CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 06/10/2020 |
| CVE-2019-4325 | 中危5.3 | "HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details." | 06/10/2020 |
| CVE-2020-14223 | 中危6.1 | HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack. | 01/10/2020 |
| CVE-2019-4091 | 中危5.4 | "HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. " | 17/07/2020 |
| CVE-2019-4090 | 中危5.4 | "HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field." | 17/07/2020 |
| CVE-2020-4095 | 中危6.0 | "BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be | 16/07/2020 |
| CVE-2019-4324 | 中危6.1 | "HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy." | 07/07/2020 |
| CVE-2019-4323 | 中危4.3 | "HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame." | 07/07/2020 |
| CVE-2017-1712 | 中危5.9 | "A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform c | 01/07/2020 |
| CVE-2020-4089 | 中危6.5 | HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected. | 26/06/2020 |
| CVE-2020-4101 | 严重9.8 | "HCL Digital Experience is susceptible to Server Side Request Forgery." | 11/06/2020 |
| CVE-2020-4092 | 中危5.3 | "If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information | 06/05/2020 |
| CVE-2019-4209 | 中危6.1 | HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks. | 01/05/2020 |
| CVE-2020-4085 | 中危6.5 | "HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user." | 22/04/2020 |
| CVE-2019-4327 | 高危7.5 | "HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files." | 21/04/2020 |
| CVE-2019-4393 | 严重9.8 | HCL AppScan Standard is vulnerable to excessive authorization attempts | 07/04/2020 |
| CVE-2019-4391 | 高危8.2 | HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data | 07/04/2020 |
| CVE-2020-4084 | 中危5.4 | HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 09/03/2020 |