Vendor
HCL Software
622 known vulnerabilities.
Products
311 results · Clear filters · Feed
-
Medium 6.5
HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
-
Medium 4.9
HCL Launch is vulnerable to Insufficiently Protected LDAP Search Credentials (CVE-2022-42445)
HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches.
-
Medium 6.2
HCL Workload Automation is affected by a vulnerability in Jlog component of the Master Domain Manager
HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.
-
Medium 5.5
HCL Domino is susceptible to an information disclosure vulnerability
HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access at…
-
Medium 5.9
HCL Verse for Android is susceptible to an APK signing key check vulnerability
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
-
Medium 5.9
HCL Launch container images may contain non-unique https certificates and database encryption key
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.
-
Medium 6.0
An insufficiently protected credential vulnerability affects HCL VersionVault Express
HCL VersionVault Express exposes administrator credentials.
-
Medium 5.9
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
-
Medium 6.1
HCL iNotes is susceptible to a link to non-existent domain vulnerability.
HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.
-
Medium 5.3
HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551)
HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.
-
Medium 4.6
HCL BigFix Web Reports authorized users may perform HTML injection.
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
-
Medium 5.0
HCL BigFix Web Reports authorized users may see sensitive information in clear text
BigFix Web Reports authorized users may see SMTP credentials in clear text.
-
Medium 4.0
HCL Launch could disclose sensitive database information to a local user in plain text.
HCL Launch may store certain data for recurring activities in a plain text format.
-
Medium 4.9
HCL Launch is vulnerable to information disclosure which can be read by a local user.
HCL Launch stores user credentials in plain clear text which can be read by a local user.
-
Medium 4.6
HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and serve…
-
Medium 4.9
HCL Traveler is susceptible to a cross-site scripting vulnerability which could allow an attacker to execute a malicious script to access sensitive information.
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to ac…
-
Medium 6.6
HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
-
Medium 5.3
HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
-
Medium 6.8
HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
-
Medium 4.2
HCL Sametime is vulnerable to clickjacking
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
-
Medium 6.8
HCL Sametime is vulnerable to arbitrary HTTP requests
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online m…
-
Medium 5.3
HCL Sametime is vulnerable to an information disclosure
Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that cou…
-
Medium 6.3
An SSL certificate host verification vulnerability affects HCL Verse for Android
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a pro…
-
Medium 6.7
HCL BigFix Platform Console is affected by a Privilege Escalation Vulnerability
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the…
-
Medium 6.7
HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the …
-
Medium 6.7
HCL BigFix Platform Server API is affected by Privilege Escalation Vulnerability
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with …
-
Medium 4.7
HCL BigFix Platform is affected by misconfigured security-related HTTP headers
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
-
Medium 4.8
HCL BigFix Platform is affected by weak web transport security
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks
-
Medium 4.6
HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart
An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascri…
-
Medium 4.3
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login afte…
-
Medium 4.4
HCL Commerce is affected by an Insufficient Session Expiration vulnerability.
HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.