CVE-2023-37502

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Oct 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-375039.8HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.CVE-2023-375046.5HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out fun CVE-2023-375077.5HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information rev CVE-2023-375086.1HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if cert CVE-2023-37519.8A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown function CVE-2023-375114.3If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.CVE-2023-375125.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensit CVE-2023-375135.5When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensit CVE-2023-375163.2Missing "no cache" headers in HCL Leap permits user directory information to be cached.CVE-2023-375177.5Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2023-375188.8HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute wi CVE-2023-375196.1Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by