Hcl Software
380 CVEs across 120 Hcl Software products. Browse Hcl Software vulnerabilities, severities, and proof-of-concept exploits.
Hcl Software products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32000 | Medium | 4.3 | 2026-09-24 | HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or expl… |
CVE-2026-21806 | Low | 3.1 | 2026-09-18 | HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated se… |
CVE-2026-56597 | Low | 3.1 | 2026-09-18 | HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal I… |
CVE-2026-56595 | Low | 3.1 | 2026-09-18 | HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to… |
CVE-2026-56592 | Medium | 6.5 | 2026-09-18 | HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an u… |
CVE-2026-56590 | Medium | 6.4 | 2026-09-18 | HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthent… |
CVE-2026-21848 | Medium | 5.0 | 2026-09-18 | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access… |
CVE-2026-21822 | Medium | 6.3 | 2026-09-18 | HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticat… |
CVE-2026-67102 | High | 8.1 | 2026-09-18 | HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized… |
CVE-2025-52657 | Low | 3.5 | 2026-09-07 | HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact… |
CVE-2025-52652 | Low | 3.5 | 2026-09-07 | HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originat… |
CVE-2025-52651 | Low | 3.5 | 2026-09-07 | HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security… |
CVE-2025-62343 | Low | 3.1 | 2026-08-27 | HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or s… |
CVE-2025-62342 | Medium | 6.4 | 2026-08-27 | HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions n… |
CVE-2026-21753 | Medium | 4.2 | 2026-08-25 | HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependen… |
CVE-2026-21784 | Medium | 4.8 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and reso… |
CVE-2025-62306 | Medium | 5.0 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an a… |
CVE-2025-62300 | Medium | 5.9 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredicta… |
CVE-2025-62299 | Medium | 6.6 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privil… |
CVE-2025-62307 | Medium | 5.4 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables… |
CVE-2026-21832 | Medium | 4.3 | 2026-08-13 | HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to user… |
CVE-2025-62318 | Low | 3.7 | 2026-08-13 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive inform… |
CVE-2025-62315 | Low | 3.4 | 2026-08-13 | HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be a… |
CVE-2025-62314 | Medium | 5.6 | 2026-08-13 | HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted witho… |
CVE-2025-52640 | Medium | 4.7 | 2026-08-13 | HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes shar… |
CVE-2026-56609 | Medium | 4.8 | 2026-08-03 | HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and… |
CVE-2026-56608 | Low | 3.7 | 2026-08-03 | HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access o… |
CVE-2026-56571 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavail… |
CVE-2026-56570 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for… |
CVE-2026-56569 | Medium | 4.0 | 2026-07-31 | HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web serve… |
CVE-2026-56568 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/A… |
CVE-2026-56567 | Medium | 5.1 | 2026-07-31 | HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper… |
CVE-2024-23564 | Critical | 9.1 | 2026-07-17 | HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redire… |
CVE-2026-56456 | Medium | 5.3 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding i… |
CVE-2026-56455 | Medium | 5.3 | 2026-07-16 | HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input si… |
CVE-2026-56454 | Medium | 5.9 | 2026-07-16 | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographi… |
CVE-2026-56453 | Medium | 5.5 | 2026-07-16 | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the serv… |
CVE-2026-35145 | Low | 3.1 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Sec… |
CVE-2026-35143 | Low | 3.0 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated… |
CVE-2026-35142 | Low | 2.6 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated serv… |
CVE-2026-35141 | Low | 2.6 | 2026-07-16 | HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit v… |
CVE-2026-35140 | Low | 3.0 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute… |
CVE-2026-35149 | High | 8.2 | 2026-07-16 | HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploi… |
CVE-2026-35148 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authen… |
CVE-2026-35147 | High | 8.2 | 2026-07-16 | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when… |
CVE-2026-9007 | | 2026-07-15 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Sit… | |
CVE-2025-62340 | Low | 3.1 | 2026-06-17 | HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automaticall… |
CVE-2025-59872 | Medium | 4.3 | 2026-06-17 | HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain comman… |
CVE-2025-31974 | Low | 3.9 | 2026-05-06 | HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintend… |
