5 results · Clear filters · Feed
-
Medium 4.3
Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.
-
Medium 4.8
HCL Sametime is impacted by clickjacking
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.
-
Medium 4.0
HCL Sametime is impacted by an autocomplete enabled vulnerability
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
-
Medium 5.9
HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.
-
Medium 6.5
HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.