Hcl Software
Page 2 of 4 — Hcl Software CVEs from a corpus of 360, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42212 | Medium | 5.4 | 2025-05-05 | HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious… |
CVE-2024-30146 | Medium | 4.1 | 2025-04-30 | Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2024-30145 | Medium | 6.5 | 2025-04-30 | Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications. |
CVE-2024-30115 | Medium | 6.3 | 2025-04-30 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. |
CVE-2023-45721 | Medium | 5.3 | 2025-04-30 | Insufficient default configuration in HCL Leap allows anonymous access to directory information. |
CVE-2023-37535 | High | 7.1 | 2025-04-30 | Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters. |
CVE-2023-37517 | Low | 3.2 | 2025-04-30 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. |
CVE-2022-42450 | Medium | 4.6 | 2025-04-30 | Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications. |
CVE-2022-42449 | Medium | 4.6 | 2025-04-30 | Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications |
CVE-2022-27562 | Medium | 4.6 | 2025-04-30 | Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. |
CVE-2024-30152 | Medium | 6.5 | 2025-04-25 | HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify dat… |
CVE-2024-30127 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. |
CVE-2023-37516 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits user directory information to be cached. |
CVE-2022-44760 | Medium | 4.6 | 2025-04-24 | Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. |
CVE-2022-44759 | Medium | 4.6 | 2025-04-24 | Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications. |
CVE-2024-30147 | Medium | 6.5 | 2025-04-24 | Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications. |
CVE-2024-30114 | Low | 3.7 | 2025-04-24 | Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment. |
CVE-2024-30113 | Medium | 6.3 | 2025-04-24 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. |
CVE-2023-45720 | Medium | 5.3 | 2025-04-24 | Insufficient default configuration in HCL Leap allows anonymous access to directory information. |
CVE-2023-37534 | High | 7.1 | 2025-04-24 | Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters. |
CVE-2024-30148 | Medium | 4.1 | 2025-04-24 | Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2024-42178 | Low | 2.5 | 2025-04-17 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential… |
CVE-2024-42177 | Low | 2.6 | 2025-04-17 | HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept a… |
CVE-2024-42193 | High | 8.1 | 2025-04-15 | HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibi… |
CVE-2024-42200 | Medium | 5.4 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input. |
CVE-2024-42189 | Medium | 6.5 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. |
CVE-2024-42208 | Low | 3.5 | 2025-04-04 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2025-0279 | Medium | 4.3 | 2025-04-03 | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, c… |
CVE-2025-0278 | Medium | 4.3 | 2025-04-03 | HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messa… |
CVE-2025-0272 | Medium | 5.4 | 2025-04-03 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2025-0257 | Medium | 6.3 | 2025-04-02 | HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its A… |
CVE-2025-0273 | Medium | 5.5 | 2025-03-27 | HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user. |
CVE-2024-30155 | Medium | 5.5 | 2025-03-26 | HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values vi… |
CVE-2025-0255 | High | 7.2 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted… |
CVE-2025-0256 | Medium | 4.3 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization f… |
CVE-2025-0254 | Medium | 5.9 | 2025-03-20 | HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept… |
CVE-2024-42176 | Low | 2.6 | 2025-03-19 | HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a singl… |
CVE-2024-30143 | Medium | 4.3 | 2025-03-13 | HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the… |
CVE-2024-30154 | Medium | 5.3 | 2025-03-03 | HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a… |
CVE-2024-30150 | Medium | 5.3 | 2025-02-25 | HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potenti… |
CVE-2024-23563 | Low | 3.9 | 2025-02-12 | HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2024-42207 | Medium | 5.5 | 2025-02-05 | HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session. |
CVE-2024-42187 | Medium | 5.3 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository w… |
CVE-2024-42186 | Low | 2.8 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation. |
CVE-2024-42185 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vuln… |
CVE-2024-42184 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using th… |
CVE-2024-42183 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary… |
CVE-2024-42182 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download files from an intern… |
CVE-2024-42181 | Low | 1.6 | 2025-01-12 | HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data i… |
CVE-2024-42180 | Low | 1.6 | 2025-01-12 | HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double e… |
CVE-2024-42179 | Low | 2.0 | 2025-01-12 | HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 as the server's name… |
CVE-2024-42175 | Low | 2.6 | 2025-01-11 | HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can le… |
CVE-2024-42174 | Low | 3.7 | 2025-01-11 | HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore comp… |
CVE-2024-42173 | Medium | 4.8 | 2025-01-11 | HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to… |
CVE-2024-42172 | Medium | 5.3 | 2025-01-11 | HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity th… |
CVE-2024-42171 | Medium | 6.4 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42170 | Medium | 6.8 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42169 | High | 7.1 | 2025-01-11 | HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be… |
CVE-2024-42168 | High | 8.9 | 2025-01-11 | HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then ind… |
CVE-2024-42194 | Low | 3.1 | 2024-12-17 | An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly ch… |
CVE-2024-30129 | Medium | 5.3 | 2024-12-06 | The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be se… |
CVE-2024-42196 | Medium | 6.2 | 2024-12-06 | HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs. |
CVE-2024-42195 | Low | 3.1 | 2024-12-05 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2024-42188 | Low | 3.7 | 2024-11-14 | HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios. |
CVE-2024-30133 | Medium | 5.3 | 2024-11-12 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during… |
CVE-2024-30142 | Low | 3.8 | 2024-11-07 | HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting… |
CVE-2024-30141 | Medium | 4.7 | 2024-11-07 | HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement infor… |
CVE-2024-30140 | Medium | 5.4 | 2024-11-07 | HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the… |
CVE-2024-30149 | Medium | 4.8 | 2024-10-31 | HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable. |
CVE-2024-30106 | Low | 3.5 | 2024-10-28 | HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain… |
CVE-2023-50355 | Low | 3.6 | 2024-10-23 | HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack. |
CVE-2024-30124 | Medium | 4.0 | 2024-10-23 | HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol… |
CVE-2024-30122 | Medium | 5.8 | 2024-10-23 | HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This w… |
CVE-2024-30117 | Low | 2.5 | 2024-10-14 | A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances. |
CVE-2024-30118 | Low | 3.5 | 2024-10-09 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to beca… |
CVE-2024-30132 | Low | 3.7 | 2024-10-01 | HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspeci… |
CVE-2024-23586 | Medium | 5.3 | 2024-09-27 | HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old sessi… |
CVE-2024-30134 | Medium | 6.7 | 2024-09-26 | The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application. |
CVE-2024-30128 | High | 8.6 | 2024-09-25 | HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may… |
CVE-2024-30130 | Low | 3.7 | 2024-07-19 | HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sens… |
CVE-2024-30126 | Medium | 4.7 | 2024-07-18 | HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target web… |
CVE-2024-30125 | Medium | 6.2 | 2024-07-18 | HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die. |
CVE-2024-23562 | Medium | 5.3 | 2024-07-08 | A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vul… |
CVE-2024-23588 | Medium | 5.3 | 2024-07-05 | HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability. |
CVE-2024-30135 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken. |
CVE-2024-30111 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due… |
CVE-2024-30110 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system… |
CVE-2024-30109 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick… |
CVE-2024-30112 | Medium | 5.4 | 2024-06-25 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2023-37541 | Low | 3.5 | 2024-06-25 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2024-30120 | Low | 2.9 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application. |
CVE-2024-30119 | Low | 3.7 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data durin… |
CVE-2023-45707 | Medium | 4.4 | 2024-06-08 | HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to crede… |
CVE-2023-37539 | High | 8.4 | 2024-06-06 | The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog… |
CVE-2024-23580 | Medium | 6.5 | 2024-05-28 | HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access to the database to r… |
CVE-2024-23579 | Medium | 6.5 | 2024-05-28 | HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover… |
CVE-2024-23556 | Medium | 5.9 | 2024-05-18 | SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability. |
CVE-2024-23554 | Medium | 5.7 | 2024-05-18 | Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE). |
CVE-2024-23583 | Medium | 6.7 | 2024-05-17 | An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems. |
CVE-2024-23576 | High | 7.1 | 2024-05-14 | Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized admini… |