CVE-2022-27546

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-275477.4HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into suppCVE-2022-275485.5HCL Launch stores user credentials in plain clear text which can be read by a local user.CVE-2022-275495.5HCL Launch may store certain data for recurring activities in a plain text format.CVE-2022-275516.5HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.CVE-2022-275587.5HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes foCVE-2022-27566.5Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.CVE-2022-275606.5HCL VersionVault Express exposes administrator credentials.CVE-2022-275614.8There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).CVE-2022-275625.4Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applicaCVE-2022-275637.5An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.CVE-2022-275679.8Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writCVE-2022-275689.8Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution b