CVE-2023-28017

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise a user's account then launch other attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-280186.5HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request aCVE-2023-280198.8Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterCVE-2023-28024.8The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow hCVE-2023-280206.1URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL CVE-2023-280217.5The BigFix WebUI uses weak cipher suites.CVE-2023-280226.5HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are nCVE-2023-280236.5A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attaCVE-2023-280254.8Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cCVE-2023-280266.7Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentCVE-2023-280276.7Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentCVE-2023-280286.7Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentCVE-2023-280296.7Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potent