Filtered by vendor Hcltech
Subscribe
Search
Total
68 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-50346 | 1 Hcltech | 1 Dryice Myxalytics | 2024-01-09 | N/A | 4.3 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information. | |||||
| CVE-2023-50345 | 1 Hcltech | 1 Dryice Myxalytics | 2024-01-09 | N/A | 6.1 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats. | |||||
| CVE-2023-50348 | 1 Hcltech | 1 Dryice Myxalytics | 2024-01-09 | N/A | 5.3 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker with insight into the application, system, etc. | |||||
| CVE-2023-50342 | 1 Hcltech | 1 Dryice Myxalytics | 2024-01-09 | N/A | 4.3 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a result of improper access control. | |||||
| CVE-2023-50343 | 1 Hcltech | 1 Dryice Myxalytics | 2024-01-09 | N/A | 6.5 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users. | |||||
| CVE-2023-50344 | 1 Hcltech | 1 Dryice Myxalytics | 2024-01-09 | N/A | 5.4 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files. | |||||
| CVE-2023-37520 | 1 Hcltech | 1 Bigfix Platform | 2023-12-29 | N/A | 6.1 MEDIUM |
| Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay. | |||||
| CVE-2023-37519 | 1 Hcltech | 1 Bigfix Platform | 2023-12-29 | N/A | 6.1 MEDIUM |
| Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server. | |||||
| CVE-2023-28025 | 1 Hcltech | 1 Bigfix Modern Client Management | 2023-12-29 | N/A | 4.8 MEDIUM |
| Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage. | |||||
| CVE-2023-28022 | 1 Hcltech | 1 Connections | 2023-12-20 | N/A | 6.5 MEDIUM |
| HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data. | |||||
| CVE-2023-28017 | 1 Hcltech | 1 Connections | 2023-12-12 | N/A | 5.4 MEDIUM |
| HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks. | |||||
| CVE-2023-37533 | 1 Hcltech | 1 Connections | 2023-11-16 | N/A | 6.1 MEDIUM |
| HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks. | |||||
| CVE-2023-37511 | 1 Hcltech | 1 Traveler To Do | 2023-08-17 | N/A | 4.3 MEDIUM |
| If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved. | |||||
| CVE-2023-37513 | 1 Hcltech | 1 Traveler To Do | 2023-08-17 | N/A | 5.5 MEDIUM |
| When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. | |||||
| CVE-2023-37512 | 1 Hcltech | 1 Traveler Companion | 2023-08-17 | N/A | 5.5 MEDIUM |
| When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. | |||||
| CVE-2023-37499 | 1 Hcltech | 1 Unica | 2023-08-07 | N/A | 6.1 MEDIUM |
| A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks. | |||||
| CVE-2023-37501 | 1 Hcltech | 1 Unica | 2023-08-07 | N/A | 6.1 MEDIUM |
| A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks. | |||||
| CVE-2023-37500 | 1 Hcltech | 1 Unica | 2023-08-07 | N/A | 6.1 MEDIUM |
| A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks. | |||||
| CVE-2023-37496 | 1 Hcltech | 1 Verse | 2023-08-04 | N/A | 5.4 MEDIUM |
| HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information. | |||||
| CVE-2023-28023 | 1 Hcltech | 1 Bigfix Webui | 2023-08-01 | N/A | 6.5 MEDIUM |
| A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network). | |||||
| CVE-2023-28020 | 1 Hcltech | 1 Bigfix Webui | 2023-07-27 | N/A | 6.1 MEDIUM |
| URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header. | |||||
| CVE-2021-27769 | 1 Hcltech | 1 Sametime | 2022-07-29 | 5.0 MEDIUM | 5.3 MEDIUM |
| Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible. | |||||
| CVE-2021-27760 | 1 Hcltech | 1 Hcl Inotes | 2022-07-29 | 6.0 MEDIUM | 5.5 MEDIUM |
| An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code. | |||||
| CVE-2021-27772 | 1 Hcltech | 1 Sametime | 2022-07-29 | 4.0 MEDIUM | 6.5 MEDIUM |
| Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge. | |||||
| CVE-2022-27544 | 1 Hcltech | 1 Bigfix Platform | 2022-07-27 | N/A | 6.5 MEDIUM |
| BigFix Web Reports authorized users may see SMTP credentials in clear text. | |||||
