Hcltech vulnerabilities
473 vulnerabilities
Known vulnerabilities in Hcltech products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 96 products.
Products
50 of 96- Bigfix Service Management36 vulnerabilities
- Bigfix Platform33 vulnerabilities
- Dryice Myxalytics31 vulnerabilities
- Aion29 vulnerabilities
- Connections24 vulnerabilities
- Domino22 vulnerabilities
- Unica18 vulnerabilities
- Aftermarket Cloud17 vulnerabilities
- Sametime17 vulnerabilities
- Dfxanalytics14 vulnerabilities
- Icontrol13 vulnerabilities
- Digital Experience11 vulnerabilities
- Hcl Leap11 vulnerabilities
- Notes11 vulnerabilities
- Bigfix Mobile10 vulnerabilities
- Bigfix Compliance9 vulnerabilities
- Domino Leap9 vulnerabilities
- Dryice Mycloud9 vulnerabilities
- Intelliops Event Management9 vulnerabilities
- Appscan8 vulnerabilities
- Traveler For Microsoft Outlook8 vulnerabilities
- Bigfix Webui7 vulnerabilities
- Hcl Inotes7 vulnerabilities
- Bigfix Modern Client Management6 vulnerabilities
- Dryice Iautomate6 vulnerabilities
- Traveler6 vulnerabilities
- Bigfix Insights For Vulnerability Remediation5 vulnerabilities
- Devops Plan5 vulnerabilities
- Verse5 vulnerabilities
- Bigfix Saas4 vulnerabilities
- Devops Loop4 vulnerabilities
- Devops Velocity4 vulnerabilities
- Dfx Server4 vulnerabilities
- Dryice Aex4 vulnerabilities
- Hcl Compass4 vulnerabilities
- Hcl Digital Experience4 vulnerabilities
- Nomad Server On Domino4 vulnerabilities
- Appscan Source3 vulnerabilities
- Bigfix Osd Bare Metal Server3 vulnerabilities
- Bigfix Webui Insights3 vulnerabilities
- Digital Experience Compose3 vulnerabilities
- Hcl Nomad3 vulnerabilities
- Hcl Sx3 vulnerabilities
- Traveler Companion3 vulnerabilities
- Unica Centralized Offer Management3 vulnerabilities
- Versionvault Express3 vulnerabilities
- Bigfix Inventory2 vulnerabilities
- Bigfix Webui Api2 vulnerabilities
- Bigfix Webui Application Administration2 vulnerabilities
- Bigfix Webui Cmep2 vulnerabilities
CVE-2018-11518hcltechlegacy_ivr_firmware
EPSS score1.40%
A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them for service activations. This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece).CVE-2021-27761hcl softwarebigfix platform+1EPSS score0.37%
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacksCVE-2021-27762hcl softwarebigfix platform+1EPSS score0.72%
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responsesCVE-2021-27784hcl softwarehcl launch+1EPSS score0.21%
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.CVE-2021-27756hcltechbigfix_complianceEPSS score0.57%
"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it."CVE-2021-27767hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27788hcl softwareverse+1EPSS score0.57%
HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.CVE-2021-27755hcltechhcl_sametimeEPSS score0.25%
"Sametime Android potential path traversal vulnerability when using File class"CVE-2021-27765hcl softwarebigfix platform+1EPSS score0.34%
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27774hcl softwarehcl digital experience+1EPSS score0.42%
User input included in error response, which could be used in a phishing attack.CVE-2021-27758hcl softwarehcl bigfix inventory+1EPSS score0.36%
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.CVE-2021-27783hcl softwarehcl bigfix mobile / modern client management+2EPSS score0.38%
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-27778hcl softwarehcl traveler+1EPSS score0.38%
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.CVE-2021-27781hcl softwarehcl bigfix mobile / modern client management+2EPSS score0.45%
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27766hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27757hcltechbigfix_insightsEPSS score0.58%
" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Since the information is stored in cleartext, attackers could potentially read it and gain access to sensitive information."CVE-2021-27782hcl softwarebigfix mobile+1EPSS score0.35%
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced.
User should be locked out for multiple invalid attempts.CVE-2021-27772hcl softwaresametime+1EPSS score0.68%
Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.CVE-2021-27760hcl softwarehcl notes+1EPSS score0.73%
An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.CVE-2021-27768hcl softwareverse for android+1EPSS score0.33%
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.