CVE-2021-27760

The CVE-2021-27760 entry concerns HCL Notes 11.0–11.0.1 FP4 Sametime Embedded chat clients, where an authenticated Sametime chat user can trigger Remote Code Execution on another chat client by sending a specially formatted message containing Javascript code. The vulnerability arises in group cha...

CVE-2020-4126

CVE-2020-4126 concerns HCL iNotes, which is vulnerable to a sensitive cookie exposure vulnerability. An unauthenticated remote attacker could capture cookies by intercepting their transmission within an HTTP session. The issue affects HCL Domino/iNotes and is fixed in versions 10.0.1 FP6 and 11.0...

CVE-2022-27546

CVE-2022-27546 affects HCL iNotes with a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input in a form POST request. A remote attacker could lure a victim to a specially-crafted URL to run script in the site’s context and potentially steal cooki...

CVE-2022-27547

CVE-2022-27547 affects HCL iNotes (linked through non-existent domains) enabling an attacker to trick users into revealing sensitive information (e.g., credentials, payment data). The connected sources corroborate a domain-link-based abuse and cite iNotes/Domino as the impacted software, with no ...

CVE-2022-27558

CVE-2022-27558 concerns HCL iNotes with a broken Password Strength Check, where custom password policies are not enforced on certain iNotes forms. The root cause, as described, is that password strength/policy enforcement may be bypassed, allowing users to set weak passwords and potentially enabl...

CVE-2020-14271

CVE-2020-14271 affects HCL iNotes v9, v10 and v11. The stored XSS occurs due to improper handling of message content, allowing an unauthenticated remote attacker to craft markup that executes script in the victim’s browser within the hosting site’s security context and potentially steal cookie-ba...

CVE-2020-14225

CVE-2020-14225 affects HCL iNotes (HCL Domino mail) and is a Tabnabbing vulnerability caused by improper sanitization of message content. The vulnerability enables a remote, unauthenticated attacker to prompt users to enter credentials via phishing-like tricks. Per CVSS data, the attack is networ...