CVE-2025-31982 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk… |
CVE-2025-31978 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An… |
CVE-2025-31976 | Medium | 4.8 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appl… |
CVE-2025-31959 | Low | 3.5 | 2026-05-06 | HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sens… |
CVE-2025-31957 | Low | 2.6 | 2026-05-06 | HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of s… |
CVE-2025-59873 | Medium | 5.9 | 2026-02-23 | An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authenticat… |
CVE-2025-55252 | Low | 3.1 | 2026-01-19 | HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauth… |
CVE-2025-55250 | Low | 1.8 | 2026-01-19 | HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information… |
CVE-2025-55251 | Low | 3.1 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |
CVE-2025-55249 | Low | 3.5 | 2026-01-19 | HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall securi… |
CVE-2025-52661 | Low | 2.4 | 2026-01-19 | HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized… |
CVE-2025-52660 | Low | 2.7 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |
CVE-2025-52659 | Low | 2.8 | 2026-01-19 | HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially res… |
CVE-2025-59870 | High | 7.4 | 2026-01-16 | HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a secur… |
CVE-2025-59849 | Medium | 4.7 | 2025-12-17 | Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicio… |
CVE-2025-55254 | Low | 3.7 | 2025-12-17 | Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malic… |
CVE-2025-62329 | Medium | 5.0 | 2025-12-16 | HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused… |
CVE-2025-62330 | Medium | 5.9 | 2025-12-16 | HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS a… |
CVE-2024-42197 | Medium | 5.5 | 2025-12-11 | HCL Workload Scheduler stores user credentials in plain text which can be read by a local user. |
CVE-2025-52622 | Medium | 5.4 | 2025-12-02 | The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, makin… |
CVE-2025-0248 | High | 8.1 | 2025-11-25 | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticat… |
CVE-2025-62346 | Medium | 6.8 | 2025-11-20 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malic… |
CVE-2025-52639 | Low | 3.5 | 2025-11-18 | HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitle… |
CVE-2025-55278 | High | 8.1 | 2025-11-05 | Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their… |
CVE-2025-31954 | Medium | 5.4 | 2025-11-05 | HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive i… |
CVE-2025-52602 | Medium | 4.2 | 2025-11-05 | HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses… |
CVE-2024-42192 | Medium | 5.5 | 2025-10-16 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications. |
CVE-2025-0277 | Medium | 6.5 | 2025-10-16 | HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into p… |
CVE-2025-0276 | Medium | 6.5 | 2025-10-16 | HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker… |
CVE-2025-0275 | Medium | 5.3 | 2025-10-16 | HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowi… |
CVE-2025-0274 | Medium | 5.3 | 2025-10-16 | HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint act… |
CVE-2025-31995 | Low | 3.5 | 2025-10-13 | HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command… |
CVE-2025-31996 | Medium | 5.3 | 2025-10-13 | HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system… |
CVE-2025-31994 | Medium | 4.3 | 2025-10-13 | HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then… |
CVE-2025-52615 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies control… |
CVE-2025-52614 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suita… |
CVE-2025-31969 | Medium | 4.0 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come ac… |
CVE-2025-31992 | Medium | 4.6 | 2025-10-12 | HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the… |
CVE-2025-52616 | Medium | 5.3 | 2025-10-12 | HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities i… |
CVE-2025-31998 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this inform… |
CVE-2025-31997 | Medium | 4.2 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in… |
CVE-2025-31993 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by su… |
CVE-2025-52647 | Medium | 6.1 | 2025-10-10 | The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks. |
CVE-2025-52658 | Low | 3.5 | 2025-10-03 | HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited. |
CVE-2025-52654 | Medium | 4.6 | 2025-10-03 | HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially all… |
CVE-2025-0280 | High | 7.5 | 2025-09-03 | A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access. |
CVE-2025-31971 | Medium | 5.1 | 2025-08-28 | AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery (SSRF) attack… |
CVE-2025-31979 | Medium | 5.4 | 2025-08-28 | A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions… |
CVE-2025-31977 | Medium | 5.3 | 2025-08-28 | HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness… |
CVE-2025-31972 | Medium | 6.5 | 2025-08-28 | HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker… |
CVE-2025-31988 | Medium | 4.9 | 2025-08-19 | HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access. |