Hcltech
37 CVEs across 102 Hcltech products. Browse Hcltech vulnerabilities, severities, and proof-of-concept exploits.
Hcltech products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56609 | Medium | 4.8 | 2026-08-03 | HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and… |
CVE-2026-56608 | Low | 3.7 | 2026-08-03 | HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access o… |
CVE-2026-56571 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavail… |
CVE-2026-56570 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for… |
CVE-2026-56569 | Medium | 4.0 | 2026-07-31 | HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web serve… |
CVE-2026-56568 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/A… |
CVE-2026-56567 | Medium | 5.1 | 2026-07-31 | HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper… |
CVE-2026-56583 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse. |
CVE-2026-56582 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL pa… |
CVE-2026-56581 | Low | 2.6 | 2026-07-21 | HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens. |
CVE-2026-56580 | Low | 2.2 | 2026-07-21 | HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compr… |
CVE-2026-56579 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's… |
CVE-2026-56578 | Low | 2.2 | 2026-07-21 | HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versio… |
CVE-2026-56577 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks. |
CVE-2026-56586 | Low | 3.1 | 2026-07-21 | HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept se… |
CVE-2026-56585 | Low | 3.1 | 2026-07-21 | HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce un… |
CVE-2026-56587 | Low | 3.7 | 2026-07-21 | HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise… |
CVE-2026-56584 | Low | 3.7 | 2026-07-21 | HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilit… |
CVE-2023-37507 | High | 7.5 | 2026-07-21 | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. |
CVE-2023-37508 | Medium | 6.1 | 2026-07-21 | HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknes… |
CVE-2026-21764 | Low | 3.1 | 2026-07-17 | HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended appl… |
CVE-2026-21762 | Low | 3.7 | 2026-07-17 | HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as… |
CVE-2026-21761 | Medium | 4.2 | 2026-07-17 | HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin request… |
CVE-2026-21760 | Medium | 4.6 | 2026-07-17 | HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthori… |
CVE-2026-56456 | Medium | 5.3 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding i… |
CVE-2026-56455 | Medium | 5.3 | 2026-07-16 | HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input si… |
CVE-2026-56454 | Medium | 5.9 | 2026-07-16 | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographi… |
CVE-2026-56453 | Medium | 5.5 | 2026-07-16 | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the serv… |
CVE-2026-35145 | Low | 3.1 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Sec… |
CVE-2026-35143 | Low | 3.0 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated… |
CVE-2026-35142 | Low | 2.6 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated serv… |
CVE-2026-35141 | Low | 2.6 | 2026-07-16 | HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit v… |
CVE-2026-35140 | Low | 3.0 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute… |
CVE-2026-35149 | High | 8.2 | 2026-07-16 | HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploi… |
CVE-2026-35148 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authen… |
CVE-2026-35147 | High | 8.2 | 2026-07-16 | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when… |
CVE-2026-35146 | Medium | 6.3 | 2026-07-16 | HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via t… |
CVE-2025-59868 | Medium | 5.5 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application inform… |
CVE-2023-37524 | High | 7.7 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reach… |
CVE-2024-23581 | Medium | 6.7 | 2026-06-26 | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. |
CVE-2025-62340 | Low | 3.1 | 2026-06-17 | HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automaticall… |
CVE-2025-59872 | Medium | 4.3 | 2026-06-17 | HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain comman… |
CVE-2026-4096 | Medium | 6.5 | 2026-06-11 | IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an att… |
CVE-2026-21837 | High | 8.8 | 2026-06-05 | HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating s… |
CVE-2026-21826 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause… |
CVE-2026-21825 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary J… |
CVE-2025-52612 | High | 7.1 | 2026-06-04 | HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by a… |
CVE-2025-52611 | Low | 3.1 | 2026-06-04 | HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in… |
CVE-2025-52609 | Low | 3.7 | 2026-06-04 | HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering me… |
CVE-2025-52608 | Low | 3.1 | 2026-06-04 | HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, incl… |
