Vendor
HCL Software
622 known vulnerabilities.
Products
622 results · Feed
-
Low 3.0
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.
-
Low 3.0
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information. This is not the same vulnerability …
-
Medium 5.4
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering conte…
-
Medium 6.4
A code injection vulnerability affects HCL BigFix ServiceNow Data Flow
HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user.
-
Medium 5.6
HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags
Missing or insecure tags in the HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower could allow an attacker to execute a malicious script on the user's browser.
-
Medium 5.6
HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags
HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower has missing or insecure tags that could allow an attacker to execute a malicious script on the user's browser.
-
Low 2.3
HCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosure
HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to execute a malicious attack.
-
High 8.8
Path Traversal Arbitrary File Read affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory. The produc…
-
High 8.2
Unauthenticated File Upload affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.
-
High 7.6
Path Traversal which allows file upload capability affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.
-
High 7.6
Improper Access Control affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive informati…
-
High 7.1
Insecure Direct Object Reference (IDOR) affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a result of improper access control.
-
High 8.3
Improper Access Control (Controller APIs) affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.
-
Medium 5.4
Unauthenticated File Downloads affect DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files.
-
Low 3.7
Open Redirect affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats.
-
Low 3.1
An information disclosure affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information.
-
Low 3.1
Improper Error Handling affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker with insight into the application, system, etc.
-
High 8.2
A broken cryptographic algorithm impacts MyXalytics
HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information.
-
High 8.2
Insecure key rotation affects MyXalytics
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.
-
Medium 6.2
HCL Launch Agent as a Windows service is vulnerable to a Denial of Service
An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts..
-
Medium 4.3
HCL Launch is susceptible to sensitive information disclosure
HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
-
High 7.7
HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.
-
High 7.7
HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server.
-
Medium 6.6
An HTML injection vulnerability can affect HCL BigFix Mobile / Modern Client Management
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all u…
-
Medium 4.3
HCL Launch is susceptible to an HTML injection vulnerability
HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
-
Medium 5.3
HCL Launch is susceptible to a Denial of Service vulnerability
HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion.
-
Low 3.5
HCL Connections is vulnerable to sensitive information disclosure
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
-
Medium 5.4
HCL Connections is vulnerable to cross-site scripting
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. …
-
Medium 5.4
HCL Connections is vulnerable to reflected cross-site scripting
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script cod…
-
Medium 5.8
A path traversal vulnerability affects HCL Commerce
HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.
-
High 8.1
A weak password requirements vulnerability affects HCL Compass
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.
-
High 7.1
An insufficient session expiration vulnerability affects HCL Compass
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to…
-
Critical 9.0
An unrestricted file upload vulnerability affects HCL Compass
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
-
High 7.8
HCL AppScan Presence deployed as Windows service might be vulnerable to an Unquoted Service Path vulnerability
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.
-
Critical 9.3
HCL Digital Experience is susceptible to cross site scripting (XSS)
HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
-
High 8.2
HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
-
Medium 6.5
HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to weak cryptography
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.
-
Medium 6.5
HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper credential handling
BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.
-
Medium 4.6
HCL BigFix Patch Management is vulnerable to insecurely stored credentials
Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.
-
Medium 4.0
HCL Domino is susceptible to a sensitive information disclosure vulnerability
In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.