CVE-2024-42172

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Jan 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-421734.8HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policiesCVE-2024-421743.7HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users,CVE-2024-421759.8HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length valiCVE-2024-421768.0HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are CVE-2024-421776.4HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the cipCVE-2024-421787.5HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentCVE-2024-421792.7HCL MyXalytics is affected by sensitive information disclosure vulnerability. The HTTP response header exposes the Microsoft-HTTP API∕2.0 aCVE-2024-42186.5The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to plCVE-2024-421809.8HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect contCVE-2024-421817.5HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or securCVE-2024-421822.5BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download fCVE-2024-421832.5BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download fi