HCL Software vulnerabilities
400 vulnerabilities
Known vulnerabilities in HCL Software products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 119 products.
Products
50 of 119- Dryice Myxalytics24 vulnerabilities
- Bigfix Platform21 vulnerabilities
- HCL Bigfix Service Management18 vulnerabilities
- AION13 vulnerabilities
- HCL Launch11 vulnerabilities
- IEM11 vulnerabilities
- Connections10 vulnerabilities
- HCL Leap10 vulnerabilities
- Bigfix Service Management (SM)9 vulnerabilities
- Dfxanalytics9 vulnerabilities
- HCL Connections8 vulnerabilities
- Sametime8 vulnerabilities
- HCL Icontrol7 vulnerabilities
- HCL Sametime7 vulnerabilities
- Bigfix Compliance6 vulnerabilities
- Bigfix Patch Management Download Plug Ins6 vulnerabilities
- HCL Domino Leap6 vulnerabilities
- Icontrol6 vulnerabilities
- Nomad Server On Domino6 vulnerabilities
- Bigfix Saas Remediate5 vulnerabilities
- Devops Deploy / Launch5 vulnerabilities
- HCL Bigfix Platform5 vulnerabilities
- HCL Devops Deploy / HCL Launch5 vulnerabilities
- Iautomate5 vulnerabilities
- Myxalytics5 vulnerabilities
- Bigfix Insights For Vulnerability Remediation4 vulnerabilities
- Dryice AEX4 vulnerabilities
- Dryice Optibot Reset Station4 vulnerabilities
- HCL Bigfix Mobile / Modern Client Management4 vulnerabilities
- HCL Commerce4 vulnerabilities
- HCL Digital Experience4 vulnerabilities
- HCL Myxalytics4 vulnerabilities
- HCL Traveler4 vulnerabilities
- HCL Unica Platform4 vulnerabilities
- Unica Platform4 vulnerabilities
- Bigfix Mobile3 vulnerabilities
- Bigfix Remote Control3 vulnerabilities
- Connections Docs3 vulnerabilities
- Dfxserver3 vulnerabilities
- Domino3 vulnerabilities
- HCL Bigfix OSD Bare Metal Server3 vulnerabilities
- HCL Bigfix OSD Bare Metal Server Webui3 vulnerabilities
- HCL Bigfix Webui3 vulnerabilities
- HCL Compass3 vulnerabilities
- HCL Domino3 vulnerabilities
- HCL Domino Volt3 vulnerabilities
- HCL Inotes3 vulnerabilities
- HCL SX3 vulnerabilities
- HCL Traveler For Microsoft Outlook (Htmo)3 vulnerabilities
- HCL Versionvault Express3 vulnerabilities
CVE-2021-27761hcl softwarebigfix platform+1
EPSS score0.37%
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacksCVE-2021-27762hcl softwarebigfix platform+1EPSS score0.72%
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responsesCVE-2021-27784hcl softwarehcl launch+1EPSS score0.21%
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.CVE-2021-27767hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27788hcl softwareverse+1EPSS score0.57%
HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.CVE-2021-27765hcl softwarebigfix platform+1EPSS score0.34%
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27751hcl softwarehcl commerce+1EPSS score0.19%
HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.CVE-2021-27774hcl softwarehcl digital experience+1EPSS score0.42%
User input included in error response, which could be used in a phishing attack.CVE-2021-27758hcl softwarehcl bigfix inventory+1EPSS score0.36%
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.CVE-2021-27783hcl softwarehcl bigfix mobile / modern client management+2EPSS score0.38%
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-27778hcl softwarehcl traveler+1EPSS score0.38%
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.CVE-2021-27785hcl softwarehcl commerce+1EPSS score0.18%
HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.CVE-2021-27781hcl softwarehcl bigfix mobile / modern client management+2EPSS score0.45%
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27766hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27782hcl softwarebigfix mobile+1EPSS score0.35%
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced.
User should be locked out for multiple invalid attempts.CVE-2021-27772hcl softwaresametime+1EPSS score0.68%
Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.CVE-2021-27760hcl softwarehcl notes+1EPSS score0.73%
An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.CVE-2021-27768hcl softwareverse for android+1EPSS score0.33%
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.CVE-2021-27777hcl softwarehcl unica+1EPSS score0.85%
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.CVE-2021-27771hcl softwaresametime+1EPSS score0.73%
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.