CVE-2025-52606 | Medium | 4.3 | 2026-06-04 | HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received i… |
CVE-2025-31985 | Low | 3.7 | 2026-05-20 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2025-31973 | Medium | 4.0 | 2026-05-20 | HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introd… |
CVE-2025-15634 | Medium | 4.3 | 2026-05-09 | A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information v… |
CVE-2025-15633 | Medium | 6.5 | 2026-05-09 | An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names… |
CVE-2025-31974 | Low | 3.9 | 2026-05-06 | HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintend… |
CVE-2025-31960 | Medium | 5.3 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that suppl… |
CVE-2024-30151 | High | 8.3 | 2026-05-06 | HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users t… |
CVE-2025-52613 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the… |
CVE-2025-31984 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2025-31983 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious… |
CVE-2025-31982 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk… |
CVE-2025-31978 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An… |
CVE-2025-31976 | Medium | 4.8 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appl… |
CVE-2025-31975 | Low | 2.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software ve… |
CVE-2025-31959 | Low | 3.5 | 2026-05-06 | HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sens… |
CVE-2025-31957 | Low | 2.6 | 2026-05-06 | HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of s… |
CVE-2025-59854 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, wh… |
CVE-2025-59853 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an… |
CVE-2025-59852 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which… |
CVE-2025-59851 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which… |
CVE-2025-31970 | Medium | 5.3 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for… |
CVE-2025-31981 | Medium | 5.3 | 2026-04-21 | HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker… |
CVE-2025-31958 | Low | 3.7 | 2026-04-21 | HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through… |
CVE-2025-52641 | Low | 2.9 | 2026-04-15 | HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information m… |
CVE-2025-31991 | Medium | 6.8 | 2026-04-13 | Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful l… |
CVE-2026-21767 | Medium | 4.0 | 2026-04-02 | HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper… |
CVE-2026-21765 | High | 8.8 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might… |
CVE-2025-55264 | Medium | 5.5 | 2026-03-26 | HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control… |
CVE-2025-55263 | High | 7.3 | 2026-03-26 | HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories… |
CVE-2025-55262 | High | 8.3 | 2026-03-26 | HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database. |
CVE-2025-55261 | High | 8.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the applicat… |
CVE-2025-55277 | Low | 2.6 | 2026-03-26 | HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits available across the… |
CVE-2025-55276 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout. |
CVE-2025-55275 | Low | 3.7 | 2026-03-26 | HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijack or impersonate an… |
CVE-2025-55274 | Low | 2.6 | 2026-03-26 | HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to a… |
CVE-2025-55273 | Medium | 4.3 | 2026-03-26 | HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability where an attacker using external scripts can tamper with the DOM, altering the con… |
CVE-2025-55272 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version details which would all… |
CVE-2025-55271 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker… |
CVE-2025-55270 | Low | 3.5 | 2026-03-26 | HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks such as XSS, SQL Inje… |
CVE-2025-55269 | Medium | 4.2 | 2026-03-26 | HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force technique… |
CVE-2025-55268 | Medium | 4.3 | 2026-03-26 | HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and processing resources… |
CVE-2025-55267 | Medium | 5.7 | 2026-03-26 | HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over t… |
CVE-2025-55266 | Medium | 5.9 | 2026-03-26 | HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf o… |
CVE-2025-55265 | Medium | 6.5 | 2026-03-26 | HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it t… |
CVE-2026-21783 | Medium | 4.3 | 2026-03-24 | HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and… |
CVE-2026-21788 | Medium | 5.4 | 2026-03-19 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2024-42210 | High | 7.6 | 2026-03-19 | A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-… |
CVE-2025-62320 | Medium | 4.7 | 2026-03-17 | HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this… |
CVE-2025-31966 | Low | 2.7 | 2026-03-17 | HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server… |