CVE-2021-27760

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
HCL Software	HCL Notes	11.0 - 11.0.1 FP4

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670Third Party Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670Third Party Advisory

Timeline

Published: May 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277617.5Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks CVE-2021-277629.8Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses CVE-2021-277646.5Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing fla CVE-2021-277657.8The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a loca CVE-2021-277667.8The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local us CVE-2021-277677.8The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local u CVE-2021-277685.9Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account informati CVE-2021-277695.3Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may CVE-2021-277708.8The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserve CVE-2021-277717.6User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a CVE-2021-277726.5Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start g CVE-2021-277734.3This vulnerability allows users to execute a clickjacking attack in the meeting's chat.