18:10:39.858818Z Last Updated: 2024-09-16T20:12:16.382Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: HCL Software Products: BigFix Platform Problem Types: CWE-269 Description: The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB00
alyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0025/MNDT-2022-0025.md
CVE ID: CVE-2021-27768 State: PUBLISHED Published: 2022-05-12T21:25:22.517252Z Last Updated: 2024-09-16T16:33:54.972Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: HCL Software Products: Verse for Android Problem Types: CWE-300 Description: Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issu
a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097753
CVE ID: CVE-2021-27769 State: PUBLISHED Published: 2022-05-12T21:25:24.050481Z Last Updated: 2024-09-16T16:52:51.973Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: Sametime Problem Types: CWE-472 Description: Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_articl
ossible. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE ID: CVE-2021-27770 State: PUBLISHED Published: 2022-05-12T21:25:25.427594Z Last Updated: 2024-09-16T20:02:52.780Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: HCL Software Products: Sametime Problem Types: CWE-472 Description: The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE ID: CVE-2021-27771 State: PUBLISHED Published: 2022-05-12T21:25:27.080788Z Last Updated: 2024-09-17T01:40:42.492Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H) Vendors: HCL Software Products: Sametime Problem Types: CWE-434, CWE-22 Description: User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files. Additional Analyst Notes: - CVE Program Container: References: - https://supp
g notifications and/or transferring files. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE ID: CVE-2021-27772 State: PUBLISHED Published: 2022-05-12T21:25:28.545905Z Last Updated: 2024-09-17T03:02:57.695Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: HCL Software Products: Sametime Problem Types: CWE-285 Description: Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge. Addi
kage where confidential information discussed in private groups is read by other users without the users knowledge. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE ID: CVE-2021-27773 State: PUBLISHED Published: 2022-05-12T21:25:29.915766Z Last Updated: 2024-09-16T23:56:30.556Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: Sametime Problem Types: CWE-451 Description: This vulnerability allows users to execute a clickjacking attack in the meeting's chat. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE ID: CVE-2021-27774 State: PUBLISHED Published: 2022-09-22T20:20:10.000Z Last Updated: 2025-05-27T15:03:23.144Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: HCL Software Products: HCL Digital Experience Problem Types: CWE-209 Description: User input included in error response, which could be used in a phishing attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100491
CVE ID: CVE-2021-27777 State: PUBLISHED Published: 2022-05-12T21:25:31.294598Z Last Updated: 2024-09-16T19:31:23.448Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: HCL Software Products: HCL Unica Problem Types: CWE-91 Description: XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097124