| CVE-2022-27545 | 1 Hcltech | 1 Bigfix Platform | 2022-07-27 | N/A | 5.4 MEDIUM |
| BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. | |||||
| CVE-2021-27778 | 1 Hcltech | 1 Traveler | 2022-06-08 | 3.5 LOW | 4.8 MEDIUM |
| HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. | |||||
| CVE-2021-27781 | 1 Hcltech | 2 Bigfix Mobile, Modern Client Management | 2022-06-08 | 3.5 LOW | 4.8 MEDIUM |
| The Master operator may be able to embed script tag in HTML with alert pop-up display cookie. | |||||
| CVE-2021-27780 | 1 Hcltech | 2 Bigfix Mobile, Modern Client Management | 2022-06-08 | 5.0 MEDIUM | 5.3 MEDIUM |
| The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment. | |||||
| CVE-2021-27783 | 1 Hcltech | 2 Bigfix Mobile, Bigfix Modern Client Management | 2022-06-07 | 4.0 MEDIUM | 6.5 MEDIUM |
| User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed. | |||||
| CVE-2021-27773 | 1 Hcltech | 1 Sametime | 2022-05-24 | 4.3 MEDIUM | 4.3 MEDIUM |
| This vulnerability allows users to execute a clickjacking attack in the meeting's chat. | |||||
| CVE-2021-27768 | 1 Hcltech | 1 Verse | 2022-05-24 | 4.3 MEDIUM | 5.9 MEDIUM |
| Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login. | |||||
| CVE-2021-27764 | 1 Hcltech | 1 Bigfix Webui | 2022-05-18 | 4.3 MEDIUM | 6.5 MEDIUM |
| Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) | |||||
| CVE-2021-27759 | 1 Hcltech | 1 Bigfix Inventory | 2022-05-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application. | |||||
| CVE-2021-27758 | 1 Hcltech | 1 Bigfix Inventory | 2022-05-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account. | |||||
| CVE-2020-4128 | 1 Hcltech | 1 Domino | 2021-07-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the ID Vault service. | |||||
| CVE-2020-14270 | 1 Hcltech | 1 Domino | 2021-07-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server. | |||||
| CVE-2020-4089 | 1 Hcltech | 1 Notes | 2021-07-21 | 4.3 MEDIUM | 6.5 MEDIUM |
| HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected. | |||||
| CVE-2020-4126 | 1 Hcltech | 1 Hcl Inotes | 2021-07-21 | 4.3 MEDIUM | 5.9 MEDIUM |
| HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later. | |||||
| CVE-2020-14221 | 1 Hcltech | 1 Digital Experience | 2021-07-21 | 4.0 MEDIUM | 4.9 MEDIUM |
| HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users. | |||||
| CVE-2020-4095 | 1 Hcltech | 1 Bigfix Platform | 2021-07-21 | 2.1 LOW | 6.0 MEDIUM |
| "BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access." | |||||
| CVE-2020-4085 | 1 Hcltech | 1 Connections | 2021-07-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| "HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user." | |||||
| CVE-2020-4081 | 1 Hcltech | 1 Digital Experience | 2021-02-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS). | |||||
| CVE-2020-14225 | 2 Hcltech, Hcltechsw | 2 Hcl Inotes, Hcl Inotes | 2020-12-23 | 4.3 MEDIUM | 6.5 MEDIUM |
| HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack. | |||||
| CVE-2020-14248 | 1 Hcltech | 1 Bigfix Platform | 2020-12-23 | 5.0 MEDIUM | 5.3 MEDIUM |
| BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. | |||||
| CVE-2020-4080 | 1 Hcltech | 1 Domino | 2020-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. | |||||
| CVE-2020-14271 | 1 Hcltech | 1 Hcl Inotes | 2020-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. | |||||
| CVE-2020-4102 | 1 Hcltech | 1 Notes | 2020-12-04 | 7.2 HIGH | 6.7 MEDIUM |
| HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Notes or execute attacker-controlled code on the client system. | |||||
| CVE-2020-4127 | 1 Hcltech | 1 Hcl Domino | 2020-12-04 | 4.3 MEDIUM | 6.5 MEDIUM |
| HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later. | |||||
| CVE-2020-4129 | 1 Hcltech | 1 Hcl Domino | 2020-12-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later. | |||||