Filtered by vendor Hcltech
Subscribe
Total
338 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-4107 | 1 Hcltech | 1 Domino | 2024-11-21 | 4.6 MEDIUM | 8.8 HIGH |
|
HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.
|
|||||
| CVE-2020-4104 | 1 Hcltech | 1 Bigfix Webui | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a.
|
|||||
| CVE-2020-4102 | 1 Hcltech | 1 Notes | 2024-11-21 | 7.2 HIGH | 6.7 MEDIUM |
|
HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Notes or execute attacker-controlled code on the client system.
|
|||||
| CVE-2020-4101 | 1 Hcltech | 1 Hcl Digital Experience | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
"HCL Digital Experience is susceptible to Server Side Request Forgery."
|
|||||
| CVE-2020-4099 | 1 Hcltech | 1 Verse | 2024-11-21 | N/A | 5.9 MEDIUM |
|
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
|
|||||
| CVE-2020-4097 | 1 Hcltech | 1 Notes | 2024-11-21 | 4.6 MEDIUM | 6.8 MEDIUM |
|
In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 previous to 11.0.1 FixPack 1, a vulnerability in the input parameter handling of the Notes Client could potentially be exploited by an attacker resulting in a buffer overflow. This could enable an attacker to crash HCL Notes or execute attacker-controlled code on the client.
|
|||||
| CVE-2020-4095 | 1 Hcltech | 1 Bigfix Platform | 2024-11-21 | 2.1 LOW | 6.0 MEDIUM |
|
"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."
|
|||||
| CVE-2020-4092 | 1 Hcltech | 1 Hcl Nomad | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."
|
|||||
| CVE-2020-4089 | 1 Hcltech | 1 Notes | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
|
HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected.
|
|||||
| CVE-2020-4085 | 1 Hcltech | 1 Connections | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
|
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."
|
|||||
| CVE-2020-4084 | 1 Hcltech | 1 Connections | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
|
|||||
| CVE-2020-4083 | 1 Hcltech | 1 Connections | 2024-11-21 | 2.1 LOW | 5.5 MEDIUM |
|
HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user.
|
|||||
| CVE-2020-4082 | 1 Hcltech | 1 Connections | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
|
|||||
| CVE-2020-4081 | 1 Hcltech | 1 Digital Experience | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
|
|||||
| CVE-2020-4080 | 1 Hcltech | 1 Domino | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
|
|||||
| CVE-2020-14273 | 1 Hcltech | 1 Domino | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker could could exploit this vulnerability to crash the Domino server.
|
|||||
| CVE-2020-14271 | 1 Hcltech | 1 Hcl Inotes | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
|
|||||
| CVE-2020-14270 | 1 Hcltech | 1 Domino | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.
|
|||||
| CVE-2020-14268 | 1 Hcltech | 1 Notes | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
|
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the client or inject code into the system which would execute with the privileges of the client.
|
|||||
| CVE-2020-14264 | 1 Hcltech | 1 Traveler Companion | 2024-11-21 | 2.1 LOW | 3.9 LOW |
|
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
|
|||||
| CVE-2020-14263 | 1 Hcltech | 1 Traveler Companion | 2024-11-21 | 2.1 LOW | 3.9 LOW |
|
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
|
|||||
| CVE-2020-14260 | 1 Hcltech | 1 Domino | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
|
HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
|
|||||
| CVE-2020-14258 | 1 Hcltech | 1 Notes | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.
|
|||||
| CVE-2020-14255 | 1 Hcltech | 1 Digital Experience | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. These affect containers only. These do not affect traditional on-premise installations.
|
|||||
| CVE-2020-14254 | 1 Hcltech | 1 Bigfix Platform | 2024-11-21 | 4.3 MEDIUM | 7.5 HIGH |
|
TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.
|
|||||
| CVE-2020-14248 | 1 Hcltech | 1 Bigfix Platform | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
|
|||||
| CVE-2020-14244 | 1 Hcltech | 1 Domino | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
|
A vulnerability in the MIME message handling of the Domino server (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the server or inject code into the system which would execute with the privileges of the server.
|
|||||
| CVE-2020-14240 | 1 Hcltech | 1 Notes | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. An attacker could use this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
|
|||||
| CVE-2020-14234 | 1 Hcltech | 1 Domino | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an attacker the ability to crash the server. Versions previous to release 9.0.1 FP10 IF6 and release 10.0.1 are affected.
|
|||||
| CVE-2020-14232 | 1 Hcltech | 1 Notes | 2024-11-21 | 9.0 HIGH | 8.8 HIGH |
|
A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attacker resulting in a stack buffer overflow. This could allow the attacker to crash the program or inject code into the system which would execute with the privileges of the currently logged in user.
|
|||||
| CVE-2020-14230 | 1 Hcltech | 1 Domino | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the server. Versions previous to releases 9.0.1 FP10 IF6, 10.0.1 FP5 and 11.0.1 are affected.
|
|||||
| CVE-2020-14225 | 2 Hcltech, Hcltechsw | 2 Hcl Inotes, Hcl Inotes | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
|
HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack.
|
|||||
| CVE-2020-14224 | 1 Hcltech | 1 Notes | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
|
A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the Notes application or inject code into the system which would execute with the privileges of the currently logged-in user.
|
|||||
| CVE-2020-14223 | 1 Hcltech | 1 Digital Experience | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.
|
|||||
| CVE-2020-14222 | 1 Hcltech | 1 Hcl Digital Experience | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
|
|||||
| CVE-2020-14221 | 1 Hcltech | 1 Digital Experience | 2024-11-21 | 4.0 MEDIUM | 4.9 MEDIUM |
|
HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.
|
|||||
| CVE-2019-4409 | 1 Hcltech | 1 Traveler | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability.
|
|||||
| CVE-2019-4393 | 1 Hcltech | 1 Appscan | 2024-11-21 | 5.0 MEDIUM | 9.8 CRITICAL |
|
HCL AppScan Standard is vulnerable to excessive authorization attempts
|
|||||
| CVE-2019-4392 | 1 Hcltech | 1 Appscan | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
|
HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.
|
|||||
| CVE-2019-4391 | 1 Hcltech | 1 Appscan | 2024-11-21 | 6.4 MEDIUM | 8.2 HIGH |
|
HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data
|
|||||