Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 11 of 15
Dec 7, 2023HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an uCVE-2023-28017 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
- Product
- HCL Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 8, 2023HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browseCVE-2023-37533 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
- Product
- HCL Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 7, 2023Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.CVE-2023-42541 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.
- Product
- Samsung Push Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.CVE-2023-46551 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
- Product
- x2000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.CVE-2023-37532 · Websites & servers · HCL Software · reported by psirt@hcl.comMedium 5.8
HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.
- Product
- HCL Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to insecure password requirements.CVE-2023-37503 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.
- Product
- HCL Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to failure to invalidate sessions.CVE-2023-37504 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
- Product
- HCL Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to lack of file upload security.CVE-2023-37502 · Other software · HCL Software · reported by psirt@hcl.comCritical 9
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
- Product
- HCL Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 17, 2023An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gainCVE-2023-37537 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.8
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.
- Product
- HCL AppScan Presence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 11, 2023HCL Digital Experience is susceptible to cross site scripting (XSS).CVE-2023-37538 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.3
HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
- Product
- Digital Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 11, 2023An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.CVE-2023-37536 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Oct 11, 2023BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content.CVE-2022-44758 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.
- Product
- BigFix Insights for Vulnerability Remediation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 11, 2023BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure.CVE-2022-44757 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.
- Product
- BigFix Insights for Vulnerability Remediation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 11, 2023Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.CVE-2022-42451 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.
- Product
- BigFix Patch Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Sep 8, 2023In some configuration scenarios, the Domino server host name can be exposed.CVE-2023-28010 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.
- Product
- HCL Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37513 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
- Product
- HCL Traveler To Do
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37512 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
- Product
- HCL Traveler Companion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 10, 2023If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.CVE-2023-37511 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.
- Product
- HCL Traveler To Do
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 10, 2023If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.CVE-2023-23342 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.
- Product
- HCL Nomad for web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 9, 2023HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm.CVE-2023-23347 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
- Product
- HCL DRYiCE iAutomate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 9, 2023HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm.CVE-2023-23346 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
- Product
- HCL DRYiCE MyCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign.CVE-2023-37501 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
- Product
- HCL Unica Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform.CVE-2023-37500 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.
- Product
- HCL Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform.CVE-2023-37499 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.
- Product
- HCL Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.CVE-2023-37498 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.
- Product
- HCL Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023The Unica application exposes an API which accepts arbitrary XML input.CVE-2023-37497 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
- Product
- HCL Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 31, 2023HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability.CVE-2023-37496 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
- Product
- HCL Verse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 26, 2023HCL BigFix Mobile is vulnerable to a cross-site scripting attack.CVE-2023-28014 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.
- Product
- HCL BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 26, 2023HCL BigFix Mobile is vulnerable to a command injection attack.CVE-2023-28012 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.
- Product
- HCL BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 26, 2023HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability.CVE-2023-28013 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
- Product
- HCL Verse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2023A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access filesCVE-2023-28023 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.9
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network).
- Product
- HCL BigFix WebUI Software Distribution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2023The BigFix WebUI uses weak cipher suites.CVE-2023-28021 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
The BigFix WebUI uses weak cipher suites.
- Product
- HCL BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2023 URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.CVE-2023-28020 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
- Product
- HCL BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2023Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.CVE-2023-28019 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
- Product
- HCL BigFix WebUI API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 10, 2023HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.CVE-2023-23348 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.1
HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 23, 2023A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.CVE-2023-23344 · Other software · HCL Software · reported by psirt@hcl.comLow 3
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
- Product
- HCL BigFix WebUI Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 22, 2023Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD BarCVE-2023-28016 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.
- Product
- HCL BigFix OSD Bare Metal Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 22, 2023The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.CVE-2023-28006 · Other software · HCL Software · reported by psirt@hcl.comHigh 7
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.
- Product
- HCL BigFix OSD Bare Metal Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 22, 2023A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a userCVE-2023-23343 · Other software · HCL Software · reported by psirt@hcl.comLow 2.4
A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.
- Product
- HCL BigFix OSD Bare Metal Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 23, 2023The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.CVE-2023-28015 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users.
- Product
- Domino AppDev Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 26, 2023HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2023-28009 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- Product
- Workload Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 26, 2023HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2023-28008 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- Product
- Workload Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 2, 2023HCL Launch is vulnerable to HTML injection.CVE-2022-42452 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 2, 2023HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS).CVE-2022-42447 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.6
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.
- Product
- HCL Compass2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Mar 10, 2023HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability.CVE-2021-27788 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
- Product
- Verse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 11, 2023An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.CVE-2022-38657 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
- Product
- Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 20, 2023HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced.CVE-2021-27782 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
- Product
- BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 23, 2022BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text.CVE-2022-38658 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.7
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.
- Product
- BigFix Server Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 21, 2022Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation.CVE-2022-44756 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged access.
- Product
- BigFix Insights for Vulnerability Remediation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 21, 2022Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.CVE-2022-42454 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged network access.
- Product
- BigFix Insights for Vulnerability Remediation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.