Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 582

Export CSV
CVE-2023-37520

HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Platform
CVE-2023-37513

HCL Traveler To Do is vulnerable to revealing sensitive information via the task switcher

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Traveler To Do
CVE-2023-37512

HCL Traveler Companion is vulnerable to revealing sensitive information via the task switcher

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Traveler Companion
CVE-2023-37511

HCL Traveler To Do is affected by App Transport Security (ATS) settings allowing insecure loads in web content

If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Traveler To Do
CVE-2023-37504

An insufficient session expiration vulnerability affects HCL Compass

HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called.  If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Compass
CVE-2023-37503

A weak password requirements vulnerability affects HCL Compass

HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Compass
CVE-2023-37502

An unrestricted file upload vulnerability affects HCL Compass

HCL Compass is vulnerable to lack of file upload security.  An attacker could upload files containing active code that can be executed by the server or by a user's web browser.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Compass
CVE-2023-37501

A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Campaign

A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign.  An attacker could hijack a user's session and perform other attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Unica
CVE-2023-37500

A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform.  An attacker could hijack a user's session and perform other attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Unica
CVE-2023-37499

A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform.  An attacker could hijack a user's session and perform other attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Unica
CVE-2023-37498

HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignation

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.  It is possible that an attacker could potentially escalate their privileges.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Unica
CVE-2023-37497

An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Unica
CVE-2023-37496

HCL Verse is susceptible to a Stored Cross-Site Scripting (XSS) Vulnerability

HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Verse
CVE-2023-28025

An HTML injection vulnerability can affect HCL BigFix Mobile / Modern Client Management

Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Modern Client Management
CVE-2023-28023

HCL BigFix WebUI Software Distribution is affected by a cross site server request forgery vulnerability

A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network). 

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Webui
CVE-2023-28021

BigFix WebUI is vulnerable to use of a risky cryptographic algorithm

The BigFix WebUI uses weak cipher suites.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Webui
CVE-2023-28020

URL redirection affects BigFix WebUI

 URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Webui
CVE-2023-28019

An SQL injection affects BigFix WebUI API

Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Webui
CVE-2023-28014

HCL BigFix Mobile can be affected by a cross-site scripting (XSS) vulnerability

HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Mobile
CVE-2023-28013

HCL Verse is susceptible to a Reflected Cross-Site Scripting (XSS) Vulnerability

HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Verse