Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

702 results · page 8 of 15

Apr 24, 2025Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2024-30127 · Other software · HCL Software · reported by psirt@hcl.comLow 3.2
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Missing "no cache" headers in HCL Leap permits user directory information to be cached.CVE-2023-37516 · Other software · HCL Software · reported by psirt@hcl.comLow 3.2
Missing "no cache" headers in HCL Leap permits user directory information to be cached.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.CVE-2022-44760 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.CVE-2022-44759 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.CVE-2024-30147 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.CVE-2024-30114 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.CVE-2024-30113 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.3
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Insufficient default configuration in HCL Leap allows anonymous access to directory information.CVE-2023-45720 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.CVE-2023-37534 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 24, 2025Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.CVE-2024-30148 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.1
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 17, 2025HCL MyXalytics is affected by a failure to restrict URL access vulnerability.CVE-2024-42178 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential information, creating a risk of misuse, manipulation, or unauthorized distribution.
Product
HCL MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 17, 2025HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities.CVE-2024-42177 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept and decrypt encrypted data, steal sensitive information, or inject malicious code into the system.
Product
HCL MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 15, 2025HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation.CVE-2024-42193 · Other software · HCL Software · reported by psirt@hcl.comLow 2.1
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability could potentially lead to unauthorized access.
Product
HCL BigFix Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 15, 2025HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input.CVE-2024-42200 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input.
Product
HCL BigFix Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 15, 2025HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.CVE-2024-42189 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.6
HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.
Product
HCL BigFix Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 4, 2025HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, causCVE-2024-42208 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
Product
HCL Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 3, 2025HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, crCVE-2025-0279 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.
Product
HCL Traveler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 3, 2025HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messagCVE-2025-0278 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.
Product
HCL Traveler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 3, 2025HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection.CVE-2025-0272 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
Product
HCL DevOps Deploy / HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 2, 2025HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its AgCVE-2025-0257 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.3
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.
Product
HCL DevOps Deploy / HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an erCVE-2025-21924 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error During the initialization of ptp, hclge_ptp_get_cycle might return an error and returned directly without unregister clock and free it. To avoid that, call hclge_ptp_destroy_clock to unregist and free clock if hclge_ptp_get_cycle failed.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Mar 27, 2025HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.CVE-2025-0273 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.
Product
HCL DevOps Deploy / HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 26, 2025HCL SX does not set the secure attribute on authorization tokens or session cookies.CVE-2024-30155 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
Product
HCL SX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 24, 2025HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted iCVE-2025-0255 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.2
HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.
Product
HCL DevOps Deploy / HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 24, 2025HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization foCVE-2025-0256 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.
Product
HCL DevOps Deploy / HCL Launch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 20, 2025HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226.CVE-2025-0254 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept and potentially alter communication between two parties.
Product
HCL Digital Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 19, 2025HCL MyXalytics is affected by concurrent login vulnerability.CVE-2024-42176 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive information.
Product
HCL MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 13, 2025HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the CVE-2024-30143 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the restricted directory. Potential exploits can completely disrupt or takeover the application or the computer where the application is running.
Product
HCL AppScan Traffic Recorder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com support.hcl-software.com
Mar 3, 2025HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a CVE-2024-30154 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Product
HCL SX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 27, 2025In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, it tries to CVE-2025-21802 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, it tries to disable sriov first for each ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at the time, because it removes all the ae_dev nodes, and it may cause oops. But we can't simply use hnae3_common_lock for this. Because in the process flow of pci_disable_sriov(), it will trigger the remove flow of VF, which will also take hnae3_common_lock. To fixes it, introduce a new mutex to protect the unload process.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 25, 2025HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potentiaCVE-2024-30150 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated users.
Product
MyCloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 12, 2025HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, causCVE-2024-23563 · Other software · HCL Software · reported by psirt@hcl.comLow 3.9
HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
Product
Connections Docs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 5, 2025HCL iAutomate is affected by a session fixation vulnerability.CVE-2024-42207 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session.
Product
iAutomate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by path traversal vulnerability.CVE-2024-42187 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository which is vulnerable to path traversal attacks.
Product
BigFix Patch Management Download Plug-ins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by an insecure protocol support.CVE-2024-42186 · Other software · HCL Software · reported by psirt@hcl.comLow 2.8
BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation.
Product
BigFix Patch Management Download Plug-ins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks.CVE-2024-42185 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
Product
BigFix Patch Management Download Plug-ins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme.CVE-2024-42184 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using the file:// URI scheme.
Product
BigFix Patch Management Download Plug-ins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability.CVE-2024-42183 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.
Product
BigFix Patch Management Download Plug-ins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability.CVE-2024-42182 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download files from an internally hosted server on localhost.
Product
BigFix Patch Management Download Plug-ins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2025In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR spaCVE-2025-21650 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses. However, hclge_fetch_pf_reg does not distinguish the tqp space information when reading the tqp space information. When the number of TQPs is greater than 1024, access bar space overwriting occurs. The problem of different segments has been considered during the initialization of tqp.io_base. Therefore, tqp.io_base is directly used when the queue is read in hclge_fetch_pf_reg. The error message: Unable to handle kernel paging request at virtual address ffff800037200000 pc : hclge_fetch_pf_reg+0x138/0x250 [hclge] lr : hclge_get_regs+0x84/0x1d0 [hclge] Call trace: hclge_fetch_pf_reg+0x138/0x250 [hclge] hclge_get_regs+0x84/0x1d0 [hclge] hns3_get_regs+0x2c/0x50 [hns3] ethtool_get_regs+0xf4/0x270 dev_ethtool+0x674/0x8a0 dev_ioctl+0x270/0x36c sock_do_ioctl+0x110/0x2a0 sock_ioctl+0x2ac/0x530 __arm64_sys_ioctl+0xa8/0x100 invoke_syscall+0x4c/0x124 el0_svc_common.constprop.0+0x140/0x15c do_el0_svc+0x30/0xd0 el0_svc+0x1c
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jan 12, 2025HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability.CVE-2024-42181 · Other software · HCL Software · reported by psirt@hcl.comLow 1.6
HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 12, 2025HCL MyXalytics is affected by a malicious file upload vulnerability.CVE-2024-42180 · Other software · HCL Software · reported by psirt@hcl.comLow 1.6
HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 12, 2025HCL MyXalytics is affected by sensitive information disclosure vulnerability.CVE-2024-42179 · Other software · HCL Software · reported by psirt@hcl.comLow 2
HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 as the server's name & version.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 11, 2025HCL MyXalytics is affected by a weak input validation vulnerability.CVE-2024-42175 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can lead to security vulnerabilities like SQL injection, XSS, and buffer overflow.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 11, 2025HCL MyXalytics is affected by username enumeration vulnerability.CVE-2024-42174 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 11, 2025HCL MyXalytics is affected by an improper password policy implementation vulnerability.CVE-2024-42173 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to guess or brute-force passwords if the username is known.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 11, 2025HCL MyXalytics is affected by broken authentication.CVE-2024-42172 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 11, 2025HCL MyXalytics is affected by a session fixation vulnerability.CVE-2024-42171 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 11, 2025HCL MyXalytics is affected by a session fixation vulnerability.CVE-2024-42170 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 10, 2025HCL MyXalytics is affected by insecure direct object references.CVE-2024-42169 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.
Product
DRYiCE MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.