Hcl vulnerabilities, page 5
90 vulnerabilities
Known vulnerabilities in Hcl products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 20 products.
CVE-2020-14258hclhcl notes+1
EPSS score1.26%
HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.CVE-2020-4089hclhcl notes+1EPSS score1.16%
HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected.CVE-2020-4104hclhcl bigfix webui+1EPSS score0.52%
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a.CVE-2024-42206hclireflectionEPSS score0.15%
HCL iReflection Third party vulnerable and outdated components issue was detected in the web applicationCVE-2024-30151hclbigfix service management (sm)+1EPSS score0.25%
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sensitive data or unauthorized system modificationsCVE-2019-4409hclhcl traveler+1EPSS score0.52%
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability.CVE-2019-4388hclappscan source+1EPSS score0.52%
HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.CVE-2019-4209hclhcl connections+1EPSS score0.64%
HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks.CVE-2026-21791hclsametime+1EPSS score0.13%
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLCVE-2023-28015hcl softwaredomino appdev pack+1EPSS score0.45%
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users.