Hcltech
Page 3 of 5 — Hcltech CVEs from a corpus of 455, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37516 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits user directory information to be cached. |
CVE-2022-44760 | Medium | 4.6 | 2025-04-24 | Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. |
CVE-2022-44759 | Medium | 4.6 | 2025-04-24 | Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications. |
CVE-2024-30147 | Medium | 6.5 | 2025-04-24 | Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications. |
CVE-2024-30114 | Low | 3.7 | 2025-04-24 | Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment. |
CVE-2024-30113 | Medium | 6.3 | 2025-04-24 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. |
CVE-2023-45720 | Medium | 5.3 | 2025-04-24 | Insufficient default configuration in HCL Leap allows anonymous access to directory information. |
CVE-2023-37534 | High | 7.1 | 2025-04-24 | Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters. |
CVE-2024-30148 | Medium | 4.1 | 2025-04-24 | Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2024-42178 | Low | 2.5 | 2025-04-17 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential… |
CVE-2024-42177 | Low | 2.6 | 2025-04-17 | HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept a… |
CVE-2024-42193 | High | 8.1 | 2025-04-15 | HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibi… |
CVE-2024-42200 | Medium | 5.4 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input. |
CVE-2024-42189 | Medium | 6.5 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. |
CVE-2024-42208 | Low | 3.5 | 2025-04-04 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2025-0279 | Medium | 4.3 | 2025-04-03 | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, c… |
CVE-2025-0278 | Medium | 4.3 | 2025-04-03 | HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messa… |
CVE-2024-30155 | Medium | 5.5 | 2025-03-26 | HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values vi… |
CVE-2024-42176 | Low | 2.6 | 2025-03-19 | HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a singl… |
CVE-2024-30154 | Medium | 5.3 | 2025-03-03 | HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a… |
CVE-2024-30150 | Medium | 5.3 | 2025-02-25 | HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potenti… |
CVE-2024-23563 | Low | 3.9 | 2025-02-12 | HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2024-42207 | Medium | 5.5 | 2025-02-05 | HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session. |
CVE-2024-22349 | Medium | 4.0 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the syste… |
CVE-2024-22348 | Medium | 5.3 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out… |
CVE-2024-22347 | Medium | 5.9 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to d… |
CVE-2024-42181 | Low | 1.6 | 2025-01-12 | HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data i… |
CVE-2024-42180 | Low | 1.6 | 2025-01-12 | HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double e… |
CVE-2024-42179 | Low | 2.0 | 2025-01-12 | HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 as the server's name… |
CVE-2024-42175 | Low | 2.6 | 2025-01-11 | HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can le… |
CVE-2024-42174 | Low | 3.7 | 2025-01-11 | HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore comp… |
CVE-2024-42173 | Medium | 4.8 | 2025-01-11 | HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to… |
CVE-2024-42172 | Medium | 5.3 | 2025-01-11 | HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity th… |
CVE-2024-42171 | Medium | 6.4 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42170 | Medium | 6.8 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42169 | High | 7.1 | 2025-01-11 | HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be… |
CVE-2024-42168 | High | 8.9 | 2025-01-11 | HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then ind… |
CVE-2024-42188 | Low | 3.7 | 2024-11-14 | HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios. |
CVE-2024-30133 | Medium | 5.3 | 2024-11-12 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during… |
CVE-2024-30142 | Low | 3.8 | 2024-11-07 | HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting… |
CVE-2024-30141 | Medium | 4.7 | 2024-11-07 | HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement infor… |
CVE-2024-30140 | Medium | 5.4 | 2024-11-07 | HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the… |
CVE-2024-30149 | Medium | 4.8 | 2024-10-31 | HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable. |
CVE-2024-30106 | Low | 3.5 | 2024-10-28 | HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain… |
CVE-2023-50355 | Low | 3.6 | 2024-10-23 | HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack. |
CVE-2024-30124 | Medium | 4.0 | 2024-10-23 | HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol… |
CVE-2024-30122 | Medium | 5.8 | 2024-10-23 | HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This w… |
