Hcltech
Products by Hcltech Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2024 there have been 18 vulnerabilities in Hcltech with an average score of 6.9 out of ten. Last year Hcltech had 46 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Hcltech in 2024 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2024 is greater by 0.23.
Year | Vulnerabilities | Average Score |
---|---|---|
2024 | 18 | 6.93 |
2023 | 46 | 6.69 |
2022 | 51 | 6.85 |
2021 | 5 | 5.26 |
2020 | 37 | 6.97 |
2019 | 3 | 5.77 |
2018 | 0 | 0.00 |
It may take a day or so for new Hcltech vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Hcltech Security Vulnerabilities
Sametime is impacted by sensitive information passed in URL.
CVE-2023-45716
4.1 - Medium
- February 09, 2024
Sametime is impacted by sensitive information passed in URL.
Cleartext Transmission of Sensitive Information
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
CVE-2023-50349
8.8 - High
- February 09, 2024
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.
Session Riding
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly
CVE-2023-37528
6.1 - Medium
- February 03, 2024
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.
XSS
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.
CVE-2024-23553
5.4 - Medium
- February 02, 2024
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.
XSS
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly
CVE-2023-37527
6.1 - Medium
- February 02, 2024
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.
XSS
HCL BigFix ServiceNow is vulnerable to arbitrary code injection
CVE-2023-37518
8.8 - High
- January 30, 2024
HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user.
Code Injection
HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability
CVE-2023-50344
5.4 - Medium
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files.
HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability
CVE-2023-50343
6.5 - Medium
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.
HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability
CVE-2023-50342
4.3 - Medium
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a result of improper access control.
Insecure Direct Object Reference / IDOR
HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability
CVE-2023-50341
7.5 - High
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint.
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability
CVE-2023-45724
9.8 - Critical
- January 03, 2024
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.
Unrestricted File Upload
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability
CVE-2023-45723
9.8 - Critical
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.
Directory traversal
HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname
CVE-2023-45722
9.8 - Critical
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory. The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.
Directory traversal
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can
CVE-2023-50351
9.1 - Critical
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.
HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption
CVE-2023-50350
7.5 - High
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information.
Use of a Broken or Risky Cryptographic Algorithm
HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability
CVE-2023-50348
5.3 - Medium
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker with insight into the application, system, etc.
HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability
CVE-2023-50346
4.3 - Medium
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information.
HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could
CVE-2023-50345
6.1 - Medium
- January 03, 2024
HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats.
Open Redirect
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68
CVE-2023-37520
6.1 - Medium
- December 21, 2023
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.
XSS
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
CVE-2023-37519
6.1 - Medium
- December 21, 2023
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server.
XSS
Due to this vulnerability
CVE-2023-28025
4.8 - Medium
- December 21, 2023
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage.
XSS
HCL Connections is vulnerable to an information disclosure vulnerability which could
CVE-2023-28022
6.5 - Medium
- December 15, 2023
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL
CVE-2023-28017
5.4 - Medium
- December 07, 2023
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
XSS
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL
CVE-2023-37533
6.1 - Medium
- November 09, 2023
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
XSS
HCL Commerce Remote Store server could
CVE-2023-37532
4.3 - Medium
- October 23, 2023
HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.
Directory traversal
HCL Compass is vulnerable to insecure password requirements
CVE-2023-37503
9.8 - Critical
- October 19, 2023
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.
Weak Password Requirements
HCL Compass is vulnerable to failure to invalidate sessions
CVE-2023-37504
6.5 - Medium
- October 19, 2023
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
Insufficient Session Expiration
HCL Compass is vulnerable to lack of file upload security
CVE-2023-37502
8.8 - High
- October 18, 2023
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
Unrestricted File Upload
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may
CVE-2023-37537
7.8 - High
- October 17, 2023
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.
Unquoted Search Path or Element
HCL Digital Experience is susceptible to cross site scripting (XSS)
CVE-2023-37538
6.1 - Medium
- October 11, 2023
HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
XSS
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform
CVE-2023-37536
8.8 - High
- October 11, 2023
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
Integer Overflow or Wraparound
BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content
CVE-2022-44758
5.3 - Medium
- October 11, 2023
BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.
Insufficiently Protected Credentials
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure
CVE-2022-44757
8.2 - High
- October 11, 2023
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.
