Threats Tagged 'cwe-1104'

CVE-2026-21753 identifies a medium severity vulnerability in HCL Software Hive version 1.0 related to weak software supply chain governance. This weakness may allow the inclusion of vulnerable, unmaintained, or malicious third-party components within the application environment, potentially impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 4.2, indicating a network attack vector with high attack complexity and requiring user interaction. No known exploits or patches are currently documented.

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.

HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library.

HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.

Image::EPEG versions through 0.15 for Perl embed an unsupported and unmaintained version (0.9.0) of the Epeg JPEG thumbnail library, which was last updated in 2004. This use of an outdated third-party component introduces critical security risks, as indicated by a CVSS score of 9.8. No official patch or remediation guidance is currently available from the vendor.

The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.

HCL BigFix SCM Reporting version 11.0.5 uses an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x is end-of-life and no longer receives security updates, this exposes the application to known security weaknesses. This increases the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components. The vulnerability is tracked as CVE-2026-21821 with a high severity score of 8.3. No official patch or remediation guidance is currently available from the vendor.