CVE-2024-30117 | Low | 2.5 | 2024-10-14 | A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances. |
CVE-2024-30118 | Low | 3.5 | 2024-10-09 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to beca… |
CVE-2024-30132 | Low | 3.7 | 2024-10-01 | HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspeci… |
CVE-2024-23586 | Medium | 5.3 | 2024-09-27 | HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old sessi… |
CVE-2024-30134 | Medium | 6.7 | 2024-09-26 | The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application. |
CVE-2024-30128 | High | 8.6 | 2024-09-25 | HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may… |
CVE-2024-30130 | Low | 3.7 | 2024-07-19 | HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sens… |
CVE-2024-30126 | Medium | 4.7 | 2024-07-18 | HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target web… |
CVE-2024-30125 | Medium | 6.2 | 2024-07-18 | HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die. |
CVE-2024-23562 | Medium | 5.3 | 2024-07-08 | A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vul… |
CVE-2024-23588 | Medium | 5.3 | 2024-07-05 | HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability. |
CVE-2024-30135 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken. |
CVE-2024-30111 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due… |
CVE-2024-30110 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system… |
CVE-2024-30109 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick… |
CVE-2024-30112 | Medium | 5.4 | 2024-06-25 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2023-37541 | Low | 3.5 | 2024-06-25 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2023-37539 | High | 8.4 | 2024-06-06 | The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog… |
CVE-2024-23556 | Medium | 5.9 | 2024-05-18 | SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability. |
CVE-2024-23554 | Medium | 5.7 | 2024-05-18 | Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE). |
CVE-2024-23583 | Medium | 6.7 | 2024-05-17 | An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems. |
CVE-2024-30107 | Low | 3.5 | 2024-04-18 | HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios. |
CVE-2024-23557 | Low | 3.5 | 2024-04-18 | HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possi… |
CVE-2023-50347 | Low | 3.7 | 2024-04-10 | HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malic… |
CVE-2023-45715 | Low | 3.5 | 2024-03-28 | The console may experience a service interruption when processing file names with invalid characters. |
CVE-2023-45706 | Low | 2.0 | 2024-03-28 | An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration. |
CVE-2023-45705 | Low | 3.5 | 2024-03-28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. |
CVE-2023-37531 | Low | 3.3 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37530 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37529 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37495 | Medium | 5.9 | 2024-02-29 | Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administ… |
CVE-2023-37540 | Low | 3.9 | 2024-02-23 | Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to… |
CVE-2023-28018 | Medium | 5.5 | 2024-02-12 | HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request an attacker could ex… |
CVE-2023-45698 | Medium | 4.8 | 2024-02-10 | Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect user… |
CVE-2023-45696 | Medium | 4.0 | 2024-02-10 | Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2023-45716 | Low | 1.7 | 2024-02-09 | Sametime is impacted by sensitive information passed in URL. |
CVE-2023-50349 | Medium | 5.9 | 2024-02-09 | Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform m… |
CVE-2023-37528 | Medium | 6.5 | 2024-02-03 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter… |
CVE-2024-23553 | Low | 3.0 | 2024-02-02 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. |
CVE-2023-37527 | Medium | 5.4 | 2024-02-02 | A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious ja… |
CVE-2023-37518 | Medium | 6.4 | 2024-01-30 | HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of… |
CVE-2023-50344 | Medium | 5.4 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files. |
CVE-2023-50343 | High | 8.3 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users t… |
CVE-2023-50342 | High | 7.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a resul… |
CVE-2023-50341 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Mi… |
CVE-2023-45724 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requir… |
CVE-2023-45723 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (… |
CVE-2023-45722 | High | 8.8 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended t… |
CVE-2023-50351 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity o… |
CVE-2023-50350 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive in… |
CVE-2023-50348 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker wit… |
CVE-2023-50346 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information. |