Hcltech Security Vulnerabilities
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
7.8CVSS
7.5AI Score
0.0004EPSS
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.
8.8CVSS
8.7AI Score
0.001EPSS
In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.
6.1CVSS
6.2AI Score
0.001EPSS
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
6.5CVSS
6.4AI Score
0.001EPSS
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.
9.6CVSS
8.5AI Score
0.001EPSS
Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.
4.6CVSS
4.5AI Score
0.0004EPSS
There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.
6.9CVSS
6.4AI Score
0.001EPSS
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in ...
9.8CVSS
7.9AI Score
0.001EPSS
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in C...
9.8CVSS
7.9AI Score
0.001EPSS
HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licen...
9.8CVSS
7.9AI Score
0.001EPSS
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licens...
9.8CVSS
7.9AI Score
0.001EPSS
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in ...
9.8CVSS
7.9AI Score
0.001EPSS
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in C...
9.8CVSS
7.9AI Score
0.001EPSS
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.
8.2CVSS
8.1AI Score
0.001EPSS
BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.
6.5CVSS
5.2AI Score
0.0005EPSS
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.
7.1CVSS
6.7AI Score
0.0004EPSS
A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.
6.1CVSS
6.2AI Score
0.001EPSS
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
6.5CVSS
6.3AI Score
0.001EPSS
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
7.1CVSS
6.8AI Score
0.0004EPSS
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
7.1CVSS
6.8AI Score
0.0004EPSS
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.
7.8CVSS
7.5AI Score
0.0004EPSS
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
8.1CVSS
8AI Score
0.001EPSS
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
8.1CVSS
8AI Score
0.001EPSS
In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.
5.3CVSS
5.1AI Score
0.0005EPSS
HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.
8.8CVSS
8.9AI Score
0.001EPSS
HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, ...
6.5CVSS
6.1AI Score
0.001EPSS
HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.
6.6CVSS
5.1AI Score
0.0005EPSS
Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.
6.1CVSS
6.3AI Score
0.001EPSS
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-b...
5.4CVSS
5.7AI Score
0.0004EPSS
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
8.8CVSS
8.6AI Score
0.001EPSS
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
6.1CVSS
6.2AI Score
0.001EPSS
7.5CVSS
7.5AI Score
0.001EPSS
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
6.5CVSS
6.1AI Score
0.0005EPSS
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network).
6.5CVSS
6.4AI Score
0.001EPSS
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and...
6.6CVSS
4.8AI Score
0.0004EPSS
HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
8.3CVSS
5.3AI Score
0.0005EPSS
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
8.8CVSS
8.5AI Score
0.001EPSS
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.
8.8CVSS
8.7AI Score
0.001EPSS
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.
8.1CVSS
6AI Score
0.001EPSS
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.
8.1CVSS
6AI Score
0.001EPSS
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
8.1CVSS
6AI Score
0.001EPSS
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
9CVSS
8.7AI Score
0.001EPSS
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.
9.8CVSS
9.5AI Score
0.001EPSS
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
7.1CVSS
6.3AI Score
0.0005EPSS
If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.
4.3CVSS
4.6AI Score
0.0004EPSS
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
5.5CVSS
5.4AI Score
0.0004EPSS
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
5.5CVSS
5.5AI Score
0.0004EPSS
HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user.
8.8CVSS
8.8AI Score
0.0005EPSS
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server.
7.7CVSS
5.6AI Score
0.0005EPSS
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.
7.7CVSS
5.8AI Score
0.0005EPSS