CVE-2021-27756

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it."

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Mar 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-277577.5" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to anCVE-2021-277586.5There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to loCVE-2021-277596.5This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was seCVE-2021-277605.5An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could causeCVE-2021-277617.5Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacksCVE-2021-277629.8Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responsesCVE-2021-277646.5Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flaCVE-2021-277657.8The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a locaCVE-2021-277667.8The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local usCVE-2021-277677.8The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local uCVE-2021-277685.9Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account informatiCVE-2021-277695.3Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may