CVE-2023-37499

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
HCL Software	HCL Unica Platform	<12.1.1

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106555Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106555Vendor Advisory

Timeline

Published: Aug 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-37505.3A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race conditi CVE-2023-375006.1A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a use CVE-2023-375016.1A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perfo CVE-2023-375028.8HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by th CVE-2023-375039.8HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.CVE-2023-375046.5HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out fun CVE-2023-375077.5HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information rev CVE-2023-375086.1HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if cert CVE-2023-37519.8A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown function CVE-2023-375114.3If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.CVE-2023-375125.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensit CVE-2023-375135.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensit