Hcltech

HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL

CVE-2023-37533 6.1 - Medium - November 09, 2023

HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

XSS

HCL Commerce Remote Store server could

CVE-2023-37532 4.3 - Medium - October 23, 2023

HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.

Directory traversal

HCL Compass is vulnerable to insecure password requirements

CVE-2023-37503 9.8 - Critical - October 19, 2023

HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.

Weak Password Requirements

HCL Compass is vulnerable to failure to invalidate sessions

CVE-2023-37504 6.5 - Medium - October 19, 2023

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called.  If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

Insufficient Session Expiration

HCL Compass is vulnerable to lack of file upload security

CVE-2023-37502 8.8 - High - October 18, 2023

HCL Compass is vulnerable to lack of file upload security.  An attacker could upload files containing active code that can be executed by the server or by a user's web browser.

Unrestricted File Upload

An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may

CVE-2023-37537 7.8 - High - October 17, 2023

An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.

Unquoted Search Path or Element

HCL Digital Experience is susceptible to cross site scripting (XSS)

CVE-2023-37538 6.1 - Medium - October 11, 2023

HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).

XSS

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform

CVE-2023-37536 8.8 - High - October 11, 2023

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

Integer Overflow or Wraparound

BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content

CVE-2022-44758 5.3 - Medium - October 11, 2023

BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.

Insufficiently Protected Credentials

BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure

CVE-2022-44757 8.2 - High - October 11, 2023

BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.

Insufficiently Protected Credentials

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.

CVE-2022-42451 4.4 - Medium - October 11, 2023

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.

Insufficiently Protected Credentials

In some configuration scenarios, the Domino server host name can be exposed

CVE-2023-28010 5.3 - Medium - September 08, 2023

In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred

CVE-2023-37513 5.5 - Medium - August 11, 2023

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred

CVE-2023-37512 5.5 - Medium - August 11, 2023

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content

CVE-2023-37511 4.3 - Medium - August 11, 2023

If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.

If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented

CVE-2023-23342 7.1 - High - August 10, 2023

If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented. 

HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm

CVE-2023-23347 7.1 - High - August 09, 2023

HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.

Use of a Broken or Risky Cryptographic Algorithm

HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm

CVE-2023-23346 7.1 - High - August 09, 2023

HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.

Use of a Broken or Risky Cryptographic Algorithm

A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign

CVE-2023-37501 6.1 - Medium - August 03, 2023

A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign.  An attacker could hijack a user's session and perform other attacks.

XSS

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform

CVE-2023-37500 6.1 - Medium - August 03, 2023

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform.  An attacker could hijack a user's session and perform other attacks.

XSS

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform

CVE-2023-37499 6.1 - Medium - August 03, 2023

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform.  An attacker could hijack a user's session and perform other attacks.

XSS

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator

CVE-2023-37498 8.8 - High - August 03, 2023

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.  It is possible that an attacker could potentially escalate their privileges.

The Unica application exposes an API which accepts arbitrary XML input

CVE-2023-37497 8.8 - High - August 03, 2023

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.

XXE

HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability

CVE-2023-37496 5.4 - Medium - August 01, 2023

HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

XSS

HCL BigFix Mobile is vulnerable to a cross-site scripting attack

CVE-2023-28014 5.4 - Medium - July 27, 2023

HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.

XSS

HCL BigFix Mobile is vulnerable to a command injection attack

CVE-2023-28012 8.8 - High - July 27, 2023

HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.

Command Injection

HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability

CVE-2023-28013 6.1 - Medium - July 26, 2023

HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

XSS

A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before

CVE-2023-28023 6.5 - Medium - July 18, 2023

A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network). 

Session Riding

The BigFix WebUI uses weak cipher suites.

CVE-2023-28021 7.5 - High - July 18, 2023

The BigFix WebUI uses weak cipher suites.

Inadequate Encryption Strength

 URL redirection in Login page in HCL BigFix WebUI

CVE-2023-28020 6.1 - Medium - July 18, 2023

 URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.

Open Redirect

Insufficient validation in Bigfix WebUI API App site version < 14

CVE-2023-28019 8.8 - High - July 18, 2023

Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.

SQL Injection

A permission issue in BigFix WebUI Insights site version 14

CVE-2023-23344 6.5 - Medium - June 23, 2023

A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.

Incorrect Default Permissions

Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower

CVE-2023-28016 6.1 - Medium - June 22, 2023

Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.

Injection

The OSD Bare Metal Server uses a cryptographic algorithm

CVE-2023-28006 7.8 - High - June 22, 2023

The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.

Use of a Broken or Risky Cryptographic Algorithm

A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower

CVE-2023-23343 6.1 - Medium - June 22, 2023

A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.

Clickjacking

HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data

CVE-2023-28009 8.1 - High - April 26, 2023

HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

XXE

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data

CVE-2023-28008 8.1 - High - April 26, 2023

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

XXE

HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS)

CVE-2022-42447 8.8 - High - April 02, 2023

HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.

Session Riding

HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability

CVE-2021-27788 6.1 - Medium - March 10, 2023

HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

XSS

An open redirect to malicious sites

CVE-2022-38657 5.4 - Medium - February 12, 2023

An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.

Open Redirect

HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced

CVE-2021-27782 7.5 - High - January 20, 2023

HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.

Improper Restriction of Excessive Authentication Attempts

BigFix WebUI non-master operators are missing controls

CVE-2022-38655 5.8 - Medium - December 21, 2022

BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.

In HCL Digital Experience, URLs

CVE-2022-38662 6.1 - Medium - December 19, 2022

In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.

Open Redirect

In HCL Digital Experience, customized XSS payload can be constructed such

CVE-2022-38653 5.4 - Medium - December 19, 2022

In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.

XSS

There are insufficient warnings when a Fixlet is imported by a user

CVE-2022-42453 6.5 - Medium - December 19, 2022

There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.

authentification

HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView

CVE-2022-44755 7.8 - High - December 19, 2022

HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44751. This vulnerability applies to software previously licensed by IBM.

Memory Corruption

HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView

CVE-2022-44754 7.8 - High - December 19, 2022

HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44750. This vulnerability applies to software previously licensed by IBM.

Memory Corruption

HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView

CVE-2022-44753 7.8 - High - December 19, 2022

HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licensed by IBM.

Memory Corruption

HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView

CVE-2022-44752 7.8 - High - December 19, 2022

HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licensed by IBM.

Memory Corruption

HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView

CVE-2022-44751 7.8 - High - December 19, 2022

HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44755. This vulnerability applies to software previously licensed by IBM.

Memory Corruption

HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView

CVE-2022-44750 7.8 - High - December 19, 2022

HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44754. This vulnerability applies to software previously licensed by IBM.

Memory Corruption

Starting with Sametime 12, anonymous users are enabled by default

CVE-2022-42446 6.5 - Medium - December 12, 2022

Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.

Incorrect Default Permissions

HCL Domino is susceptible to an information disclosure vulnerability

CVE-2022-38654 5.5 - Medium - November 04, 2022

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.

HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability

CVE-2022-38660 8.8 - High - November 04, 2022

HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.

Session Riding

The application was signed using a key length less than or equal to 1024 bits

CVE-2020-4099 7.5 - High - November 01, 2022

The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.

Inadequate Encryption Strength

The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key

CVE-2021-27784 7.5 - High - October 31, 2022

The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.

Use of a Broken or Risky Cryptographic Algorithm

User input included in error response

CVE-2021-27774 5.4 - Medium - September 22, 2022

User input included in error response, which could be used in a phishing attack.

Improper Input Validation

There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).

CVE-2022-27561 4.8 - Medium - September 15, 2022

There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).

XSS

An unauthenticated user can overload a part of HCL VersionVault Express

CVE-2022-27563 7.5 - High - August 30, 2022

An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.

Improper Check for Unusual or Exceptional Conditions

HCL VersionVault Express exposes administrator credentials.

CVE-2022-27560 6.5 - Medium - August 30, 2022

HCL VersionVault Express exposes administrator credentials.

Insufficiently Protected Credentials

HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability

CVE-2022-27558 7.5 - High - August 29, 2022

HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.

Weak Password Requirements

HCL iNotes is susceptible to a link to non-existent domain vulnerability

CVE-2022-27547 7.4 - High - August 29, 2022

HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.

Open Redirect

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request

CVE-2022-27546 6.1 - Medium - August 29, 2022

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.

XSS

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.

CVE-2022-27545 5.4 - Medium - July 19, 2022

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.

XSS

BigFix Web Reports authorized users may see SMTP credentials in clear text.

CVE-2022-27544 6.5 - Medium - July 19, 2022

BigFix Web Reports authorized users may see SMTP credentials in clear text.

Insufficiently Protected Credentials

Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner

CVE-2021-27786 9.8 - Critical - June 09, 2022

Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.

Incorrect Comparison

HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages

CVE-2021-27778 4.8 - Medium - June 01, 2022

HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

XSS

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.

CVE-2021-27781 4.8 - Medium - May 27, 2022

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.

XSS

The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.

CVE-2021-27780 5.3 - Medium - May 27, 2022

The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.

User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.

CVE-2021-27783 6.5 - Medium - May 25, 2022

User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.

Missing Encryption of Sensitive Data

VersionVault Express exposes sensitive information

CVE-2021-27779 9.1 - Critical - May 25, 2022

VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.

Missing Encryption of Sensitive Data

HCL Domino is affected by an Insufficient Access Control vulnerability

CVE-2020-4107 7.8 - High - May 19, 2022

HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.

XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation

CVE-2021-27777 7.5 - High - May 12, 2022

XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.

XXE

This vulnerability allows users to execute a clickjacking attack in the meeting's chat.

CVE-2021-27773 4.3 - Medium - May 12, 2022

This vulnerability allows users to execute a clickjacking attack in the meeting's chat.

Clickjacking

Users are able to read group conversations without actively taking part in them

CVE-2021-27772 6.5 - Medium - May 12, 2022

Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.

Using the ability to perform a Man-in-the-Middle (MITM) attack

CVE-2021-27768 5.9 - Medium - May 12, 2022

Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.

Improper Certificate Validation

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service

CVE-2021-27771 7.6 - High - May 12, 2022

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.

Unrestricted File Upload

The vulnerability was discovered within the FaviconService

CVE-2021-27770 8.8 - High - May 12, 2022

The vulnerability was discovered within the FaviconService. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the meetings-function where users can specify an external URL where the online meeting will take place.

Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system

CVE-2021-27769 5.3 - Medium - May 12, 2022

Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible.

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability

CVE-2021-27767 7.8 - High - May 06, 2022

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Improper Privilege Management

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability

CVE-2021-27766 7.8 - High - May 06, 2022

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Improper Privilege Management

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability

CVE-2021-27765 7.8 - High - May 06, 2022

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Improper Privilege Management

This vulnerability arises because the application allows the user to perform some sensitive action without verifying

CVE-2021-27759 6.5 - Medium - May 06, 2022

This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.

Insufficient Verification of Data Authenticity

There is a security vulnerability in login form related to Cross-site Request Forgery

CVE-2021-27758 6.5 - Medium - May 06, 2022

There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.

Session Riding

Cookie without HTTPONLY flag set

CVE-2021-27764 6.5 - Medium - May 06, 2022

Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)

Missing Encryption of Sensitive Data

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses

CVE-2021-27762 9.8 - Critical - May 06, 2022

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses

Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks

CVE-2021-27761 7.5 - High - May 06, 2022

Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks

Inadequate Encryption Strength

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients

CVE-2021-27760 5.5 - Medium - May 06, 2022

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.

"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5

CVE-2021-27756 7.5 - High - March 04, 2022

"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it."

Use of a Broken or Risky Cryptographic Algorithm

" Insecure password storage issue.The application stores sensitive information in cleartext within a resource

CVE-2021-27757 7.5 - High - March 04, 2022

" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Since the information is stored in cleartext, attackers could potentially read it and gain access to sensitive information."

Cleartext Storage of Sensitive Information

"Sametime Android potential path traversal vulnerability when using File class"

CVE-2021-27755 5.5 - Medium - February 21, 2022

"Sametime Android potential path traversal vulnerability when using File class"

Directory traversal

"Sametime Android PathTraversal Vulnerability"

CVE-2021-27753 5.5 - Medium - February 21, 2022

"Sametime Android PathTraversal Vulnerability"

Directory traversal

"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability

CVE-2020-14264 3.9 - Low - October 25, 2021

"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"

Use of a Broken or Risky Cryptographic Algorithm

"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability

CVE-2020-14263 3.9 - Low - October 21, 2021

"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"

Incorrect Permission Assignment for Critical Resource

In Digital Experience 8.5

CVE-2020-4081 6.1 - Medium - February 02, 2021

In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).

XSS

HCL Digital Experience 8.5

CVE-2020-14221 4.9 - Medium - February 02, 2021

HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.

Information Disclosure

HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests

CVE-2020-14255 7.5 - High - February 02, 2021

HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. These affect containers only. These do not affect traditional on-premise installations.

Information Disclosure

HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API

CVE-2020-14273 7.5 - High - December 28, 2020

HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker could could exploit this vulnerability to crash the Domino server.

Improper Input Validation

HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input

CVE-2020-14270 5.3 - Medium - December 22, 2020

HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.

Generation of Error Message Containing Sensitive Information

HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content

CVE-2020-14225 6.5 - Medium - December 21, 2020

HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack.