Hcltech
Page 4 of 5 — Hcltech CVEs from a corpus of 455, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50345 | Low | 3.7 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to… |
CVE-2023-37520 | High | 7.7 | 2023-12-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This X… |
CVE-2023-37519 | High | 7.7 | 2023-12-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server… |
CVE-2023-28025 | Medium | 6.6 | 2023-12-21 | Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate… |
CVE-2023-28022 | Low | 3.5 | 2023-12-15 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2023-28017 | Medium | 5.4 | 2023-12-07 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2023-37533 | Medium | 5.4 | 2023-11-09 | HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the brows… |
CVE-2023-37532 | Medium | 5.8 | 2023-10-23 | HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system. |
CVE-2023-37503 | High | 8.1 | 2023-10-19 | HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. |
CVE-2023-37504 | High | 7.1 | 2023-10-19 | HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is calle… |
CVE-2023-37502 | Critical | 9.0 | 2023-10-18 | HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a us… |
CVE-2023-37537 | High | 7.8 | 2023-10-17 | An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gai… |
CVE-2023-37538 | Critical | 9.3 | 2023-10-11 | HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce… |
CVE-2023-37536 | High | 8.2 | 2023-10-11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. |
CVE-2022-44758 | Medium | 6.5 | 2023-10-11 | BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly… |
CVE-2022-44757 | Medium | 6.5 | 2023-10-11 | BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive in… |
CVE-2022-42451 | Medium | 4.6 | 2023-10-11 | Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user. |
CVE-2023-28010 | Medium | 4.0 | 2023-09-08 | In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks. |
CVE-2023-37513 | Low | 3.3 | 2023-08-11 | When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. |
CVE-2023-37512 | Low | 3.3 | 2023-08-11 | When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. |
CVE-2023-37511 | Low | 3.5 | 2023-08-11 | If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved. |
CVE-2023-23342 | Medium | 6.6 | 2023-08-10 | If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented. |
CVE-2023-23347 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of s… |
CVE-2023-23346 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sen… |
CVE-2023-37501 | High | 8.1 | 2023-08-03 | A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks. |
CVE-2023-37500 | High | 8.1 | 2023-08-03 | A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and per… |
CVE-2023-37499 | High | 8.1 | 2023-08-03 | A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session a… |
CVE-2023-37498 | High | 8.1 | 2023-08-03 | A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could pot… |
CVE-2023-37497 | High | 8.1 | 2023-08-03 | The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can succes… |
CVE-2023-37496 | High | 8.3 | 2023-08-01 | HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operation… |
CVE-2023-28014 | Medium | 6.6 | 2023-07-27 | HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application. |
CVE-2023-28012 | Medium | 5.4 | 2023-07-27 | HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server. |
CVE-2023-28013 | Medium | 6.5 | 2023-07-26 | HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated at… |
CVE-2023-28023 | Medium | 4.9 | 2023-07-18 | A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access file… |
CVE-2023-28021 | Medium | 5.9 | 2023-07-18 | The BigFix WebUI uses weak cipher suites. |
CVE-2023-28020 | Medium | 4.7 | 2023-07-18 | URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header. |
CVE-2023-28019 | Medium | 5.5 | 2023-07-18 | Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query. |
CVE-2023-23344 | Low | 3.0 | 2023-06-23 | A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page. |
CVE-2023-28016 | Low | 3.1 | 2023-06-22 | Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Ba… |
CVE-2023-28006 | High | 7.0 | 2023-06-22 | The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure. |
CVE-2023-23343 | Low | 2.4 | 2023-06-22 | A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a use… |
CVE-2023-28009 | Medium | 6.5 | 2023-04-26 | HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2023-28008 | High | 7.1 | 2023-04-26 | HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex… |
CVE-2022-42447 | Critical | 9.6 | 2023-04-02 | HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into… |
CVE-2021-27788 | High | 8.3 | 2023-03-10 | HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker coul… |
CVE-2022-38657 | High | 8.2 | 2023-02-12 | An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page. |
CVE-2021-27782 | Medium | 5.4 | 2023-01-20 | HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts. |
CVE-2022-38658 | High | 7.7 | 2022-12-24 | BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. O… |
CVE-2022-38655 | Medium | 6.4 | 2022-12-21 | BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES S… |
