CVE-2019-4409

HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the...

CVE-2019-4409: Improper Neutralization of Input During Web Page Generation

HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the...

HCL Traveler Cross-Site Scripting Vulnerability

HCL Traveler is a real-time synchronization of email, calendar, address book data, etc. A cross-site scripting vulnerability exists in HCL Traveler 9.x and prior versions, which stems from a lack of proper validation of client-side data by the web application and can be exploited by an attacker t...

HCL AppScan Source Code Issue Vulnerability

HCL AppScan Source is a suite of dynamic analysis and testing tools from HCL India, which is mainly used for web security testing. A code issue vulnerability exists in HCL AppScan Source versions prior to 9.03.13. The vulnerability stems from an improperly designed or implemented code development...

CVE-2019-16188

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...

CVE-2019-16188

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...

Xxe

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...

CVE-2019-16188

The CVE-2019-16188 issue affects HCL AppScan Source prior to version 9.03.13. It allows XML External Entity (XXE) attacks via a specially crafted .ozasmt file, where, if the victim opens/imports it, the attacker can read local files accessible to the victim and exfiltrate content to a remote list...

CVE-2019-16188

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...

CVE-2019-16188: Improper Restriction of XML External Entity Reference

HCL AppScan Source before 9.03.13 is susceptible to XML External Entity XXE attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the victim imports the .ozasmt file in AppScan Source, the conte...

HCL Exposes Customer, Personnel Info in Wide-Ranging Data Leak

IT services provider HCL Technologies has inadvertently exposed passwords, sensitive project reports and other private data of thousands of customers and internal employees on various public HCL subdomains. HCL, an $8 billion conglomerate with more than 100,000 employees, specializes in...

Honeywell MIDAS-E-HCL Gas Detector Detection

Binary data 762164.prm...

Cross site request forgery (csrf)

A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can...

CVE-2018-11518

A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can...

CVE-2018-11518

A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can...

CVE-2018-11518

CVE-2018-11518 describes a phreaking attack on HCL legacy IVR systems that do not use VoIP. The vulnerability arises from handling of audio-frequency signals (DTMF) within a phone call, where an attacker can record the tones and trigger a service activation. The issue is a request-forgery : if th...

CVE-2018-11518: Improper Input Validation

A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can...

Motorola Bootloader - Kernel Cmdline Injection Secure Boot and Device Locking Bypass Exploit

Exploit for Android platform in category local exploits Sources: https://alephsecurity.com/2017/08/30/untethered-initroot/ https://github.com/alephsecurity/initroot initroot: Motorola Bootloader Kernel Cmdline Injection Secure Boot & Device Locking Bypass CVE-2016-10277 By Roee Hay / Aleph...

Denial of Service Vulnerability in Multiple ImageMagick Functions

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A security vulnerability exists in several functions in ImageMagick versions 7.0.4-9. The vulnerability can be exploit...

HCL / IBM BigFix Remote Control Detection (HTTP)

HTTP based detection of HCL / IBM BigFix Remote Control. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...