Monica Murray

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE AEX (affected versions not specified) **Description** The issue is related to a lack of input validation in a web application, allowing a malicious script to be injected into the system. This can cause the system to behave in unexpected ways. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE AEX (affected versions not specified) **Description** The HCL DRYiCE AEX product is impacted by a Missing Root Detection issue in its mobile application. This allows the mobile app to be installed on rooted devices, potentially enabling malicious users to gain unauthorized access. This unauthorized access could compromise security and lead to data breaches or other malicious activities. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE AEX (affected versions not specified) **Description** The issue is related to a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE AEX (affected versions not specified) **Description** The issue concerns the potential disclosure of sensitive information in the mobile application of HCL DRYiCE AEX when a snapshot is taken. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE Optibot Reset Station (affected versions not specified) **Description** The issue is related to a missing Strict Transport Security Header, which could allow an attacker to intercept or manipulate data during redirection. This affects the security of data transmission. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE Optibot Reset Station (affected versions not specified) **Description** The issue is related to an unused parameter in the web application of HCL DRYiCE Optibot Reset Station. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE Optibot Reset Station (affected versions not specified) **Description** The issue concerns insecure encryption of security questions in the HCL DRYiCE Optibot Reset Station. This could potentially allow an attacker with access to the database to recover some or all encrypted values. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE Optibot Reset Station (affected versions not specified) **Description** The issue concerns insecure encryption of One-Time Passwords (OTPs) in the HCL DRYiCE Optibot Reset Station. This could potentially allow an attacker with access to the database to recover some or all encrypted values. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL BigFix Compliance versions 9.x through 11.x **Description** Database scanning using a `username` and `password` stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk, leading to exposure of sensitive information for unauthorized access, potentially resulting in severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity. **Recommendations** For versions 9.x through 11.x, consider disabling database scanning using username and password until a patch is available. Restrict access to sensitive files at the endpoint to minimize the risk of exploitation. Avoid using plaintext or encoded format for storing credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The application is impacted by an improper error handling issue. It returns detailed error messages that can provide an attacker with insight into the application and system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The issue allows file upload capability through a path traversal vulnerability. Certain endpoints permit users to manipulate the path, including the file name, where these files are stored on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The issue is related to Improper Access Control due to obsolete web pages. This could lead to the exposure of sensitive information and/or vulnerable endpoints. The discovery of outdated and accessible web pages reflects a "Missing Access Control" vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability, which allows a user to obtain certain details about another user due to improper access control. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The issue is related to an Improper Access Control vulnerability in Controller APIs. Certain API endpoints, such as "/api/v1/login" or "/users/{id}", are accessible to Customer Admin Users, allowing access to sensitive information about other users. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The issue is related to improper access control, allowing an unauthenticated user to download certain files. This is described as an Unauthenticated File Download vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The issue is related to the use of a broken cryptographic algorithm for encryption in HCL DRYiCE MyXalytics, which could allow an attacker to decrypt sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyXalytics (affected versions not specified) **Description** The issue is related to the use of an insecure key rotation mechanism, which can allow an attacker to compromise the confidentiality or integrity of data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE iAutomate (affected versions not specified) **Description** The issue is related to the use of a broken cryptographic algorithm, which can potentially allow an attacker to compromise the confidentiality and integrity of sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL DRYiCE MyCloud (affected versions not specified) **Description** The issue is related to the use of a broken cryptographic algorithm, which can potentially allow an attacker to compromise the confidentiality and integrity of sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HCL BigFix Mobile (affected versions not specified) **Description** The issue allows an authenticated attacker to inject malicious scripts into the application through a cross-site scripting attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.