rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-27734 
Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-17T14:28:42.000Z
CVE-2021-27736 
FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-22T13:14:54.000Z
CVE-2021-27737 
Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Traffic Server
Published: 2021-05-14T20:39:39.000Z
CVE-2021-27738 Improper Access Control to Streaming Coordinator & SSRF
All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Apache Software Foundation
product: Apache Kylin
Credits: lang: en
value: Wei Lin Ngo <ngo.weilin@starlabs.sg>
Published: 2022-01-06T12:35:17.000Z
CVE-2021-27741 
" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"
Problem types: description: "XML external entity (XXE) injection"
Affected products: vendor: n/a
product: Commerce
Published: 2021-08-13T13:20:44.000Z
CVE-2021-27746 
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"
Problem types: description: "Cross-Site Scripting (XSS)"
Affected products: vendor: n/a
product: "HCL Connections"
Published: 2021-10-21T20:27:43.000Z
CVE-2021-27751 HCL Commerce is affected by an Insufficient Session Expiration vulnerability.
HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: HCL Software
product: HCL Commerce
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-05-06T18:10:26.603Z
CVE-2021-27753 
"Sametime Android PathTraversal Vulnerability"
Problem types: description: "Improper Limitation of a Pathname to a Restricted Directory"
Affected products: vendor: n/a
product: "HCL Sametime"
Published: 2022-02-21T17:49:28.000Z
CVE-2021-27755 
"Sametime Android potential path traversal vulnerability when using File class"
Problem types: description: "Relative Path Traversal"
Affected products: vendor: n/a
product: "HCL Sametime"
Published: 2022-02-21T17:49:28.000Z
CVE-2021-27756 
"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it."
Problem types: description: "Sensitive Data Exposure"
Affected products: vendor: n/a
product: "BigFix Compliance Server"
Published: 2022-03-04T21:18:06.000Z
CVE-2021-27757 
" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Since the information is stored in cleartext, attackers could potentially read it and gain access to sensitive information."
Problem types: description: "Sensitive Data Exposure"
Affected products: vendor: n/a
product: "BigFix Insights"
Published: 2022-03-04T18:53:06.000Z
CVE-2021-27758 
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: HCL Software
product: HCL BigFix Inventory
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
availabilityRequirement: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
confidentialityRequirement: LOW
environmentalScore: 3.5
environmentalSeverity: MEDIUM
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
integrityRequirement: LOW
modifiedAttackComplexity: LOW
modifiedAttackVector: ADJACENT_NETWORK
modifiedAvailabilityImpact: LOW
modifiedConfidentialityImpact: NONE
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: UNCHANGED
modifiedUserInteraction: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.2
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:U/RC:C/CR:L/IR:L/AR:L/MAV:A/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:L
version: 3.1
Published: 2022-05-06T18:10:27.962Z
CVE-2021-27759 
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: HCL Software
product: HCL BigFix Inventory
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
availabilityRequirement: LOW
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: LOW
environmentalScore: 1.6
environmentalSeverity: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
integrityRequirement: LOW
modifiedAttackComplexity: HIGH
modifiedAttackVector: ADJACENT_NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: LOW
modifiedScope: UNCHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 2.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C/CR:L/IR:L/AR:L/MAV:A/MAC:H/MPR:L/MUI:R/MS:U/MC:X/MI:N/MA:N
version: 3.1
Published: 2022-05-06T18:10:29.374Z
CVE-2021-27760 HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart
An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: HCL Software
product: HCL Notes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
version: 3.1
Published: 2022-05-06T18:10:30.931Z
CVE-2021-27761 HCL BigFix Platform is affected by weak web transport security
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks
Problem types: description: weak TLS
Affected products: vendor: HCL Software
product: BigFix Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-05-06T18:10:32.571Z
CVE-2021-27762 HCL BigFix Platform is affected by misconfigured security-related HTTP headers
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
Problem types: description: Missing Headers
Affected products: vendor: HCL Software
product: BigFix Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Published: 2022-05-06T18:10:33.990Z
CVE-2021-27764 HCL BigFix WebUI Cookie missing attributes
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: HCL Software
product: HCL BigFix WebUI
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2022-05-06T18:10:35.347Z
CVE-2021-27765 HCL BigFix Platform Server API is affected by Privilege Escalation Vulnerability
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: HCL Software
product: BigFix Platform
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: HCL Software would like to thank Mandiant for responsibly reporting this vulnerability.
Published: 2022-05-06T18:10:36.862Z
CVE-2021-27766 HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: HCL Software
product: BigFix Platform
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: HCL Software would like to thank Mandiant for responsibly reporting this vulnerability.
Published: 2022-05-06T18:10:38.317Z
CVE-2021-27767 HCL BigFix Platform Console is affected by a Privilege Escalation Vulnerability
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: HCL Software
product: BigFix Platform
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: HCL Software would like to thank Mandiant for responsibly reporting this vulnerability.
Published: 2022-05-06T18:10:39.858Z
CVE-2021-27768 An SSL certificate host verification vulnerability affects HCL Verse for Android
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.
Problem types: cwe_id: CWE-300
description: CWE-300 Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Affected products: vendor: HCL Software
product: Verse for Android
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-05-12T21:25:22.517Z
CVE-2021-27769 HCL Sametime is vulnerable to an information disclosure
Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible.
Problem types: cwe_id: CWE-472
description: CWE-472 External Control of Assumed-Immutable Web Parameter
Affected products: vendor: HCL Software
product: Sametime
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-05-12T21:25:24.050Z
CVE-2021-27770 HCL Sametime is vulnerable to arbitrary HTTP requests
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place.
Problem types: cwe_id: CWE-472
description: CWE-472 External Control of Assumed-Immutable Web Parameter
Affected products: vendor: HCL Software
product: Sametime
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Published: 2022-05-12T21:25:25.427Z
CVE-2021-27771 HCL Sametime is susceptible a file transfer service vulnerability
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: HCL Software
product: Sametime
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
version: 3.1
Published: 2022-05-12T21:25:27.080Z
CVE-2021-27772 HCL Sametime is vulnerable to an information disclosure
Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: HCL Software
product: Sametime
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
version: 3.1
Published: 2022-05-12T21:25:28.545Z
CVE-2021-27773 HCL Sametime is vulnerable to clickjacking
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
Problem types: cwe_id: CWE-451
description: CWE-451 User Interface (UI) Misrepresentation of Critical Information
Affected products: vendor: HCL Software
product: Sametime
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-05-12T21:25:29.915Z
CVE-2021-27774 An injection vulnerability affects HCL Digital Experience
User input included in error response, which could be used in a phishing attack.
Problem types: cwe_id: CWE-209
description: CWE-209 Information Exposure Through an Error Message
Affected products: vendor: HCL Software
product: HCL Digital Experience
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-09-22T20:20:10.000Z
CVE-2021-27777 HCL Unica Platform is vulnerable to XML External Entity (XXE) injection
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.
Problem types: cwe_id: CWE-91
description: CWE-91 XML Injection (aka Blind XPath Injection)
Affected products: vendor: HCL Software
product: HCL Unica
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-05-12T21:25:31.294Z
CVE-2021-27778 HCL Traveler is susceptible to a cross-site scripting vulnerability which could allow an attacker to execute a malicious script to access sensitive information.
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: HCL Software
product: HCL Traveler
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
version: 3.1
Published: 2022-05-31T23:50:11.060Z
CVE-2021-27779 A Security Misconfiguration vulnerability affects HCL VersionVault Express
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: HCL Software
product: HCL VersionVault Express
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-05-25T15:20:16.792Z
CVE-2021-27780 HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
Problem types: cwe_id: CWE-112
description: CWE-112 Missing XML Validation
Affected products: vendor: HCL Software
product: HCL BigFix Mobile / Modern Client Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-05-27T16:15:15.034Z
CVE-2021-27781 HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: HCL Software
product: HCL BigFix Mobile / Modern Client Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2022-05-27T16:15:16.664Z
CVE-2021-27782 HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced.
User should be locked out for multiple invalid attempts.


Problem types: description: n/a
Affected products: vendor: HCL Software
product: BigFix Mobile
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-01-19T18:54:01.027Z