CVE-2024-30112

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may let the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-301135.4Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.CVE-2024-301145.4Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.CVE-2024-301155.4Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.CVE-2024-301175.3A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstancesCVE-2024-301185.7HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are nCVE-2024-301193.7HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header.  This could allow an attacker to intercept or maCVE-2024-30128.8A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentCCVE-2024-301202.9HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.CVE-2024-301225.3HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web servicCVE-2024-301244.0HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default usinCVE-2024-301256.2HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to dieCVE-2024-301264.7HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that em