CVE-2022-27544

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

BigFix Web Reports authorized users may see SMTP credentials in clear text.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

VendorProductVersions
HCL SoftwareHCL BigFix9.5, 10.0

References

Timeline

Published
Jul 19, 2022
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-275455.4BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.CVE-2022-275466.1HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplCVE-2022-275477.4HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into suppCVE-2022-275485.5HCL Launch stores user credentials in plain clear text which can be read by a local user.CVE-2022-275495.5HCL Launch may store certain data for recurring activities in a plain text format.CVE-2022-275516.5HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.CVE-2022-275587.5HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes foCVE-2022-27566.5Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.CVE-2022-275606.5HCL VersionVault Express exposes administrator credentials.CVE-2022-275614.8There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).CVE-2022-275625.4Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applicaCVE-2022-275637.5An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
CVE-2022-27544: Medium severity, CVSS 6.5 | Vulnix