CVE-2023-45723

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jan 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-457249.8HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain CVE-2023-457255.7Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who access CVE-2023-457277.5Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1 CVE-2023-45736.5When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causin CVE-2023-457332.8Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial informatio CVE-2023-457348.8in OpenHarmony v3.2.4 and prior versions allow an adjacent attacker arbitrary code execution through out-of-bounds write.CVE-2023-457358.0A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning CVE-2023-457367.8Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially ena CVE-2023-457375.4Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of G CVE-2023-45746.5When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and CVE-2023-457405.4Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is CVE-2023-457416.8VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands