Filtered by vendor Hcltech
Subscribe
Total
213 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-37539 | 1 Hcltech | 1 Domino | 2024-08-01 | N/A | 5.4 MEDIUM |
| The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it. | |||||
| CVE-2023-37536 | 3 Apache, Fedoraproject, Hcltech | 3 Xerces-c\+\+, Fedora, Bigfix Platform | 2024-08-01 | N/A | 8.8 HIGH |
| An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. | |||||
| CVE-2024-23588 | 1 Hcltech | 1 Nomad Server On Domino | 2024-07-08 | N/A | 6.5 MEDIUM |
| HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability. | |||||
| CVE-2023-37520 | 1 Hcltech | 1 Bigfix Platform | 2023-12-29 | N/A | 6.1 MEDIUM |
| Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay. | |||||
| CVE-2023-28025 | 1 Hcltech | 1 Bigfix Modern Client Management | 2023-12-29 | N/A | 4.8 MEDIUM |
| Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage. | |||||
| CVE-2023-28022 | 1 Hcltech | 1 Connections | 2023-12-20 | N/A | 6.5 MEDIUM |
| HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data. | |||||
| CVE-2023-28017 | 1 Hcltech | 1 Connections | 2023-12-12 | N/A | 5.4 MEDIUM |
| HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks. | |||||
| CVE-2023-37533 | 1 Hcltech | 1 Connections | 2023-11-16 | N/A | 6.1 MEDIUM |
| HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks. | |||||
| CVE-2022-38660 | 1 Hcltech | 1 Domino | 2023-11-07 | N/A | 8.8 HIGH |
| HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user. | |||||
| CVE-2022-38654 | 1 Hcltech | 1 Domino | 2023-11-07 | N/A | 5.5 MEDIUM |
| HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record. | |||||
| CVE-2023-37532 | 1 Hcltech | 1 Commerce | 2023-10-30 | N/A | 4.3 MEDIUM |
| HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system. | |||||
| CVE-2023-37502 | 1 Hcltech | 1 Hcl Compass | 2023-10-25 | N/A | 8.8 HIGH |
| HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser. | |||||
| CVE-2023-37504 | 1 Hcltech | 1 Hcl Compass | 2023-10-25 | N/A | 6.5 MEDIUM |
| HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user. | |||||
| CVE-2023-37503 | 1 Hcltech | 1 Hcl Compass | 2023-10-25 | N/A | 9.8 CRITICAL |
| HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. | |||||
| CVE-2023-37537 | 1 Hcltech | 1 Appscan Presence | 2023-10-24 | N/A | 7.8 HIGH |
| An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges. | |||||
| CVE-2022-44757 | 1 Hcltech | 1 Bigfix Insights For Vulnerability Remediation | 2023-10-23 | N/A | 8.2 HIGH |
| BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc. | |||||
| CVE-2022-44758 | 1 Hcltech | 1 Bigfix Insights For Vulnerability Remediation | 2023-10-23 | N/A | 5.3 MEDIUM |
| BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized. | |||||
| CVE-2023-37538 | 1 Hcltech | 1 Digital Experience | 2023-10-18 | N/A | 6.1 MEDIUM |
| HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site). | |||||
| CVE-2023-37511 | 1 Hcltech | 1 Traveler To Do | 2023-08-17 | N/A | 4.3 MEDIUM |
| If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved. | |||||
| CVE-2023-37513 | 1 Hcltech | 1 Traveler To Do | 2023-08-17 | N/A | 5.5 MEDIUM |
| When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information. | |||||