HCL Software HCL Sametime vulnerabilities
7 vulnerabilities
Known vulnerabilities in HCL Software HCL Sametime, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-32000hcl softwarehcl sametime
EPSS score0.21%
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.CVE-2022-42446hcl softwarehcl sametime+1EPSS score0.40%
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.CVE-2023-45716hcl softwarehcl sametime+1EPSS score0.12%
Sametime is impacted by sensitive information passed in URL.CVE-2023-45718hcl softwarehcl sametime+1EPSS score0.35%
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.CVE-2023-45696hcl softwarehcl sametime+1EPSS score0.44%
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.CVE-2023-45698hcl softwarehcl sametime+1EPSS score0.32%
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.CVE-2023-50349hcl softwarehcl sametime+1EPSS score0.24%
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.