Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-42161 State: PUBLISHED Published: 2024-07-30T07:47:03.136Z Last Updated: 2025-11-03T22:02:24.334Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a default branch in the switch statement to initialize `val'.] GCC warns that `val' may be used uninitialized in the BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as: [...] unsigned long long val; \ [...] \ switch (__CORE_RELO(s, field, BYTE_SIZE)) { \ case 1: val = *(const unsigned char *)p; break; \ case 2: val = *(const unsigned short *)p; break; \ case 4: val = *(const unsign
al = *(const unsigned char *)p; break; \ case 2: val = *(const unsigned short *)p; break; \ case 4: val = *(const unsigned int *)p; break; \ case 8: val = *(const unsigned long long *)p; break; \ } \ [...] val; \ } \ This patch adds a default entry in the switch statement that sets `val' to zero in order to avoid the warning, and random values to be used in case __builtin_preserve_field_info returns unexpected values for BPF_FIELD_BYTE_SIZE. Tested in bpf-next master. No regressions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b694989bb13ed5f166e633faa1eb0f21c6d261a6 - https://git.kernel.org/stable/c/3364c2ed1c2419
ttps://git.kernel.org/stable/c/b694989bb13ed5f166e633faa1eb0f21c6d261a6 - https://git.kernel.org/stable/c/3364c2ed1c241989847f19cf83e3db903ce689e3 - https://git.kernel.org/stable/c/a21d76bd0b0d39518e9a4c19f6cf7c042a974aff - https://git.kernel.org/stable/c/7e5471b5efebc30dd0bc035cda86693a5c73d45f - https://git.kernel.org/stable/c/ff941a8449e712eaf7efca1a13bfb9afd3d99fc2 - https://git.kernel.org/stable/c/009367099eb61a4fc2af44d4eb06b6b4de7de6db
CVE ID: CVE-2024-42162 State: PUBLISHED Published: 2024-07-30T07:47:04.050Z Last Updated: 2025-05-21T09:13:02.476Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gve: Account for stopped queues when reading NIC stats We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62 - https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e
.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62 - https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6
CVE ID: CVE-2024-42163 State: PUBLISHED Published: 2024-08-12T11:21:54.443Z Last Updated: 2024-08-12T16:11:16.884Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: FIWARE Products: FIWARE Keyrock Problem Types: CWE-326 Description: Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE ID: CVE-2024-42164 State: PUBLISHED Published: 2024-08-12T11:27:17.672Z Last Updated: 2024-08-12T13:13:06.556Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: FIWARE Products: FIWARE Keyrock Problem Types: CWE-287 Description: Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE ID: CVE-2024-42165 State: PUBLISHED Published: 2024-08-12T11:33:39.049Z Last Updated: 2024-08-12T12:23:11.741Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: FIWARE Products: FIWARE Keyrock Problem Types: CWE-330 Description: Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE ID: CVE-2024-42166 State: PUBLISHED Published: 2024-08-12T11:36:28.386Z Last Updated: 2024-08-12T13:46:39.901Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: FIWARE Products: FIWARE Keyrock Problem Types: CWE-78 Description: The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ait.ac.at/themen/cyber-security/pentesting/security
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE ID: CVE-2024-42167 State: PUBLISHED Published: 2024-08-12T11:38:35.988Z Last Updated: 2024-08-12T14:20:39.285Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: FIWARE Products: FIWARE Keyrock Problem Types: CWE-78 Description: The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ait.ac.at/themen/cyber-security/pent
nname. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
CVE ID: CVE-2024-42168 State: PUBLISHED Published: 2025-01-11T02:24:38.352Z Last Updated: 2025-01-13T19:29:30.205Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-610 Description: HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42169 State: PUBLISHED Published: 2025-01-11T02:31:22.611Z Last Updated: 2025-01-13T19:29:09.475Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-639 Description: HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42170 State: PUBLISHED Published: 2025-01-11T06:17:20.606Z Last Updated: 2025-01-13T19:26:40.043Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-384 Description: HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42171 State: PUBLISHED Published: 2025-01-11T06:31:24.165Z Last Updated: 2025-01-13T19:26:14.052Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-384 Description: HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42172 State: PUBLISHED Published: 2025-01-11T06:44:28.808Z Last Updated: 2025-01-13T19:25:52.775Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-287 Description: HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications. Additional Analyst Notes: - CISA ADP Vulnri
control, including databases, network infrastructure, and web applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42173 State: PUBLISHED Published: 2025-01-11T06:54:33.550Z Last Updated: 2025-01-13T19:25:32.172Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-521 Description: HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to guess or brute-force passwords if the username is known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42174 State: PUBLISHED Published: 2025-01-11T07:04:24.964Z Last Updated: 2025-01-13T19:22:10.825Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-204 Description: HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42175 State: PUBLISHED Published: 2025-01-11T07:20:57.617Z Last Updated: 2025-01-13T17:49:03.171Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-20 Description: HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can lead to security vulnerabilities like SQL injection, XSS, and buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42176 State: PUBLISHED Published: 2025-03-19T14:24:21.759Z Last Updated: 2025-03-19T15:05:13.705Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL MyXalytics Description: HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119919
