CVE-2023-28018

HCL Connections s vulnerable to possible denial of service for certain users

HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request an attacker could exploit this vulnerability to cause denial of service for affected users.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Connections

CVE-2021-27788

HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability

HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability.  By tricking a user into clicking a crafted URL, a remote unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Verse

CVE-2022-42447

Cross-origin resource sharing vulnerability affects HCL Compass

HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hcl Compass

CVE-2023-37536

HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

CVSS 3.1 · 8.2 High EPSS 1.9% KEV · Not listed

Vendors

Apache Fedoraproject Hcltech and 1 more

Products

Xerces-c\+\+ Fedora Bigfix Platform and 1 more

CVE-2023-28008

HCL Workload Automation is vulnerable to XML External Entity (XXE) Injection

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Workload Automation

CVE-2023-28009

HCL Workload Automation is vulnerable to XML External Entity (XXE) Injection

HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Workload Automation

CVE-2023-23343

HCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability.

A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Osd Bare Metal Server

CVE-2023-28006

HCL BigFix OSD Bare Metal Server is affected by a weak cryptographic algorithm.

The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Osd Bare Metal Server

CVE-2023-28016

HCL BigFix OSD Bare Metal Server is affected by a host header injection vulnerability

Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Osd Bare Metal Server

CVE-2023-28017

HCL Connections is vulnerable to cross-site scripting

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Connections

CVE-2023-28022

HCL Connections is vulnerable to sensitive information disclosure

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Connections

CVE-2024-30122

HCL Sametime is impacted by misconfigured security related HTTP headers

HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Sametime

CVE-2024-23588

A denial of service vulnerability affects HCL Nomad server on Domino

HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Nomad Server On Domino

CVE-2024-23562

HCL Domino is susceptible to an information disclosure vulnerability

A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vulnerability to obtain information to launch further attacks against the affected system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Domino

CVE-2023-45698

HCL Sametime is impacted by clickjacking

Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Sametime Chat And Meetings

CVE-2023-37539

HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability

The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Domino

CVE-2023-37538

HCL Digital Experience is susceptible to cross site scripting (XSS)

HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Digital Experience

CVE-2023-37537

HCL AppScan Presence deployed as Windows service might be vulnerable to an Unquoted Service Path vulnerability

An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Appscan Presence

CVE-2023-37533

HCL Connections is vulnerable to reflected cross-site scripting

HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Connections

CVE-2023-37532

A path traversal vulnerability affects HCL Commerce

HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Commerce