Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 582

Export CSV
CVE-2023-45723

Path Traversal which allows file upload capability affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Dryice Myxalytics
CVE-2024-42212

HCL BigFix Compliance is affected by an improper or missing SameSite attribute

HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Compliance
CVE-2024-42213

HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment

HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing or retrieved via predictable URLs or misconfigured permissions, leading to information disclosure.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Compliance
CVE-2024-30142

HCL BigFix Compliance is affected by a missing secure flag on a cookie

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Compliance
CVE-2024-30141

HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information

HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement information or expose information about its environment, users, or associated data.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Compliance
CVE-2024-30140

HCL BigFix Compliance is affected by unvalidated redirects and forwards

HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the web cache and provide back to users being served the page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Compliance
CVE-2024-30126

HCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerability

HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target website in a frame or iframe, tricking users into performing actions on the target website without their knowledge.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Compliance
CVE-2024-30125

HCL BigFix Compliance is affected by an internal server error

HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Compliance
CVE-2023-50349

HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability

Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Sametime
CVE-2024-23553

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2023-50342

Insecure Direct Object Reference (IDOR) affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability.  A user can obtain certain details about another user as a result of improper access control.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Dryice Myxalytics
CVE-2023-45718

HCL Sametime is impacted by a failure to invalidate sessions

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.  

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Sametime
CVE-2023-45716

HCL Sametime is impacted by a sensitive information disclosure

Sametime is impacted by sensitive information passed in URL.

CVSS 3.1 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Sametime
CVE-2023-45696

HCL Sametime is impacted by an autocomplete enabled vulnerability

Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Sametime
CVE-2023-37531

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2023-37530

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2023-37529

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information. This is not the same vulnerability as identified in CVE-2023-37530.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2023-37528

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2023-37527

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2023-50345

Open Redirect affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Dryice Myxalytics