CVE ID: CVE-2024-42177 State: PUBLISHED Published: 2025-04-17T19:18:05.137Z Last Updated: 2025-04-17T19:29:01.902Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL MyXalytics Problem Types: CWE-326 Description: HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept and decrypt encrypted data, steal sensitive information, or inject malicious code into the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120504
CVE ID: CVE-2024-42178 State: PUBLISHED Published: 2025-04-17T21:24:34.185Z Last Updated: 2025-04-18T12:02:16.960Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL MyXalytics Problem Types: CWE-288 Description: HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential information, creating a risk of misuse, manipulation, or unauthorized distribution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120502
CVE ID: CVE-2024-42179 State: PUBLISHED Published: 2025-01-12T21:46:39.992Z Last Updated: 2025-01-13T15:14:33.571Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-200 Description: HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 as the server's name & version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42180 State: PUBLISHED Published: 2025-01-12T21:53:03.369Z Last Updated: 2025-01-13T15:14:02.864Z Severity: LOW (CVSS 1.6 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-434 Description: HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42181 State: PUBLISHED Published: 2025-01-12T22:04:37.495Z Last Updated: 2025-01-13T15:13:31.207Z Severity: LOW (CVSS 1.6 CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Problem Types: CWE-319 Description: HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE ID: CVE-2024-42182 State: PUBLISHED Published: 2025-01-23T01:05:52.350Z Last Updated: 2025-01-23T14:54:26.538Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix Patch Management Download Plug-ins Problem Types: CWE-918 Description: BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download files from an internally hosted server on localhost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE ID: CVE-2024-42183 State: PUBLISHED Published: 2025-01-23T01:42:47.496Z Last Updated: 2025-01-23T14:53:30.106Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix Patch Management Download Plug-ins Problem Types: CWE-494 Description: BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE ID: CVE-2024-42184 State: PUBLISHED Published: 2025-01-23T01:59:00.971Z Last Updated: 2025-01-23T14:53:08.031Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix Patch Management Download Plug-ins Problem Types: CWE-84 Description: BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using the file:// URI scheme. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE ID: CVE-2024-42185 State: PUBLISHED Published: 2025-01-23T02:10:02.525Z Last Updated: 2025-01-23T14:51:45.463Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix Patch Management Download Plug-ins Problem Types: CWE-611 Description: BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article
ess. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE ID: CVE-2024-42186 State: PUBLISHED Published: 2025-01-23T02:47:40.896Z Last Updated: 2025-01-23T15:01:15.665Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix Patch Management Download Plug-ins Problem Types: CWE-295 Description: BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE ID: CVE-2024-42187 State: PUBLISHED Published: 2025-01-23T02:53:07.305Z Last Updated: 2025-01-23T15:00:41.338Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: HCL Software Products: BigFix Patch Management Download Plug-ins Problem Types: CWE-22 Description: BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository which is vulnerable to path traversal attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE ID: CVE-2024-42188 State: PUBLISHED Published: 2024-11-14T15:31:58.223Z Last Updated: 2024-11-14T15:53:55.192Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: Connections Description: HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117387
CVE ID: CVE-2024-42189 State: PUBLISHED Published: 2025-04-15T18:07:40.703Z Last Updated: 2025-04-15T18:21:41.257Z Vendors: HCL Software Products: HCL BigFix Platform Problem Types: CWE-1287 Description: HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120585
CVE ID: CVE-2024-42190 State: PUBLISHED Published: 2025-05-30T15:51:35.047Z Last Updated: 2025-05-30T15:59:55.348Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Traveler for Microsoft Outlook (HTMO) Problem Types: CWE-427 Description: HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120744
CVE ID: CVE-2024-42191 State: PUBLISHED Published: 2025-05-30T15:54:23.554Z Last Updated: 2025-05-30T16:10:53.534Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Traveler for Microsoft Outlook (HTMO) Problem Types: CWE-427 Description: HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120745
CVE ID: CVE-2024-42192 State: PUBLISHED Published: 2025-10-16T20:24:53.515Z Last Updated: 2025-10-17T13:33:25.412Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: Traveler for Microsoft Outlook Problem Types: CWE-522 Description: HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124066
CVE ID: CVE-2024-42193 State: PUBLISHED Published: 2025-04-15T18:16:01.247Z Last Updated: 2025-04-15T18:51:09.135Z Vendors: HCL Software Products: HCL BigFix Platform Problem Types: CWE-295 Description: HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability could potentially lead to unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120585
CVE ID: CVE-2024-42194 State: PUBLISHED Published: 2024-12-17T17:28:24.872Z Last Updated: 2024-12-17T20:37:59.293Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: HCL Software Products: BigFix Inventory Problem Types: CWE-280 Description: An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118212
CVE ID: CVE-2024-42195 State: PUBLISHED Published: 2024-12-05T04:47:28.191Z Last Updated: 2024-12-05T11:13:25.028Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: DevOps Deploy / Launch Problem Types: CWE-80 Description: HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117908