CVE-2024-42206

LowCVSS 3.1/10Last modified Jul 22, 2026

Description

HCL iReflection Third party vulnerable and outdated components issue was detected in the web application

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 2, 2026
Last modified
Jul 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2024

CVE-2024-422076.0HCL iAutomate is affected by a session fixation vulnerability.  An attacker could hijack a victim's session ID from their authenticated sessCVE-2024-422083.5HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are nCVE-2024-422093.5HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are noCVE-2024-422105.4A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower.  Stored cross-site scripting (alCVE-2024-422125.4HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks,CVE-2024-422135.3HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to thesCVE-2024-422145.3HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of tCVE-2024-422184.71Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.CVE-2024-422197.81Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is CVE-2024-42228.2The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capCVE-2024-422209.1A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access pCVE-2024-422224.3In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin a
CVE-2024-42206: Low severity, CVSS 3.1 | Vulnix