Filtered by vendor Hcltech Subscriptions
Total 193 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-4092 1 Hcltech 1 Hcl Nomad 2024-11-21 5.3 Medium
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."
CVE-2020-4089 1 Hcltech 1 Notes 2024-11-21 6.5 Medium
HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected.
CVE-2020-4085 1 Hcltech 1 Connections 2024-11-21 6.5 Medium
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."
CVE-2020-4084 1 Hcltech 1 Connections 2024-11-21 5.4 Medium
HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2020-4083 1 Hcltech 1 Connections 2024-11-21 5.5 Medium
HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user.
CVE-2020-4082 1 Hcltech 1 Connections 2024-11-21 5.4 Medium
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVE-2020-4081 1 Hcltech 1 Digital Experience 2024-11-21 6.1 Medium
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
CVE-2020-4080 1 Hcltech 1 Domino 2024-11-21 6.1 Medium
HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
CVE-2020-14273 1 Hcltech 1 Domino 2024-11-21 7.5 High
HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker could could exploit this vulnerability to crash the Domino server.
CVE-2020-14271 1 Hcltech 1 Hcl Inotes 2024-11-21 6.1 Medium
HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
CVE-2020-14270 1 Hcltech 1 Domino 2024-11-21 5.3 Medium
HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated attacker could exploit this vulnerability to obtain information about the XPages software running on the Domino server.
CVE-2020-14268 1 Hcltech 1 Notes 2024-11-21 9.8 Critical
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the client or inject code into the system which would execute with the privileges of the client.
CVE-2020-14264 1 Hcltech 1 Traveler Companion 2024-11-21 3.9 Low
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
CVE-2020-14263 1 Hcltech 1 Traveler Companion 2024-11-21 3.9 Low
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
CVE-2020-14260 1 Hcltech 1 Domino 2024-11-21 9.8 Critical
HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
CVE-2020-14258 1 Hcltech 1 Notes 2024-11-21 7.5 High
HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9, 10 and 11 are affected.
CVE-2020-14255 1 Hcltech 1 Digital Experience 2024-11-21 7.5 High
HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. These affect containers only. These do not affect traditional on-premise installations.
CVE-2020-14254 1 Hcltech 1 Bigfix Platform 2024-11-21 7.5 High
TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.
CVE-2020-14248 1 Hcltech 1 Bigfix Platform 2024-11-21 5.3 Medium
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVE-2020-14244 1 Hcltech 1 Domino 2024-11-21 9.8 Critical
A vulnerability in the MIME message handling of the Domino server (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the server or inject code into the system which would execute with the privileges of the server.