Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 9 of 15
Jan 10, 2025HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability.CVE-2024-42168 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.9
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 17, 2024An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.CVE-2024-42194 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.
- Product
- BigFix Inventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024The HTTP host header can be manipulated and cause the application to behave in unexpected ways.CVE-2024-30129 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 6, 2024HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.CVE-2024-42196 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.2
HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.
- Product
- Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 5, 2024HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection.CVE-2024-42195 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
- Product
- DevOps Deploy / Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 14, 2024HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.CVE-2024-42188 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 12, 2024HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability.CVE-2024-30133 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 7, 2024HCL BigFix Compliance is affected by a missing secure flag on a cookie.CVE-2024-30142 · Other software · HCL Software · reported by psirt@hcl.comLow 3.8
HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 7, 2024HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information.CVE-2024-30141 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement information or expose information about its environment, users, or associated data.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 7, 2024HCL BigFix Compliance is affected by unvalidated redirects and forwards.CVE-2024-30140 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the web cache and provide back to users being served the page.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 31, 2024HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable.CVE-2024-30149 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable.
- Product
- AppScan Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 28, 2024HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain sCVE-2024-30106 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain sensitive information they are not entitled to due to the improper handling of request data.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 23, 2024HCL Sametime is impacted by the error messages containing sensitive information.CVE-2023-50355 · Other software · HCL Software · reported by psirt@hcl.comLow 3.6
HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 23, 2024HCL Sametime is impacted by insecure services in-use on the UIM client by default.CVE-2024-30124 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 23, 2024HCL Sametime is impacted by misconfigured security related HTTP headers.CVE-2024-30122 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.8
HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 14, 2024A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.CVE-2024-30117 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 9, 2024HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to becauCVE-2024-30118 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to because of improperly handling the request data.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 1, 2024HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecifCVE-2024-30132 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024HCL Nomad is susceptible to an insufficient session expiration vulnerability.CVE-2024-23586 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old session information.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application.CVE-2024-30134 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.7
The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application.
- Product
- HCL Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address.CVE-2024-30128 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.6
HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may enable an attacker to trick the user into exposing sensitive information.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2024HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensiCVE-2024-30130 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2024HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target websCVE-2024-30126 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target website in a frame or iframe, tricking users into performing actions on the target website without their knowledge.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2024HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.CVE-2024-30125 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.2
HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 8, 2024A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information.CVE-2024-23562 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vulnerability to obtain information to launch further attacks against the affected system.
- Product
- Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.comsupport.hcltechsw.com
Jul 5, 2024HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability.CVE-2024-23588 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.CVE-2024-30135 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application.CVE-2024-30111 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, compromising security and potentially leading to data breaches or other malicious activities.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application.CVE-2024-30110 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system which can cause the system to behave in unexpected ways.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application.CVE-2024-30109 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 25, 2024HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an uCVE-2024-30112 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 25, 2024HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2023-37541 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.comsupport.hcltechsw.com
Jun 19, 2024In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg Currently, the hns3_remove functCVE-2021-47596 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg Currently, the hns3_remove function firstly uninstall client instance, and then uninstall acceletion engine device. The netdevice is freed in client instance uninstall process, but acceletion engine device uninstall process still use it to trace runtime information. This causes a use after free problem. So fixes it by check the instance register state to avoid use after free.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 14, 2024HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.CVE-2024-30120 · Other software · HCL Software · reported by psirt@hcl.comLow 2.9
HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 14, 2024HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header.CVE-2024-30119 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 8, 2024HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code.CVE-2023-45707 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.4
HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to credentials disclosure and possibly launch additional attacks.
- Product
- Connections Docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 6, 2024The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.CVE-2023-37539 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.4
The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it.
- Product
- Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 28, 2024HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs).CVE-2024-23580 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access to the database to recover some or all encrypted values.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 28, 2024HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions.CVE-2024-23579 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 17, 2024SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.CVE-2024-23556 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 17, 2024Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).CVE-2024-23554 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.7
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 17, 2024An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.CVE-2024-23583 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.7
An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.
- Product
- BigFix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 14, 2024Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized adminisCVE-2024-23576 · Websites & servers · HCL Software · reported by psirt@hcl.comHigh 7.1
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
- Product
- Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 14, 2024HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability.CVE-2023-37526 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks.
- Product
- DRYiCE Lucy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 7, 2024Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint.CVE-2024-23551 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized access, potentially leading to severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 2, 2024Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability.CVE-2023-39474 · Other software · Inductive Automation · reported by zdi-disclosures@trendmicro.comHigh 8.8
Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the downloadLaunchClientJar function. The issue results from the lack of validating a remote JAR file prior to loading it. An attacker can leverage this vulnerability to execute code in the context of the current user. . Was ZDI-CAN-19915.
- Product
- Ignition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 18, 2024HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.CVE-2024-30107 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 18, 2024HCL Connections contains a user enumeration vulnerability.CVE-2024-23557 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 15, 2024HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values.CVE-2024-23561 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values.
- Product
- DevOps Deploy / Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 15, 2024HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.CVE-2024-23558 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.3
HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
- Product
- DevOps Deploy / Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.