Hcl Software
Page 3 of 4 — Hcl Software CVEs from a corpus of 360, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37526 | Medium | 6.5 | 2024-05-14 | HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which co… |
CVE-2024-23551 | Medium | 6.5 | 2024-05-07 | Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a… |
CVE-2024-30107 | Low | 3.5 | 2024-04-18 | HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios. |
CVE-2024-23557 | Low | 3.5 | 2024-04-18 | HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possi… |
CVE-2024-23561 | Medium | 4.3 | 2024-04-15 | HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values. |
CVE-2024-23558 | Medium | 6.3 | 2024-04-15 | HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. |
CVE-2024-23560 | Medium | 4.4 | 2024-04-15 | HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. |
CVE-2024-23559 | Medium | 6.1 | 2024-04-15 | HCL DevOps Deploy / Launch is generating an obsolete HTTP header. |
CVE-2023-50347 | Low | 3.7 | 2024-04-10 | HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malic… |
CVE-2024-23584 | Medium | 6.6 | 2024-04-08 | The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry. |
CVE-2024-23540 | Medium | 5.3 | 2024-04-03 | The HCL BigFix Inventory server is vulnerable to path traversal which enables an attacker to read internal application files from the Inventory server. The Big… |
CVE-2023-45715 | Low | 3.5 | 2024-03-28 | The console may experience a service interruption when processing file names with invalid characters. |
CVE-2023-45706 | Low | 2.0 | 2024-03-28 | An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration. |
CVE-2023-45705 | Low | 3.5 | 2024-03-28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. |
CVE-2023-37531 | Low | 3.3 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37530 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37529 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37495 | Medium | 5.9 | 2024-02-29 | Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administ… |
CVE-2023-37540 | Low | 3.9 | 2024-02-23 | Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to… |
CVE-2023-28018 | Medium | 5.5 | 2024-02-12 | HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request an attacker could ex… |
CVE-2023-45698 | Medium | 4.8 | 2024-02-10 | Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect user… |
CVE-2023-45696 | Medium | 4.0 | 2024-02-10 | Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2023-45716 | Low | 1.7 | 2024-02-09 | Sametime is impacted by sensitive information passed in URL. |
CVE-2023-50349 | Medium | 5.9 | 2024-02-09 | Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform m… |
CVE-2024-23550 | Medium | 6.2 | 2024-02-03 | HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent. |
CVE-2023-37528 | Medium | 6.5 | 2024-02-03 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter… |
CVE-2024-23553 | Low | 3.0 | 2024-02-02 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. |
CVE-2023-37527 | Medium | 5.4 | 2024-02-02 | A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious ja… |
CVE-2023-37518 | Medium | 6.4 | 2024-01-30 | HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of… |
CVE-2023-37523 | Medium | 5.6 | 2024-01-16 | Missing or insecure tags in the HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower could allow an attacker to execute a malicious script on the use… |
CVE-2023-37522 | Medium | 5.6 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower has missing or insecure tags that could allow an attacker to execute a malicious script on the u… |
CVE-2023-37521 | Low | 2.3 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to e… |
CVE-2023-50344 | Medium | 5.4 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files. |
CVE-2023-50343 | High | 8.3 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users t… |
CVE-2023-50342 | High | 7.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a resul… |
CVE-2023-50341 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Mi… |
CVE-2023-45724 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requir… |
CVE-2023-45723 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (… |
CVE-2023-45722 | High | 8.8 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended t… |
CVE-2023-50351 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity o… |
CVE-2023-50350 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive in… |
CVE-2023-50348 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker wit… |
CVE-2023-50346 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information. |
CVE-2023-50345 | Low | 3.7 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to… |
CVE-2023-45702 | Medium | 6.2 | 2023-12-28 | An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.. |
CVE-2023-45701 | Medium | 4.3 | 2023-12-28 | HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information c… |
CVE-2023-37520 | High | 7.7 | 2023-12-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This X… |
CVE-2023-37519 | High | 7.7 | 2023-12-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server… |
CVE-2023-45700 | Medium | 4.3 | 2023-12-21 | HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive inf… |
CVE-2023-28025 | Medium | 6.6 | 2023-12-21 | Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate… |
CVE-2023-45703 | Medium | 5.3 | 2023-12-21 | HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. |
CVE-2023-28022 | Low | 3.5 | 2023-12-15 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2023-28017 | Medium | 5.4 | 2023-12-07 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2023-37533 | Medium | 5.4 | 2023-11-09 | HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the brows… |
CVE-2023-37532 | Medium | 5.8 | 2023-10-23 | HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system. |
CVE-2023-37503 | High | 8.1 | 2023-10-19 | HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. |
CVE-2023-37504 | High | 7.1 | 2023-10-19 | HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is calle… |
CVE-2023-37502 | Critical | 9.0 | 2023-10-18 | HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a us… |
CVE-2023-37537 | High | 7.8 | 2023-10-17 | An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gai… |
CVE-2023-37538 | Critical | 9.3 | 2023-10-11 | HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce… |
CVE-2023-37536 | High | 8.2 | 2023-10-11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. |
CVE-2022-44758 | Medium | 6.5 | 2023-10-11 | BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly… |
CVE-2022-44757 | Medium | 6.5 | 2023-10-11 | BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive in… |
CVE-2022-42451 | Medium | 4.6 | 2023-10-11 | Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user. |
CVE-2023-28010 | Medium | 4.0 | 2023-09-08 | In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks. |
CVE-2023-37513 | Low | 3.3 | 2023-08-11 | When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. |
CVE-2023-37512 | Low | 3.3 | 2023-08-11 | When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. |
CVE-2023-37511 | Low | 3.5 | 2023-08-11 | If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved. |
CVE-2023-23342 | Medium | 6.6 | 2023-08-10 | If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented. |
CVE-2023-23347 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of s… |
CVE-2023-23346 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sen… |
CVE-2023-37501 | High | 8.1 | 2023-08-03 | A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks. |
CVE-2023-37500 | High | 8.1 | 2023-08-03 | A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and per… |
CVE-2023-37499 | High | 8.1 | 2023-08-03 | A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session a… |
CVE-2023-37498 | High | 8.1 | 2023-08-03 | A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could pot… |
CVE-2023-37497 | High | 8.1 | 2023-08-03 | The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can succes… |
CVE-2023-37496 | High | 8.3 | 2023-08-01 | HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operation… |
CVE-2023-28014 | Medium | 6.6 | 2023-07-27 | HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application. |
CVE-2023-28012 | Medium | 5.4 | 2023-07-27 | HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server. |
CVE-2023-28013 | Medium | 6.5 | 2023-07-26 | HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated at… |
CVE-2023-28023 | Medium | 4.9 | 2023-07-18 | A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access file… |
CVE-2023-28021 | Medium | 5.9 | 2023-07-18 | The BigFix WebUI uses weak cipher suites. |
CVE-2023-28020 | Medium | 4.7 | 2023-07-18 | URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header. |
CVE-2023-28019 | Medium | 5.5 | 2023-07-18 | Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query. |
CVE-2023-23348 | Medium | 5.1 | 2023-07-10 | HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed. |
CVE-2023-23344 | Low | 3.0 | 2023-06-23 | A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page. |
CVE-2023-28016 | Low | 3.1 | 2023-06-22 | Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Ba… |
CVE-2023-28006 | High | 7.0 | 2023-06-22 | The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure. |
CVE-2023-23343 | Low | 2.4 | 2023-06-22 | A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a use… |
CVE-2023-28015 | Medium | 5.3 | 2023-05-23 | The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages cou… |
CVE-2023-28009 | Medium | 6.5 | 2023-04-26 | HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2023-28008 | High | 7.1 | 2023-04-26 | HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex… |
CVE-2022-42452 | Medium | 4.6 | 2023-04-02 | HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Re… |
CVE-2022-42447 | Critical | 9.6 | 2023-04-02 | HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into… |
CVE-2021-27788 | High | 8.3 | 2023-03-10 | HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker coul… |
CVE-2022-38657 | High | 8.2 | 2023-02-12 | An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page. |
CVE-2021-27782 | Medium | 5.4 | 2023-01-20 | HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts. |
CVE-2022-38658 | High | 7.7 | 2022-12-24 | BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. O… |
CVE-2022-44756 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged ac… |