Filtered by vendor Hcltech Subscriptions
Total 193 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-50345 1 Hcltech 1 Dryice Myxalytics 2024-11-21 3.7 Low
HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats.
CVE-2023-50344 1 Hcltech 1 Dryice Myxalytics 2024-11-21 5.4 Medium
HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files.
CVE-2023-50343 1 Hcltech 1 Dryice Myxalytics 2024-11-21 8.3 High
HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.
CVE-2023-50342 1 Hcltech 1 Dryice Myxalytics 2024-11-21 7.1 High
HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability.  A user can obtain certain details about another user as a result of improper access control.
CVE-2023-50341 1 Hcltech 1 Dryice Myxalytics 2024-11-21 7.6 High
HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint.
CVE-2023-45724 1 Hcltech 1 Dryice Myxalytics 2024-11-21 8.2 High
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.
CVE-2023-45723 1 Hcltech 1 Dryice Myxalytics 2024-11-21 7.6 High
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.
CVE-2023-45722 1 Hcltech 1 Dryice Myxalytics 2024-11-21 8.8 High
HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.  The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.
CVE-2023-45718 1 Hcltech 1 Sametime 2024-11-21 3.9 Low
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.  
CVE-2023-45716 1 Hcltech 1 Sametime 2024-11-21 1.7 Low
Sametime is impacted by sensitive information passed in URL.
CVE-2023-45698 1 Hcltech 1 Sametime Chat And Meetings 2024-11-21 4.8 Medium
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.
CVE-2023-45696 1 Hcltech 1 Sametime 2024-11-21 4 Medium
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
CVE-2023-37539 1 Hcltech 1 Domino 2024-11-21 8.4 High
The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it.
CVE-2023-37538 1 Hcltech 1 Digital Experience 2024-11-21 9.3 Critical
HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
CVE-2023-37537 1 Hcltech 1 Appscan Presence 2024-11-21 7.8 High
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.
CVE-2023-37536 4 Apache, Fedoraproject, Hcltech and 1 more 4 Xerces-c\+\+, Fedora, Bigfix Platform and 1 more 2024-11-21 8.2 High
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
CVE-2023-37533 1 Hcltech 1 Connections 2024-11-21 5.4 Medium
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
CVE-2023-37532 1 Hcltech 1 Commerce 2024-11-21 5.8 Medium
HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.
CVE-2023-37528 1 Hcltech 1 Bigfix Platform 2024-11-21 6.5 Medium
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.
CVE-2023-37527 1 Hcltech 1 Bigfix Platform 2024-11-21 5.4 Medium
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.