CVE-2021-27762

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-277646.5Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flaCVE-2021-277657.8The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a locaCVE-2021-277667.8The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local usCVE-2021-277677.8The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local uCVE-2021-277685.9Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account informatiCVE-2021-277695.3Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information mayCVE-2021-277708.8The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserveCVE-2021-277717.6User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in aCVE-2021-277726.5Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start gCVE-2021-277734.3This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-277745.4User input included in error response, which could be used in a phishing attack.CVE-2021-277777.5XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient
CVE-2021-27762: Critical severity, CVSS 9.8 | Vulnix