Hcltech Hcl Inotes vulnerabilities

7 CVEs affecting Hcltech Hcl Inotes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27558, published 2022-08-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-14225, published 2020-12-21. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into…
CVE-2020-14271, published 2020-12-18. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this…
CVE-2021-27760, published 2022-05-06. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a…
CVE-2020-4126, published 2020-12-01. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http…
CVE-2022-27546, published 2022-08-29. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could…
CVE-2022-27558, published 2022-08-29. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading…
CVE-2022-27547, published 2022-08-29. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password,…