Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 12 of 15
Dec 21, 2022BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES SuCVE-2022-38655 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
- Product
- BigFix WebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.CVE-2022-44755 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44751. This vulnerability applies to software previously licensed by IBM.
- Product
- Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.CVE-2022-44754 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44750. This vulnerability applies to software previously licensed by IBM.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView.CVE-2022-44753 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licensed by IBM.
- Product
- Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView.CVE-2022-44752 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerability applies to software previously licensed by IBM.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.CVE-2022-44751 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44755. This vulnerability applies to software previously licensed by IBM.
- Product
- Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.CVE-2022-44750 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.8
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44754. This vulnerability applies to software previously licensed by IBM.
- Product
- Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022There are insufficient warnings when a Fixlet is imported by a user.CVE-2022-42453 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.9
There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022 In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.CVE-2022-38662 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.1
In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.
- Product
- HCL Digital Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.CVE-2022-38659 · Other software · HCL Software · reported by psirt@hcl.comMedium 6
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 19, 2022In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.CVE-2022-38653 · Other software · HCL Software · reported by psirt@hcl.comLow 2
In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.
- Product
- HCL Digital Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 12, 2022Starting with Sametime 12, anonymous users are enabled by default.CVE-2022-42446 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
- Product
- HCL Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 12, 2022HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for CVE-2022-42445 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.9
HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 12, 2022HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.CVE-2022-38661 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.2
HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.
- Product
- HCL Workload Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 12, 2022HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.CVE-2022-38656 · Websites & servers · HCL Software · reported by psirt@hcl.comHigh 8.6
HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.
- Product
- HCL Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 4, 2022HCL Domino is susceptible to an information disclosure vulnerability.CVE-2022-38654 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions. An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 4, 2022HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability.CVE-2022-38660 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 1, 2022The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures.CVE-2020-4099 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
- Product
- HCL Verse for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 31, 2022The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key.CVE-2021-27784 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Sep 22, 2022User input included in error response, which could be used in a phishing attack.CVE-2021-27774 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
User input included in error response, which could be used in a phishing attack.
- Product
- HCL Digital Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Sep 21, 2022Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows reCVE-2022-35621 · Other software · Evohclaimable Project · reported by MITREMedium 5.3
Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows remote attackers to execute fraudulent NFT transfers.
- Product
- Evohclaimable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).CVE-2022-27561 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 30, 2022An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.CVE-2022-27563 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 30, 2022HCL VersionVault Express exposes administrator credentials.CVE-2022-27560 · Other software · HCL Software · reported by psirt@hcl.comMedium 6
HCL VersionVault Express exposes administrator credentials.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 29, 2022HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.CVE-2022-27558 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
- Product
- HCL iNotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 29, 2022HCL iNotes is susceptible to a link to non-existent domain vulnerability.CVE-2022-27547 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.1
HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.
- Product
- HCL iNotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 29, 2022HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POSTCVE-2022-27546 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.
- Product
- HCL iNotes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2022HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.CVE-2022-27551 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 29, 2022HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information.CVE-2021-27785 · Websites & servers · HCL Software · reported by psirt@hcl.comLow 3.9
HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.
- Product
- HCL Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 19, 2022BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.CVE-2022-27545 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
- Product
- HCL BigFix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 19, 2022BigFix Web Reports authorized users may see SMTP credentials in clear text.CVE-2022-27544 · Other software · HCL Software · reported by psirt@hcl.comMedium 5
BigFix Web Reports authorized users may see SMTP credentials in clear text.
- Product
- HCL BigFix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 6, 2022HCL Launch may store certain data for recurring activities in a plain text format.CVE-2022-27549 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
HCL Launch may store certain data for recurring activities in a plain text format.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 6, 2022HCL Launch stores user credentials in plain clear text which can be read by a local user.CVE-2022-27548 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.9
HCL Launch stores user credentials in plain clear text which can be read by a local user.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 9, 2022Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner.CVE-2021-27786 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.
- Product
- HCL OneTest Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 31, 2022HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler adminisCVE-2021-27778 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.9
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 27, 2022The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27781 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 27, 2022The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-27780 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 25, 2022User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-27783 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 25, 2022VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.CVE-2021-27779 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.1
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 19, 2022HCL Domino is affected by an Insufficient Access Control vulnerability.CVE-2020-4107 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.8
HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.
- Product
- HCL Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 12, 2022XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation.CVE-2021-27777 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.
- Product
- HCL Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 12, 2022This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-27773 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.2
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 12, 2022Users are able to read group conversations without actively taking part in them.CVE-2021-27772 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 12, 2022User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service.CVE-2021-27771 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 12, 2022The vulnerability was discovered within the “FaviconService”.CVE-2021-27770 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 12, 2022Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system.CVE-2021-27769 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 12, 2022Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be inCVE-2021-27768 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.3
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.
- Product
- Verse for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 6, 2022The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a priCVE-2021-27767 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.7
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hcltechsw.com
May 6, 2022The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privCVE-2021-27766 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.7
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hcltechsw.com
May 6, 2022The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a CVE-2021-27765 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.7
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hcltechsw.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.