CVE-2024-30xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
726 records · Page 7 of 8
HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.
Updated- CVE-2024-30129: HCL Nomad server on Domino is affected by a host header injection vulnerability 5.3 Medium
The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.
Updated HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may enable an attacker to trick the user into exposing sensitive information.
UpdatedMissing "no cache" headers in HCL Leap permits sensitive data to be cached.
Updated- CVE-2024-30126: HCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerability 4.7 Medium
HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target website in a frame or iframe, tricking users into performing actions on the target website without their knowledge.
Updated HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.
UpdatedHCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.
UpdatedHCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.
UpdatedHCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.
UpdatedHCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection.
Updated- CVE-2024-30118: HCL Connections is susceptible to a sensitive information disclosure vulnerability 3.5 Low
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to because of improperly handling the request data.
Updated A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.
UpdatedInsufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
UpdatedInsufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
UpdatedInsufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
Updated- CVE-2024-30112: HCL Connections is vulnerable to a cross-site scripting (XSS) vulnerability 5.4 Medium
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
Updated HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, compromising security and potentially leading to data breaches or other malicious activities.
UpdatedHCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system which can cause the system to behave in unexpected ways.
UpdatedHCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.
UpdatedHCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.
UpdatedHCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain sensitive information they are not entitled to due to the improper handling of request data.
Updated.NET and Visual Studio Denial of Service Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft Outlook Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Remote Code Execution Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Cryptographic Services Security Feature Bypass Vulnerability
UpdatedMicrosoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
UpdatedWindows Cryptographic Services Information Disclosure Vulnerability
Updated- CVE-2024-30095: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 7.8 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Updated - CVE-2024-30094: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 7.8 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Updated Windows Storage Elevation of Privilege Vulnerability
UpdatedWindows Hyper-V Remote Code Execution Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
UpdatedMicrosoft Streaming Service Elevation of Privilege Vulnerability
UpdatedMicrosoft Streaming Service Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
UpdatedWindows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Updated- CVE-2024-30085: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 7.8 High
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Updated Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Updated- CVE-2024-30083: Windows Standards-Based Storage Management Service Denial of Service Vulnerability 7.5 High
Windows Standards-Based Storage Management Service Denial of Service Vulnerability
Updated Win32k Elevation of Privilege Vulnerability
UpdatedWindows NTLM Spoofing Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Updated- CVE-2024-30079: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability 7.8 High
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Updated Windows Wi-Fi Driver Remote Code Execution Vulnerability
UpdatedWindows OLE Remote Code Execution Vulnerability
UpdatedWindows Container Manager Service Elevation of Privilege Vulnerability
Updated- CVE-2024-30075: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability 8.0 High
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Updated - CVE-2024-30074: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability 8.0 High
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Updated Windows Security Zone Mapping Security Feature Bypass Vulnerability
UpdatedMicrosoft Event Trace Log File Parsing Remote Code Execution Vulnerability
Updated- CVE-2024-30071: Windows Remote Access Connection Manager Information Disclosure Vulnerability 4.7 Medium
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Updated DHCP Server Service Denial of Service Vulnerability
Updated- CVE-2024-30069: Windows Remote Access Connection Manager Information Disclosure Vulnerability 4.7 Medium
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Updated Windows Kernel Elevation of Privilege Vulnerability
UpdatedWinlogon Elevation of Privilege Vulnerability
UpdatedWinlogon Elevation of Privilege Vulnerability
UpdatedWindows Themes Denial of Service Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
Updated- CVE-2024-30063: Windows Distributed File System (DFS) Remote Code Execution Vulnerability 6.7 Medium
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Updated Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability
UpdatedMicrosoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
UpdatedAzure Monitor Agent Elevation of Privilege Vulnerability
Updated- CVE-2024-30059: Microsoft Intune for Android Mobile Application Management Tampering Vulnerability 6.1 Medium
Microsoft Intune for Android Mobile Application Management Tampering Vulnerability
Updated Microsoft Edge (Chromium-based) Spoofing Vulnerability
UpdatedMicrosoft Edge for iOS Spoofing Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Spoofing Vulnerability
Updated- CVE-2024-30054: Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability 6.5 Medium
Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability
Updated Azure Migrate Cross-Site Scripting Vulnerability
UpdatedVisual Studio Remote Code Execution Vulnerability
UpdatedWindows DWM Core Library Elevation of Privilege Vulnerability
UpdatedWindows Mark of the Web Security Feature Bypass Vulnerability
UpdatedWindows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
UpdatedDynamics 365 Customer Insights Spoofing Vulnerability
UpdatedDynamics 365 Customer Insights Spoofing Vulnerability
UpdatedVisual Studio Denial of Service Vulnerability
Updated.NET and Visual Studio Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Information Disclosure Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft Bing Search Spoofing Vulnerability
UpdatedWindows MSHTML Platform Security Feature Bypass Vulnerability
Updated- CVE-2024-30039: Windows Remote Access Connection Manager Information Disclosure Vulnerability 5.5 Medium
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Updated Win32k Elevation of Privilege Vulnerability
Updated- CVE-2024-30037: Windows Common Log File System Driver Elevation of Privilege Vulnerability 5.5 Medium
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Updated Windows Deployment Services Information Disclosure Vulnerability
UpdatedWindows DWM Core Library Elevation of Privilege Vulnerability
Updated- CVE-2024-30034: Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability 5.5 Medium
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
Updated Windows Search Service Elevation of Privilege Vulnerability
UpdatedWindows DWM Core Library Elevation of Privilege Vulnerability
UpdatedWindows CNG Key Isolation Service Elevation of Privilege Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
Updated- CVE-2024-30029: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 7.5 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Updated Win32k Elevation of Privilege Vulnerability
UpdatedNTFS Elevation of Privilege Vulnerability
Updated