CVE-2022-27547

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
HCL Software	HCL iNotes	9, 10, 11, 12

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100212Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100212Vendor Advisory

Timeline

Published: Aug 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-275485.5HCL Launch stores user credentials in plain clear text which can be read by a local user.CVE-2022-275495.5HCL Launch may store certain data for recurring activities in a plain text format.CVE-2022-275516.5HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.CVE-2022-275587.5HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes fo CVE-2022-27566.5Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.CVE-2022-275606.5HCL VersionVault Express exposes administrator credentials.CVE-2022-275614.8There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).CVE-2022-275625.4Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applica CVE-2022-275637.5An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.CVE-2022-275679.8Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writ CVE-2022-275689.8Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution b CVE-2022-275699.8Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution b