CVE-2020-4104

HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a.

• CWE-79

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855Vendor Advisory
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855Vendor Advisory

Published

Jul 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-4095"BigFix Platform is storing clear text credentials within th…6
• CVE-2020-4097In HCL Notes version 9 previous to release 9.0.1 FixPack 10 …6.8
• CVE-2020-4099The application was signed using a key length less than or e…7.5
• CVE-2020-4100"HCL Verse for Android was found to employ dynamic code load…4.4
• CVE-2020-4101"HCL Digital Experience is susceptible to Server Side Reques…9.8
• CVE-2020-4102HCL Notes is susceptible to a Buffer Overflow vulnerability …6.7
• CVE-2020-4107HCL Domino is affected by an Insufficient Access Control vul…7.8
• CVE-2020-4125Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a …8.1
• CVE-2020-4126HCL iNotes is susceptible to a sensitive cookie exposure vul…5.9
• CVE-2020-4127HCL Domino is susceptible to a Login CSRF vulnerability. Wit…6.5
• CVE-2020-4128HCL Domino is susceptible to a lockout policy bypass vulnera…5.3
• CVE-2020-4129HCL Domino is susceptible to a lockout policy bypass vulnera…5.3