Export limit exceeded: 10159 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 582

Export CSV
CVE-2023-28012

HCL BigFix Mobile can be affected by a command injection vulnerability

HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Mobile
CVE-2023-28010

HCL Domino is susceptible to a sensitive information disclosure vulnerability

In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Domino
CVE-2023-23347

Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomate

HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Dryice Iautomate
CVE-2023-23346

Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud

HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Dryice Mycloud
CVE-2023-23344

HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorization

A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Webui Insights
CVE-2023-23342

HCL Nomad for web is affected by cryptographic validation of local data access that can be circumvented

If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented. 

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Hcl Nomad
CVE-2022-44758

HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper credential handling

BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Insights For Vulnerability Remediation
CVE-2022-44757

HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to weak cryptography

BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Insights For Vulnerability Remediation
CVE-2022-42451

HCL BigFix Patch Management is vulnerable to insecurely stored credentials

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Patch Management
CVE-2022-27563

Overload/denial of service affects HCL VersionVault Express

An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Versionvault Express
CVE-2022-27561

HCL Traveler is susceptible to a Reflected Cross-Site Scripting vulnerability in the web admin (LotusTraveler.nsf)

There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Traveler
CVE-2022-27560

An insufficiently protected credential vulnerability affects HCL VersionVault Express

HCL VersionVault Express exposes administrator credentials.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Versionvault Express
CVE-2022-27558

HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.

HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Domino Hcl Inotes
CVE-2022-27547

HCL iNotes is susceptible to a link to non-existent domain vulnerability.

HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Domino Hcl Inotes
CVE-2022-27546

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Domino Hcl Inotes
CVE-2021-27786

HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted

Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Onetest Server
CVE-2021-27781

HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Mobile Modern Client Management
CVE-2021-27780

HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction

The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Mobile Modern Client Management
CVE-2021-27779

A Security Misconfiguration vulnerability affects HCL VersionVault Express

VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Versionvault Express