Vendor
HCL Software
622 known vulnerabilities.
Products
622 results · Feed
-
Low 3.7
Lack of input validation vulnerability affects DRYiCE AEX v10
HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system which can cause the system to behave in unexpected ways.
-
Low 3.7
Lack of Clickjacking Protection vulnerability affects DRYiCE AEX v10
HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.
-
Medium 5.4
HCL Connections is vulnerable to a cross-site scripting (XSS) vulnerability
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal co…
-
Low 3.5
HCL Connections is vulnerable to broken access control
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.
-
Low 2.9
HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application
HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.
-
Low 3.7
HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header
HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection.
-
Medium 4.4
HCL Connections Docs is vulnerable to Cross-Site Scripting (XSS)
HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to credentials disclosure and possibly launch additional attacks.
-
High 8.4
HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability
The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack …
-
Medium 6.5
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs)
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access to the database to recover some or all encrypted values.
-
Medium 6.5
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values.
-
Medium 5.9
HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiation
SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.
-
Medium 5.7
HCL BigFix Platform is susceptible to Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).
-
Medium 6.7
HCL BigFix Platform is susceptible to insufficiently protected credentials
An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.
-
High 7.1
HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
-
Medium 6.5
HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability
HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enabl…
-
Medium 6.5
HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint
Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized acc…
-
Low 3.5
HCL Connections is vulnerable to broken access control
HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.
-
Low 3.5
HCL Connections is vulnerable to a user enumeration vulnerability
HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack.
-
Medium 6.3
HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout
HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
-
Medium 4.3
HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability
HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values.
-
Medium 4.4
HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type
HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type.
-
Medium 6.1
HCL DevOps Deploy / Launch is generating an obsolete HTTP header
HCL DevOps Deploy / Launch is generating an obsolete HTTP header.
-
Low 3.7
Insecure SQL Interface affects HCL DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malicious user can run arbitrary SQL commands including changing system configuration.
-
Medium 6.6
HCL BigFix Asset Discovery is affected by a security vulnerability
The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry.
-
Medium 5.3
HCL BigFix Inventory is vulnerable to path traversal
The HCL BigFix Inventory server is vulnerable to path traversal which enables an attacker to read internal application files from the Inventory server. The BigFix Inventory server does not properly restrict the served static file.
-
Low 3.5
HCL BigFix Platform is susceptible to a Denial of Service attack
The console may experience a service interruption when processing file names with invalid characters.
-
Low 2.0
HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack
An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.
-
Low 3.5
HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)
An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.
-
Low 3.9
HCL Sametime Chat is affected by an unimplemented feature in the UI
Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data.
-
Medium 5.9
HCL Domino is susceptible to a weak cryptography vulnerability
Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm. This could enable attackers with ac…
-
Medium 5.5
HCL Connections s vulnerable to possible denial of service for certain users
HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request an attacker could exploit this vulnerability to cause denial of service for affected users.
-
Medium 4.8
HCL Sametime is impacted by clickjacking
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.
-
Medium 4.0
HCL Sametime is impacted by an autocomplete enabled vulnerability
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
-
Low 3.9
HCL Sametime is impacted by a failure to invalidate sessions
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.
-
Low 1.7
HCL Sametime is impacted by a sensitive information disclosure
Sametime is impacted by sensitive information passed in URL.
-
Medium 5.9
HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.
-
Medium 6.2
HCL DevOps Deploy / HCL Launch (UCD) may be vulnerable to sensitive information disclosure
HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent.
-
Medium 6.5
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.
-
Low 3.0
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.
-
Low 3.3
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access.