Monica Murray

The issue is related to a lack of input validation in a web application, allowing a malicious script to be injected into the system. This can cause the system to behave in unexpected ways.

The HCL DRYiCE AEX product is impacted by a Missing Root Detection issue in its mobile application. This allows the mobile app to be installed on rooted devices, potentially enabling malicious users to gain unauthorized access. This unauthorized access could compromise security and lead to data breaches or other malicious activities.

The issue is related to a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.

The issue concerns the potential disclosure of sensitive information in the mobile application of HCL DRYiCE AEX when a snapshot is taken.

The issue is related to a missing Strict Transport Security Header, which could allow an attacker to intercept or manipulate data during redirection. This affects the security of data transmission.

The issue is related to an unused parameter in the web application of HCL DRYiCE Optibot Reset Station.

The issue concerns insecure encryption of security questions in the HCL DRYiCE Optibot Reset Station. This could potentially allow an attacker with access to the database to recover some or all encrypted values.

The issue concerns insecure encryption of One-Time Passwords (OTPs) in the HCL DRYiCE Optibot Reset Station. This could potentially allow an attacker with access to the database to recover some or all encrypted values.

Database scanning using a `username` and `password` stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk, leading to exposure of sensitive information for unauthorized access, potentially resulting in severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.

The application is impacted by an improper error handling issue. It returns detailed error messages that can provide an attacker with insight into the application and system.

The issue allows file upload capability through a path traversal vulnerability. Certain endpoints permit users to manipulate the path, including the file name, where these files are stored on the server.

The issue is related to Improper Access Control due to obsolete web pages. This could lead to the exposure of sensitive information and/or vulnerable endpoints. The discovery of outdated and accessible web pages reflects a "Missing Access Control" vulnerability.

The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability, which allows a user to obtain certain details about another user due to improper access control.

The issue is related to an Improper Access Control vulnerability in Controller APIs. Certain API endpoints, such as "/api/v1/login" or "/users/{id}", are accessible to Customer Admin Users, allowing access to sensitive information about other users. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to improper access control, allowing an unauthenticated user to download certain files. This is described as an Unauthenticated File Download vulnerability.

The issue is related to the use of a broken cryptographic algorithm for encryption in HCL DRYiCE MyXalytics, which could allow an attacker to decrypt sensitive information.

The issue is related to the use of an insecure key rotation mechanism, which can allow an attacker to compromise the confidentiality or integrity of data.

The issue is related to the use of a broken cryptographic algorithm, which can potentially allow an attacker to compromise the confidentiality and integrity of sensitive information.

The issue is related to the use of a broken cryptographic algorithm, which can potentially allow an attacker to compromise the confidentiality and integrity of sensitive information.

The issue allows an authenticated attacker to inject malicious scripts into the application through a cross-site scripting attack.