Insufficiently Protected Credentials
Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.
CVE-2022-42451
4.4 - Medium
- October 11, 2023
Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.
Insufficiently Protected Credentials
In some configuration scenarios, the Domino server host name can be exposed
CVE-2023-28010
5.3 - Medium
- September 08, 2023
In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred
CVE-2023-37513
5.5 - Medium
- August 11, 2023
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred
CVE-2023-37512
5.5 - Medium
- August 11, 2023
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content
CVE-2023-37511
4.3 - Medium
- August 11, 2023
If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented
CVE-2023-23342
7.1 - High
- August 10, 2023
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm
CVE-2023-23347
7.1 - High
- August 09, 2023
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Use of a Broken or Risky Cryptographic Algorithm
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm
CVE-2023-23346
7.1 - High
- August 09, 2023
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Use of a Broken or Risky Cryptographic Algorithm
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign
CVE-2023-37501
6.1 - Medium
- August 03, 2023
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
XSS
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform
CVE-2023-37500
6.1 - Medium
- August 03, 2023
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.
XSS
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform
CVE-2023-37499
6.1 - Medium
- August 03, 2023
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.
XSS
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator
CVE-2023-37498
8.8 - High
- August 03, 2023
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.
The Unica application exposes an API which accepts arbitrary XML input
CVE-2023-37497
8.8 - High
- August 03, 2023
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
XXE
HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability
CVE-2023-37496
5.4 - Medium
- August 01, 2023
HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
XSS
HCL BigFix Mobile is vulnerable to a cross-site scripting attack
CVE-2023-28014
5.4 - Medium
- July 27, 2023
HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.
XSS
HCL BigFix Mobile is vulnerable to a command injection attack
CVE-2023-28012
8.8 - High
- July 27, 2023
HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.
Command Injection
HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability
CVE-2023-28013
6.1 - Medium
- July 26, 2023
HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
XSS
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before
CVE-2023-28023
6.5 - Medium
- July 18, 2023
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network).
Session Riding
The BigFix WebUI uses weak cipher suites.
CVE-2023-28021
7.5 - High
- July 18, 2023
The BigFix WebUI uses weak cipher suites.
Inadequate Encryption Strength
URL redirection in Login page in HCL BigFix WebUI
CVE-2023-28020
6.1 - Medium
- July 18, 2023
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
Open Redirect
Insufficient validation in Bigfix WebUI API App site version < 14
CVE-2023-28019
8.8 - High
- July 18, 2023
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
SQL Injection
A permission issue in BigFix WebUI Insights site version 14
CVE-2023-23344
6.5 - Medium
- June 23, 2023
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
Incorrect Default Permissions
Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower
CVE-2023-28016
6.1 - Medium
- June 22, 2023
Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.
Injection
The OSD Bare Metal Server uses a cryptographic algorithm
CVE-2023-28006
7.8 - High
- June 22, 2023
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.
Use of a Broken or Risky Cryptographic Algorithm
A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower
CVE-2023-23343
6.1 - Medium
- June 22, 2023
A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.
Clickjacking
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
CVE-2023-28009
8.1 - High
- April 26, 2023
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
XXE
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
CVE-2023-28008
8.1 - High
- April 26, 2023
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
XXE
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS)
CVE-2022-42447
8.8 - High
- April 02, 2023
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.
Session Riding
HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability
CVE-2021-27788
6.1 - Medium
- March 10, 2023
HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
XSS
An open redirect to malicious sites
CVE-2022-38657
5.4 - Medium
- February 12, 2023
An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
Open Redirect
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced
CVE-2021-27782
7.5 - High
- January 20, 2023
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
Improper Restriction of Excessive Authentication Attempts
BigFix WebUI non-master operators are missing controls
CVE-2022-38655
5.8 - Medium
- December 21, 2022
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
In HCL Digital Experience, URLs
CVE-2022-38662
6.1 - Medium
- December 19, 2022
In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.
Open Redirect
In HCL Digital Experience, customized XSS payload can be constructed such
CVE-2022-38653
5.4 - Medium
- December 19, 2022
In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.
XSS
There are insufficient warnings when a Fixlet is imported by a user
CVE-2022-42453
6.5 - Medium
- December 19, 2022
There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.
authentification
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView
CVE-2022-44755
7.8 - High
- December 19, 2022
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44751. This vulnerability applies to software previously licensed by IBM.
