CVE-2021-27779

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-311

Affected software

VendorProductVersions
HCL SoftwareHCL VersionVault Express2.0.x

References

Timeline

Published
May 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-277805.3The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-277814.8The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-277827.5HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalCVE-2021-277836.5User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-277847.5The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions anCVE-2021-277855.0HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the vicCVE-2021-277869.8Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin heCVE-2021-277886.1HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability.  By tricking a user into clicking a crafted URL, a remote unauthentiCVE-2021-277896.5The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitiCVE-2021-277907.8The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string functioCVE-2021-277915.4The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a aCVE-2021-277927.8The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properl
CVE-2021-27779: Critical severity, CVSS 9.1 | Vulnix