Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

702 results · page 11 of 15

Dec 7, 2023HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an uCVE-2023-28017 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
Product
HCL Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Nov 8, 2023HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browseCVE-2023-37533 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
Product
HCL Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Nov 7, 2023Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.CVE-2023-42541 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.
Product
Samsung Push Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.CVE-2023-46551 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
Product
x2000r_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com totolink.cn
Oct 23, 2023HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.CVE-2023-37532 · Websites & servers · HCL Software · reported by psirt@hcl.comMedium 5.8
HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.
Product
HCL Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to insecure password requirements.CVE-2023-37503 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.
Product
HCL Compass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to failure to invalidate sessions.CVE-2023-37504 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.
Product
HCL Compass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 18, 2023HCL Compass is vulnerable to lack of file upload security.CVE-2023-37502 · Other software · HCL Software · reported by psirt@hcl.comCritical 9
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
Product
HCL Compass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 17, 2023An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gainCVE-2023-37537 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.8
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.
Product
HCL AppScan Presence
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 11, 2023HCL Digital Experience is susceptible to cross site scripting (XSS).CVE-2023-37538 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.3
HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
Product
Digital Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 11, 2023An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.CVE-2023-37536 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
Product
BigFix Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Oct 11, 2023BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content.CVE-2022-44758 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.
Product
BigFix Insights for Vulnerability Remediation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 11, 2023BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure.CVE-2022-44757 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.
Product
BigFix Insights for Vulnerability Remediation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 11, 2023Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.CVE-2022-42451 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user.
Product
BigFix Patch Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Sep 8, 2023In some configuration scenarios, the Domino server host name can be exposed.CVE-2023-28010 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.
Product
HCL Domino Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37513 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
Product
HCL Traveler To Do
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37512 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
Product
HCL Traveler Companion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 10, 2023If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.CVE-2023-37511 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.
Product
HCL Traveler To Do
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 10, 2023If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.CVE-2023-23342 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.
Product
HCL Nomad for web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 9, 2023HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm.CVE-2023-23347 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Product
HCL DRYiCE iAutomate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 9, 2023HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm.CVE-2023-23346 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Product
HCL DRYiCE MyCloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 3, 2023A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign.CVE-2023-37501 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
Product
HCL Unica Campaign
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 3, 2023A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform.CVE-2023-37500 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.
Product
HCL Unica Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 3, 2023A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform.CVE-2023-37499 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.
Product
HCL Unica Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 3, 2023A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.CVE-2023-37498 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.
Product
HCL Unica Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 3, 2023The Unica application exposes an API which accepts arbitrary XML input.CVE-2023-37497 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
Product
HCL Unica Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 31, 2023HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability.CVE-2023-37496 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
Product
HCL Verse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 26, 2023HCL BigFix Mobile is vulnerable to a cross-site scripting attack.CVE-2023-28014 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.
Product
HCL BigFix Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 26, 2023HCL BigFix Mobile is vulnerable to a command injection attack.CVE-2023-28012 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.
Product
HCL BigFix Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 26, 2023HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability.CVE-2023-28013 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
Product
HCL Verse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 18, 2023A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access filesCVE-2023-28023 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.9
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network).
Product
HCL BigFix WebUI Software Distribution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 18, 2023The BigFix WebUI uses weak cipher suites.CVE-2023-28021 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
The BigFix WebUI uses weak cipher suites.
Product
HCL BigFix WebUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 18, 2023 URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.CVE-2023-28020 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
Product
HCL BigFix WebUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 18, 2023Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.CVE-2023-28019 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
Product
HCL BigFix WebUI API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jul 10, 2023HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.CVE-2023-23348 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.1
HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.
Product
HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 23, 2023A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.CVE-2023-23344 · Other software · HCL Software · reported by psirt@hcl.comLow 3
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
Product
HCL BigFix WebUI Insights
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 22, 2023Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD BarCVE-2023-28016 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.
Product
HCL BigFix OSD Bare Metal Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 22, 2023The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.CVE-2023-28006 · Other software · HCL Software · reported by psirt@hcl.comHigh 7
The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.
Product
HCL BigFix OSD Bare Metal Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jun 22, 2023A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a userCVE-2023-23343 · Other software · HCL Software · reported by psirt@hcl.comLow 2.4
A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.
Product
HCL BigFix OSD Bare Metal Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
May 23, 2023The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.CVE-2023-28015 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users.
Product
Domino AppDev Pack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Apr 26, 2023HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2023-28009 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Product
Workload Automation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Apr 26, 2023HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2023-28008 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Product
Workload Automation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Apr 2, 2023HCL Launch is vulnerable to HTML injection.CVE-2022-42452 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections.
Product
HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Apr 2, 2023HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS).CVE-2022-42447 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.6
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.
Product
HCL Compass2.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Mar 10, 2023HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability.CVE-2021-27788 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
Product
Verse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Feb 11, 2023An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.CVE-2022-38657 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
Product
Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Jan 20, 2023HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced.CVE-2021-27782 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
Product
BigFix Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Dec 23, 2022BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text.CVE-2022-38658 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.7
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.
Product
BigFix Server Automation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Dec 21, 2022Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation.CVE-2022-44756 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged access. 
Product
BigFix Insights for Vulnerability Remediation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Dec 21, 2022Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.CVE-2022-42454 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.  This requires privileged network access.
Product
BigFix Insights for Vulnerability Remediation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.