Memory Corruption
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView
CVE-2022-44754
7.8 - High
- December 19, 2022
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44750. This vulnerability applies to software previously licensed by IBM.
Memory Corruption
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView
CVE-2022-44753
7.8 - High
- December 19, 2022
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licensed by IBM.
Memory Corruption
HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView
CVE-2022-44752
7.8 - High
- December 19, 2022
HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licensed by IBM.
Memory Corruption
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView
CVE-2022-44751
7.8 - High
- December 19, 2022
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44755. This vulnerability applies to software previously licensed by IBM.
Memory Corruption
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView
CVE-2022-44750
7.8 - High
- December 19, 2022
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44754. This vulnerability applies to software previously licensed by IBM.
Memory Corruption
Starting with Sametime 12, anonymous users are enabled by default
CVE-2022-42446
6.5 - Medium
- December 12, 2022
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
Incorrect Default Permissions
HCL Domino is susceptible to an information disclosure vulnerability
CVE-2022-38654
5.5 - Medium
- November 04, 2022
HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability
CVE-2022-38660
8.8 - High
- November 04, 2022
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.
Session Riding
The application was signed using a key length less than or equal to 1024 bits
CVE-2020-4099
7.5 - High
- November 01, 2022
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
Inadequate Encryption Strength
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key
CVE-2021-27784
7.5 - High
- October 31, 2022
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.
Use of a Broken or Risky Cryptographic Algorithm
User input included in error response
CVE-2021-27774
5.4 - Medium
- September 22, 2022
User input included in error response, which could be used in a phishing attack.
Improper Input Validation
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).
CVE-2022-27561
4.8 - Medium
- September 15, 2022
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).
XSS
An unauthenticated user can overload a part of HCL VersionVault Express
CVE-2022-27563
7.5 - High
- August 30, 2022
An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
Improper Check for Unusual or Exceptional Conditions
HCL VersionVault Express exposes administrator credentials.
CVE-2022-27560
6.5 - Medium
- August 30, 2022
HCL VersionVault Express exposes administrator credentials.
Insufficiently Protected Credentials
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability
CVE-2022-27558
7.5 - High
- August 29, 2022
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
Weak Password Requirements
HCL iNotes is susceptible to a link to non-existent domain vulnerability
CVE-2022-27547
7.4 - High
- August 29, 2022
HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.
Open Redirect
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request
CVE-2022-27546
6.1 - Medium
- August 29, 2022
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.
XSS
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
CVE-2022-27545
5.4 - Medium
- July 19, 2022
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
XSS
BigFix Web Reports authorized users may see SMTP credentials in clear text.
CVE-2022-27544
6.5 - Medium
- July 19, 2022
BigFix Web Reports authorized users may see SMTP credentials in clear text.
Insufficiently Protected Credentials
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner
CVE-2021-27786
9.8 - Critical
- June 09, 2022
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.
Incorrect Comparison
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages
CVE-2021-27778
4.8 - Medium
- June 01, 2022
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
XSS
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVE-2021-27781
4.8 - Medium
- May 27, 2022
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
XSS
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVE-2021-27780
5.3 - Medium
- May 27, 2022
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
CVE-2021-27783
6.5 - Medium
- May 25, 2022
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
Missing Encryption of Sensitive Data
VersionVault Express exposes sensitive information
CVE-2021-27779
9.1 - Critical
- May 25, 2022
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.
Missing Encryption of Sensitive Data
HCL Domino is affected by an Insufficient Access Control vulnerability
CVE-2020-4107
7.8 - High
- May 19, 2022
HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation
CVE-2021-27777
7.5 - High
- May 12, 2022
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.
XXE
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
CVE-2021-27773
4.3 - Medium
- May 12, 2022
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
Clickjacking
Users are able to read group conversations without actively taking part in them
CVE-2021-27772
6.5 - Medium
- May 12, 2022
Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.
Using the ability to perform a Man-in-the-Middle (MITM) attack
CVE-2021-27768
5.9 - Medium
- May 12, 2022
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.
Improper Certificate Validation
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service
CVE-2021-27771
7.6 - High
- May 12, 2022
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.
Unrestricted File Upload