Hclsoftware
29 CVEs across 37 Hclsoftware products. Browse Hclsoftware vulnerabilities, severities, and proof-of-concept exploits.
Hclsoftware products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56619 | Medium | 5.4 | 2026-08-10 | HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input. |
CVE-2026-56620 | Medium | 4.3 | 2026-08-10 | HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting. |
CVE-2026-21766 | Medium | 5.4 | 2026-08-05 | The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases… |
CVE-2026-56538 | Low | 3.5 | 2026-07-27 | An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorize… |
CVE-2026-56537 | Low | 3.5 | 2026-07-27 | HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper h… |
CVE-2026-56583 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse. |
CVE-2026-56582 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL pa… |
CVE-2026-56581 | Low | 2.6 | 2026-07-21 | HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens. |
CVE-2026-56580 | Low | 2.2 | 2026-07-21 | HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compr… |
CVE-2026-56579 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's… |
CVE-2026-56578 | Low | 2.2 | 2026-07-21 | HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versio… |
CVE-2026-56577 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks. |
CVE-2026-56586 | Low | 3.1 | 2026-07-21 | HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept se… |
CVE-2026-56585 | Low | 3.1 | 2026-07-21 | HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce un… |
CVE-2026-56587 | Low | 3.7 | 2026-07-21 | HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise… |
CVE-2026-56584 | Low | 3.7 | 2026-07-21 | HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilit… |
CVE-2023-37507 | High | 7.5 | 2026-07-21 | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. |
CVE-2023-37508 | Medium | 6.1 | 2026-07-21 | HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknes… |
CVE-2026-21824 | High | 8.8 | 2026-07-20 | HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorize… |
CVE-2025-59866 | Low | 3.3 | 2026-07-17 | The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables… |
CVE-2026-21764 | Low | 3.1 | 2026-07-17 | HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended appl… |
CVE-2026-21762 | Low | 3.7 | 2026-07-17 | HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as… |
CVE-2026-21761 | Medium | 4.2 | 2026-07-17 | HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin request… |
CVE-2026-21760 | Medium | 4.6 | 2026-07-17 | HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthori… |
CVE-2024-42214 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are… |
CVE-2024-23578 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows acc… |
CVE-2024-23577 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol… |
CVE-2024-23575 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An… |
CVE-2024-23574 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in… |
CVE-2024-23573 | Low | 3.7 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and… |
CVE-2024-23572 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should re… |
CVE-2024-23571 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its f… |
CVE-2024-23570 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in… |
CVE-2024-23569 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header |
CVE-2024-23568 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version inform… |
CVE-2024-23567 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during norma… |
CVE-2024-23566 | Medium | 6.5 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute… |
CVE-2024-23565 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The a… |
CVE-2026-21770 | Medium | 6.5 | 2026-07-17 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application wi… |
CVE-2026-35146 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via t… |
CVE-2026-21840 | Low | 3.1 | 2026-07-14 | HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring… |
CVE-2026-56460 | Medium | 6.5 | 2026-07-09 | HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attack… |
CVE-2026-56459 | Medium | 6.2 | 2026-07-09 | HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that… |
CVE-2026-56458 | Medium | 5.4 | 2026-07-09 | HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as… |
CVE-2026-56457 | Medium | 4.3 | 2026-06-29 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with… |
CVE-2025-59868 | Medium | 5.5 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application inform… |
CVE-2023-37524 | High | 7.7 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reach… |
CVE-2024-23581 | Medium | 6.7 | 2026-06-26 | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. |
CVE-2025-15619 | Low | 3.5 | 2026-06-23 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. |
CVE-2026-21768 | Medium | 6.3 | 2026-06-19 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby all… |
CVE-2026-21837 | High | 8.8 | 2026-06-05 | HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating s… |
CVE-2026-21826 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause… |
CVE-2026-21825 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary J… |
CVE-2025-62338 | Low | 3.3 | 2026-06-04 | HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information expo… |
CVE-2026-21785 | Medium | 4.0 | 2026-05-27 | A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without f… |
CVE-2026-21836 | Medium | 6.5 | 2026-05-20 | The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ign… |
CVE-2026-21789 | Medium | 4.6 | 2026-05-18 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2026-21821 | High | 8.3 | 2026-05-13 | The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longe… |
CVE-2025-15634 | Medium | 4.3 | 2026-05-09 | A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information v… |
CVE-2025-15633 | Medium | 6.5 | 2026-05-09 | An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names… |
CVE-2025-31981 | Medium | 5.3 | 2026-04-21 | HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker… |
CVE-2025-31958 | Low | 3.7 | 2026-04-21 | HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through… |
CVE-2025-31991 | Medium | 6.8 | 2026-04-13 | Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful l… |
CVE-2026-21767 | Medium | 4.0 | 2026-04-02 | HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper… |
CVE-2026-21765 | High | 8.8 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might… |
CVE-2026-21790 | Medium | 6.3 | 2026-03-24 | HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks. |
CVE-2026-21783 | Medium | 4.3 | 2026-03-24 | HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and… |
CVE-2026-21788 | Medium | 5.4 | 2026-03-19 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2024-42210 | High | 7.6 | 2026-03-19 | A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-… |
CVE-2025-62328 | Low | 3.7 | 2026-03-11 | HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to ob… |
CVE-2026-21786 | Low | 3.3 | 2026-03-05 | HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs. |
CVE-2025-62326 | Medium | 6.1 | 2026-02-20 | HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to expl… |
CVE-2025-52603 | Low | 3.5 | 2026-02-20 | HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information wh… |
CVE-2025-31990 | Medium | 6.8 | 2026-02-07 | Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the syst… |
CVE-2023-37525 | Medium | 5.3 | 2026-01-28 | A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class… |
CVE-2025-62327 | Medium | 4.9 | 2026-01-07 | In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing auth… |
CVE-2025-31964 | Low | 2.2 | 2026-01-07 | Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability… |
CVE-2025-31963 | Low | 2.9 | 2026-01-07 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform una… |
CVE-2025-31962 | Low | 2.0 | 2026-01-07 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unautho… |