Vendor
HCL Software
622 known vulnerabilities.
Products
622 results · Feed
-
Low 3.2
HCL Domino Volt and Domino Leap are affected by missing "no cache" headers
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
-
Medium 4.6
HCL Domino Volt is affected by Cross-site scripting (XSS)
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
-
Medium 4.6
HCL Domino Volt is affected by an unrestricted upload of a dangerous file type
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
-
Medium 4.6
HCL Domino Volt is affected by an unrestricted upload of a dangerous file type
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.
-
Medium 6.5
HCL SX is affected by usage of a weak cryptographic algorithm
HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify data, or other impacts.
-
Medium 4.6
HCL Leap is affected by Cross-site scripting (XSS)
Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.
-
Medium 4.6
HCL Leap is affected by an unrestricted upload of file with dangerous type vulnerability
Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.
-
Low 3.2
HCL Leap is affected by missing "no cache" headers
Missing "no cache" headers in HCL Leap permits user directory information to be cached.
-
Low 3.2
HCL Leap is affected by missing "no cache" headers
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
-
High 7.1
HCL Leap is affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
-
Medium 5.3
HCL Leap is affected by a disclosure of private personal information vulnerability
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
-
Medium 6.3
HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
-
Low 3.7
HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
-
Medium 6.5
HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
-
Medium 4.1
HCL Leap is affected by improper access control
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
-
Low 2.5
HCL MyXalytics is affected by a failure to restrict URL access vulnerability
HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential information, creating a risk of misuse, manipulation, or unauthorized distribution.
-
Low 2.6
HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities
HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept and decrypt encrypted data, steal sensitive information, or inject malicious code into the system.
-
Low 2.1
HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attack
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability coul…
-
Medium 5.6
HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack
HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.
-
Medium 4.8
HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attack
HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input.
-
Low 3.5
HCL Connections is vulnerable to an information disclosure vulnerability
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
-
Medium 4.3
An internal path disclosure vulnerability affects HCL Traveler
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.
-
Medium 4.3
HCL Traveler is affected by generation of error messages containing sensitive information
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights …
-
Medium 5.4
HCL DevOps Deploy / HCL Launch is susceptible to an HTML injection vulnerability
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
-
Medium 6.3
HCL DevOps Deploy / HCL Launch is susceptible to unauthorized access to other services
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.
-
Medium 5.5
HCL DevOps Deploy / HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability
HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.
-
Medium 5.5
HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
-
High 7.2
HCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability
HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.
-
Medium 4.3
HCL DevOps Deploy / HCL Launch is susceptible to a sensitive information disclosure
HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.
-
Medium 5.9
HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226.
HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept and potentially alter communication between two parties.
-
Low 2.6
HCL MyXalytics is affected by concurrent login vulnerability
HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive info…
-
Medium 4.3
A path traversal vulnerability in HCL AppScan Traffic Recorder
HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the restricted directory. Potential exploits can completely disrupt or takeover the application or the …
-
Medium 5.3
HCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability
HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
-
Medium 5.3
An unauthenticated privilege escalation vulnerability affects HCL MyCloud
HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated us…
-
Low 3.9
HCL Connections Docs is vulnerable to a sensitive information disclosure
HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
-
Medium 5.5
HCL iAutomate is affected by a session fixation vulnerability
HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session.
-
Medium 5.3
HCL BigFix Patch Download Plug-ins are affected by path traversal vulnerability
BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository which is vulnerable to path traversal attacks.
-
Low 2.8
HCL BigFix Patch Download Plug-ins are affected by an insecure protocol support
BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation.
-
Low 2.5
HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of se…
-
Low 2.5
HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme
BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using the file:// URI scheme.