Hcltech Appscan vulnerabilities

8 CVEs affecting Hcltech Appscan, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4326, published 2020-10-06.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-4392, published 2020-02-14. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.
• CVE-2019-4391, published 2020-04-07. High severity, CVSS 8.2. EPSS: 1.2% chance of exploitation in the next 30 days. HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data
• CVE-2019-4326, published 2020-10-06. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. "HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header."
• CVE-2019-4393, published 2020-04-07. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. HCL AppScan Standard is vulnerable to excessive authorization attempts
• CVE-2019-4327, published 2020-04-21. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. "HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files."
• CVE-2019-4323, published 2020-07-07. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. "HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
• CVE-2019-4324, published 2020-07-07. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. "HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
• CVE-2019-4325, published 2020-10-06. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. "HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."