Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Hcltech Subscribe
Total 110 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-14230 1 Hcltech 1 Domino 2020-12-01 5.0 MEDIUM 7.5 HIGH
HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the server. Versions previous to releases 9.0.1 FP10 IF6, 10.0.1 FP5 and 11.0.1 are affected.
CVE-2020-14234 1 Hcltech 1 Domino 2020-12-01 5.0 MEDIUM 7.5 HIGH
HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an attacker the ability to crash the server. Versions previous to release 9.0.1 FP10 IF6 and release 10.0.1 are affected.
CVE-2020-14258 1 Hcltech 1 Notes 2020-12-01 5.0 MEDIUM 7.5 HIGH
HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.
CVE-2020-14240 1 Hcltech 1 Notes 2020-11-19 4.3 MEDIUM 6.1 MEDIUM
HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. An attacker could use this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
CVE-2020-4097 1 Hcltech 1 Notes 2020-11-19 4.6 MEDIUM 6.8 MEDIUM
In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 previous to 11.0.1 FixPack 1, a vulnerability in the input parameter handling of the Notes Client could potentially be exploited by an attacker resulting in a buffer overflow. This could enable an attacker to crash HCL Notes or execute attacker-controlled code on the client.
CVE-2020-14222 1 Hcltech 1 Hcl Digital Experience 2020-11-13 4.3 MEDIUM 6.1 MEDIUM
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
CVE-2019-4325 1 Hcltech 1 Appscan 2020-10-19 5.0 MEDIUM 5.3 MEDIUM
"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."
CVE-2019-4326 1 Hcltech 1 Appscan 2020-10-19 5.0 MEDIUM 7.5 HIGH
"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header."
CVE-2020-14223 1 Hcltech 1 Digital Experience 2020-10-08 4.3 MEDIUM 6.1 MEDIUM
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.
CVE-2019-4301 1 Hcltech 1 Self-service Application 2020-08-24 6.0 MEDIUM 8.4 HIGH
BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.
CVE-2019-4091 1 Hcltech 1 Marketing Campaign 2020-07-22 3.5 LOW 5.4 MEDIUM
"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "
CVE-2020-4104 1 Hcltech 1 Bigfix Webui 2020-07-22 3.5 LOW 5.4 MEDIUM
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a.
CVE-2019-4090 1 Hcltech 1 Marketing Campaign 2020-07-22 3.5 LOW 5.4 MEDIUM
"HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field."
CVE-2019-4324 1 Hcltech 1 Appscan 2020-07-15 4.3 MEDIUM 6.1 MEDIUM
"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
CVE-2019-4323 1 Hcltech 1 Appscan 2020-07-15 4.3 MEDIUM 4.3 MEDIUM
"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
CVE-2017-1712 1 Hcltech 1 Domino 2020-07-10 4.3 MEDIUM 5.9 MEDIUM
"A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions."
CVE-2020-4101 1 Hcltech 1 Hcl Digital Experience 2020-06-17 7.5 HIGH 9.8 CRITICAL
"HCL Digital Experience is susceptible to Server Side Request Forgery."
CVE-2020-4092 1 Hcltech 1 Hcl Nomad 2020-05-12 5.0 MEDIUM 5.3 MEDIUM
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."
CVE-2019-4209 1 Hcltech 1 Connections 2020-05-05 5.8 MEDIUM 6.1 MEDIUM
HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks.
CVE-2019-4327 1 Hcltech 1 Appscan 2020-04-29 5.0 MEDIUM 7.5 HIGH
"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files."