Filtered by vendor Hcltech
Subscribe
Total
177 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-45696 | 1 Hcltech | 1 Sametime | 2024-09-05 | N/A | 7.5 HIGH |
| Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser. | |||||
| CVE-2023-45718 | 1 Hcltech | 1 Sametime | 2024-09-05 | N/A | 7.5 HIGH |
| Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session. | |||||
| CVE-2023-37539 | 1 Hcltech | 1 Domino | 2024-08-01 | N/A | 5.4 MEDIUM |
| The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it. | |||||
| CVE-2023-37536 | 3 Apache, Fedoraproject, Hcltech | 3 Xerces-c\+\+, Fedora, Bigfix Platform | 2024-08-01 | N/A | 8.8 HIGH |
| An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. | |||||
| CVE-2024-23562 | 1 Hcltech | 1 Domino | 2024-07-11 | N/A | 7.5 HIGH |
| This vulnerability is being re-assessed. Vulnerability details will be updated. The security bulletin will be republished when further details are available. | |||||
| CVE-2024-23588 | 1 Hcltech | 1 Nomad Server On Domino | 2024-07-08 | N/A | 6.5 MEDIUM |
| HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability. | |||||
| CVE-2023-45724 | 1 Hcltech | 1 Dryice Myxalytics | 2024-02-28 | N/A | 9.8 CRITICAL |
| HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication. | |||||
| CVE-2023-37520 | 1 Hcltech | 1 Bigfix Platform | 2024-02-28 | N/A | 6.1 MEDIUM |
| Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay. | |||||
| CVE-2023-37527 | 1 Hcltech | 1 Bigfix Platform | 2024-02-28 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page. | |||||
| CVE-2023-50341 | 1 Hcltech | 1 Dryice Myxalytics | 2024-02-28 | N/A | 7.5 HIGH |
| HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint. | |||||
| CVE-2023-50344 | 1 Hcltech | 1 Dryice Myxalytics | 2024-02-28 | N/A | 5.4 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files. | |||||
| CVE-2023-37518 | 1 Hcltech | 1 Bigfix Servicenow Data Flow | 2024-02-28 | N/A | 8.8 HIGH |
| HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user. | |||||
| CVE-2023-28017 | 1 Hcltech | 1 Connections | 2024-02-28 | N/A | 5.4 MEDIUM |
| HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks. | |||||
| CVE-2023-50342 | 1 Hcltech | 1 Dryice Myxalytics | 2024-02-28 | N/A | 4.3 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a result of improper access control. | |||||
| CVE-2023-28025 | 1 Hcltech | 1 Bigfix Modern Client Management | 2024-02-28 | N/A | 4.8 MEDIUM |
| Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage. | |||||
| CVE-2023-50343 | 1 Hcltech | 1 Dryice Myxalytics | 2024-02-28 | N/A | 6.5 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users. | |||||
| CVE-2023-50350 | 1 Hcltech | 1 Dryice Myxalytics | 2024-02-28 | N/A | 7.5 HIGH |
| HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information. | |||||
| CVE-2023-50345 | 1 Hcltech | 1 Dryice Myxalytics | 2024-02-28 | N/A | 6.1 MEDIUM |
| HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats. | |||||
| CVE-2023-37519 | 1 Hcltech | 1 Bigfix Platform | 2024-02-28 | N/A | 6.1 MEDIUM |
| Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server. | |||||
| CVE-2023-45716 | 1 Hcltech | 1 Sametime | 2024-02-28 | N/A | 4.1 MEDIUM |
| Sametime is impacted by sensitive information passed in URL. | |||||