CVE-2024-42180

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-421817.5HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or secur CVE-2024-421822.5BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download f CVE-2024-421832.5BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download fi CVE-2024-421842.5BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to down CVE-2024-421852.5BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker t CVE-2024-421862.8BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificate CVE-2024-421875.3BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a CVE-2024-421884.6HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenari CVE-2024-421896.5HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.CVE-2024-42199.1Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a serve CVE-2024-421909.8HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace CVE-2024-421919.8HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace