CVE-2021-27772 HCL Sametime is vulnerable to an information disclosure

Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead t...

CVE-2021-27771 HCL Sametime is susceptible a file transfer service vulnerability

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...

CVE-2021-27770 HCL Sametime is vulnerable to arbitrary HTTP requests

The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place...

CVE-2021-27768 An SSL certificate host verification vulnerability affects HCL Verse for Android

Using the ability to perform a Man-in-the-Middle MITM attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode...

HCL Technologies HCL Sametime 授权问题漏洞

HCL Sametime, a conferencing solution from HCL Technologies, is vulnerable to an authorization issue in HCL Sametime version 11.6, which stems from an application where users can read group conversations without actively participating, which could be exploited to read sensitive information...

HCL Technologies HCL Sametime 安全漏洞

HCL Sametime, a conferencing solution from HCL Technologies, has a security vulnerability in HCL Technologies HCL Sametime version 11.6 that could be exploited by attackers to conduct clickjacking attacks in conference chats...

HCL Technologies HCL Sametime 安全漏洞

HCL Sametime, a conferencing solution from HCL Technologies, has a security vulnerability in HCL Technologies HCL Sametime version 11.6, which stems from a lack of effective restrictions on sensitive information on websites, which could be exploited by attackers to gain access to sensitive...

HCL Technologies HCL Sametime 安全漏洞

HCL Sametime, a conferencing solution from HCL Technologies, has a security vulnerability in HCL Technologies HCL Sametime version 11.6 that stems from a lack of external URL absorption in FaviconService, which could be exploited by an attacker to specify the external URL where the online meeting...

HCL Technologies HCL Verse 信任管理问题漏洞

HCL Technologies HCL Verse is a mobile application from HCL Technologies India that allows access to emails and life plan management.A security vulnerability exists in versions of HCL Technologies HCL Verse for Android prior to version 12.0.9, which stems from a server setup and login process in...

HCL BigFix Platform Elevation of Privilege Vulnerability

HCL BigFix Platform is an endpoint security management platform. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Client. An attacker exploits the vulnerability to perform elevation of privilege...

HCL BigFix Platform Console Elevation of Privilege Vulnerability

HCL BigFix Platform is an endpoint security management platform. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in the HCL BigFix Platform Console. An attacker exploited the vulnerability to perform elevation of...

HCL BigFix Platform elevation of privilege vulnerability (CNVD-2022-38161)

HCL BigFix Platform is an endpoint security management platform. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform. An attacker exploits the vulnerability to perform elevation of privilege...

CVE-2021-27751

HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible...

CVE-2021-27751

HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible...

Session fixation

HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible...

CVE-2021-27767 HCL BigFix Platform Console is affected by a Privilege Escalation Vulnerability

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed...

CVE-2021-27766 HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed...

CVE-2021-27765 HCL BigFix Platform Server API is affected by Privilege Escalation Vulnerability

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed...

CVE-2021-27764 HCL BigFix WebUI Cookie missing attributes

Cookie without HTTPONLY flag set. NUMBER cookies was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. WebUI...

CVE-2021-27762 HCL BigFix Platform is affected by misconfigured security-related HTTP headers

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses...