VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Dec 18, 2020· Updated Jun 17, 2026

CVE-2020-14271

CVE-2020-14271

Description

HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

Affected products

11
  • HCLTech/Hcl Inotes9 versions
    cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:*range: >=9.0,<10.0.1
    • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:*
    • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack1:*:*:*:*:*:*
    • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack2:*:*:*:*:*:*
    • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack3:*:*:*:*:*:*
    • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack4:*:*:*:*:*:*
    • cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack5:*:*:*:*:*:*
    • cpe:2.3:a:hcltech:hcl_inotes:11.0.1:-:*:*:*:*:*:*
    • cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack1:*:*:*:*:*:*
  • HCL/iNotesdescription
  • HCL Software/iNotesllm-create
    Range: v9, v10 and v11

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.