CVE-2021-27764

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-614 CWE-311 CWE-732

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277657.8The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a loca CVE-2021-277667.8The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local us CVE-2021-277677.8The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local u CVE-2021-277685.9Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account informati CVE-2021-277695.3Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may CVE-2021-277708.8The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserve CVE-2021-277717.6User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a CVE-2021-277726.5Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start g CVE-2021-277734.3This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-277745.4User input included in error response, which could be used in a phishing attack.CVE-2021-277777.5XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient CVE-2021-277784.8HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in