Hcltech Aion
29 CVEs affecting Hcltech Aion. Latest disclosed: 2026-04-15. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52650 | High | 8.2 | 2025-10-10 | Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0 |
CVE-2025-52632 | Medium | 6.5 | 2025-10-10 | A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0. |
CVE-2025-52644 | Medium | 5.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce t… |
CVE-2025-52627 | Medium | 5.5 | 2026-02-03 | Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing… |
CVE-2025-52624 | Medium | 5.4 | 2025-10-10 | A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized sc… |
CVE-2025-52643 | Medium | 4.7 | 2026-03-16 | HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expos… |
CVE-2025-52628 | Medium | 4.6 | 2026-02-03 | HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potenti… |
CVE-2025-52626 | Medium | 4.5 | 2026-02-03 | A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the… |
CVE-2025-52631 | Low | 3.7 | 2026-02-03 | HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially expo… |
CVE-2025-52623 | Low | 3.7 | 2026-02-03 | HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead… |
CVE-2025-52629 | Low | 3.7 | 2026-02-03 | HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content in… |
CVE-2025-52635 | Low | 3.7 | 2025-10-10 | A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0. |
CVE-2025-52625 | Low | 3.7 | 2025-10-10 | A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or intern… |
CVE-2025-52634 | Low | 3.7 | 2025-10-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0. |
CVE-2025-52630 | