Hcl Software
Page 4 of 4 — Hcl Software CVEs from a corpus of 360, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42454 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged netw… |
CVE-2022-38655 | Medium | 6.4 | 2022-12-21 | BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES S… |
CVE-2022-44755 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44754 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44753 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44752 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attack… |
CVE-2022-44751 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44750 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-42453 | Medium | 6.9 | 2022-12-19 | There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with… |
CVE-2022-38662 | Medium | 6.1 | 2022-12-19 | In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites. |
CVE-2022-38659 | Medium | 6.0 | 2022-12-19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent. |
CVE-2022-38653 | Low | 2.0 | 2022-12-19 | In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded. |
CVE-2022-42446 | Medium | 6.5 | 2022-12-12 | Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and… |
CVE-2022-42445 | Medium | 4.9 | 2022-12-12 | HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for… |
CVE-2022-38661 | Medium | 6.2 | 2022-12-12 | HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash. |
CVE-2022-38656 | High | 8.6 | 2022-12-12 | HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes. |
CVE-2022-38654 | Medium | 5.5 | 2022-11-04 | HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ig… |
CVE-2022-38660 | High | 8.3 | 2022-11-04 | HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to… |
CVE-2020-4099 | Medium | 5.9 | 2022-11-01 | The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could… |
CVE-2021-27784 | Medium | 5.9 | 2022-10-31 | The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace… |
CVE-2021-27774 | Low | 3.1 | 2022-09-22 | User input included in error response, which could be used in a phishing attack. |
CVE-2022-27561 | High | 7.5 | 2022-09-15 | There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf). |
CVE-2022-27563 | High | 7.5 | 2022-08-30 | An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service. |
CVE-2022-27560 | Medium | 6.0 | 2022-08-30 | HCL VersionVault Express exposes administrator credentials. |
CVE-2022-27558 | Medium | 5.9 | 2022-08-29 | HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could all… |
CVE-2022-27547 | Medium | 6.1 | 2022-08-29 | HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive inf… |
CVE-2022-27546 | High | 8.3 | 2022-08-29 | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POS… |
CVE-2022-27551 | Medium | 5.3 | 2022-08-03 | HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. |
CVE-2021-27785 | Low | 3.9 | 2022-07-30 | HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perfor… |
CVE-2022-27545 | Medium | 4.6 | 2022-07-19 | BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. |
CVE-2022-27544 | Medium | 5.0 | 2022-07-19 | BigFix Web Reports authorized users may see SMTP credentials in clear text. |
CVE-2022-27549 | Medium | 4.0 | 2022-07-06 | HCL Launch may store certain data for recurring activities in a plain text format. |
CVE-2022-27548 | Medium | 4.9 | 2022-07-06 | HCL Launch stores user credentials in plain clear text which can be read by a local user. |
CVE-2021-27786 | Medium | 4.6 | 2022-06-09 | Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifie… |
CVE-2021-27778 | Medium | 4.9 | 2022-06-01 | HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler admini… |
CVE-2021-27781 | Medium | 6.6 | 2022-05-27 | The Master operator may be able to embed script tag in HTML with alert pop-up display cookie. |
CVE-2021-27780 | Medium | 5.3 | 2022-05-27 | The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment. |
CVE-2021-27783 | Medium | 6.8 | 2022-05-25 | User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed. |
CVE-2021-27779 | Critical | 9.1 | 2022-05-25 | VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server. |
CVE-2020-4107 | High | 8.8 | 2022-05-19 | HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerabil… |
CVE-2021-27777 | High | 7.5 | 2022-05-12 | XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attacke… |
CVE-2021-27773 | Medium | 4.2 | 2022-05-12 | This vulnerability allows users to execute a clickjacking attack in the meeting's chat. |
CVE-2021-27772 | High | 7.1 | 2022-05-12 | Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations… |
CVE-2021-27771 | High | 8.2 | 2022-05-12 | User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with… |
CVE-2021-27770 | Medium | 6.8 | 2022-05-12 | The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this s… |
CVE-2021-27769 | Medium | 5.3 | 2022-05-12 | Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sens… |
CVE-2021-27768 | Medium | 6.3 | 2022-05-12 | Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be i… |
CVE-2021-27767 | Medium | 6.7 | 2022-05-06 | The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pr… |
CVE-2021-27766 | Medium | 6.7 | 2022-05-06 | The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pri… |
CVE-2021-27765 | Medium | 6.7 | 2022-05-06 | The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a… |
CVE-2021-27764 | High | 7.4 | 2022-05-06 | Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) |
CVE-2021-27762 | Medium | 4.7 | 2022-05-06 | Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses |
CVE-2021-27761 | Medium | 4.8 | 2022-05-06 | Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks |
CVE-2021-27760 | Medium | 4.6 | 2022-05-06 | An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execut… |
CVE-2021-27759 | Low | 2.3 | 2022-05-06 | This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. A… |
CVE-2021-27758 | Medium | 4.3 | 2022-05-06 | There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system bloc… |
CVE-2021-27751 | Medium | 4.4 | 2022-05-06 | HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are st… |
CVE-2020-4084 | Medium | 5.4 | 2020-03-09 | HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2020-4083 | Medium | 5.5 | 2020-03-05 | HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user. |
CVE-2020-4082 | Medium | 5.4 | 2020-03-05 | The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploi… |