CVE-2022-44755 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44754 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44753 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44752 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attack… |
CVE-2022-44751 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44750 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-42453 | Medium | 6.9 | 2022-12-19 | There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with… |
CVE-2022-38662 | Medium | 6.1 | 2022-12-19 | In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites. |
CVE-2022-38659 | Medium | 6.0 | 2022-12-19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent. |
CVE-2022-38653 | Low | 2.0 | 2022-12-19 | In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded. |
CVE-2022-42446 | Medium | 6.5 | 2022-12-12 | Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and… |
CVE-2022-38654 | Medium | 5.5 | 2022-11-04 | HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ig… |
CVE-2022-38660 | High | 8.3 | 2022-11-04 | HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to… |
CVE-2020-4099 | Medium | 5.9 | 2022-11-01 | The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could… |
CVE-2021-27784 | Medium | 5.9 | 2022-10-31 | The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace… |
CVE-2021-27774 | Low | 3.1 | 2022-09-22 | User input included in error response, which could be used in a phishing attack. |
CVE-2022-27561 | High | 7.5 | 2022-09-15 | There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf). |
CVE-2022-27563 | High | 7.5 | 2022-08-30 | An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service. |
CVE-2022-27560 | Medium | 6.0 | 2022-08-30 | HCL VersionVault Express exposes administrator credentials. |
CVE-2022-27558 | Medium | 5.9 | 2022-08-29 | HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could all… |
CVE-2022-27547 | Medium | 6.1 | 2022-08-29 | HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive inf… |
CVE-2022-27546 | High | 8.3 | 2022-08-29 | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POS… |
CVE-2022-27545 | Medium | 4.6 | 2022-07-19 | BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. |
CVE-2022-27544 | Medium | 5.0 | 2022-07-19 | BigFix Web Reports authorized users may see SMTP credentials in clear text. |
CVE-2021-27786 | Medium | 4.6 | 2022-06-09 | Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifie… |
CVE-2021-27778 | Medium | 4.9 | 2022-06-01 | HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler admini… |
CVE-2021-27781 | Medium | 6.6 | 2022-05-27 | The Master operator may be able to embed script tag in HTML with alert pop-up display cookie. |
CVE-2021-27780 | Medium | 5.3 | 2022-05-27 | The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment. |
CVE-2021-27783 | Medium | 6.8 | 2022-05-25 | User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed. |
CVE-2021-27779 | Critical | 9.1 | 2022-05-25 | VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server. |
CVE-2020-4107 | High | 8.8 | 2022-05-19 | HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerabil… |
CVE-2021-27777 | High | 7.5 | 2022-05-12 | XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attacke… |
CVE-2021-27773 | Medium | 4.2 | 2022-05-12 | This vulnerability allows users to execute a clickjacking attack in the meeting's chat. |
CVE-2021-27772 | High | 7.1 | 2022-05-12 | Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations… |
CVE-2021-27771 | High | 8.2 | 2022-05-12 | User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with… |
CVE-2021-27770 | Medium | 6.8 | 2022-05-12 | The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this s… |
CVE-2021-27769 | Medium | 5.3 | 2022-05-12 | Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sens… |
CVE-2021-27768 | Medium | 6.3 | 2022-05-12 | Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be i… |
CVE-2021-27767 | Medium | 6.7 | 2022-05-06 | The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pr… |
CVE-2021-27766 | Medium | 6.7 | 2022-05-06 | The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pri… |
CVE-2021-27765 | Medium | 6.7 | 2022-05-06 | The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a… |
CVE-2021-27764 | High | 7.4 | 2022-05-06 | Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) |
CVE-2021-27762 | Medium | 4.7 | 2022-05-06 | Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses |
CVE-2021-27761 | Medium | 4.8 | 2022-05-06 | Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks |
CVE-2021-27760 | Medium | 4.6 | 2022-05-06 | An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execut… |
CVE-2021-27759 | Low | 2.3 | 2022-05-06 | This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. A… |
CVE-2021-27758 | Medium | 4.3 | 2022-05-06 | There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system bloc… |
CVE-2021-27756 | High | 7.5 | 2022-03-04 | "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record… |
CVE-2021-27757 | High | 7.5 | 2022-03-04 | " Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control spher… |
CVE-2021-27755 | Medium | 5.5 | 2022-02-21 | "Sametime Android potential path traversal vulnerability when using File class" |
CVE-2021-27753 | Medium | 5.5 | 2022-02-21 | "Sametime Android PathTraversal Vulnerability" |