Sametime (Hcltech) - vulnerabilities (CVEs)

17 CVEs, 0 in the last 30 days, 41 known versions, newest CVE from 2026-03-17. Vendor: Hcltech.

CVEs of Sametime

CVE-2025-31966 - CVSS 2.7 (low), 2026-03-17: HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web…
CVE-2026-21791 - CVSS 3.3 (low), 2026-03-10: HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL
CVE-2026-21786 - CVSS 3.3 (low), 2026-03-05: HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.
CVE-2023-50355 - CVSS 5.3 (medium), 2024-10-23: HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack.
CVE-2024-30124 - CVSS 4 (medium), 2024-10-23: HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP…
CVE-2024-30122 - CVSS 5.8 (medium), 2024-10-23: HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This…
CVE-2023-37540 - CVSS 3.9 (low), 2024-02-23: Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to…
CVE-2023-45696 - CVSS 7.5 (high), 2024-02-10: Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by…
CVE-2023-45718 - CVSS 7.5 (high), 2024-02-09: Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients.…
CVE-2023-45716 - CVSS 4.1 (medium), 2024-02-09: Sametime is impacted by sensitive information passed in URL.
CVE-2023-50349 - CVSS 8.8 (high), 2024-02-09: Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform…
CVE-2022-42446 - CVSS 6.5 (medium), 2022-12-12: Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and…
CVE-2021-27773 - CVSS 4.3 (medium), 2022-05-12: This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
CVE-2021-27769 - CVSS 5.3 (medium), 2022-05-12: Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be…
CVE-2021-27772 - CVSS 7.1 (high), 2022-05-12: Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations…
CVE-2021-27771 - CVSS 8.2 (high), 2022-05-12: User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter…
CVE-2021-27770 - CVSS 8.8 (high), 2022-05-12: The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this…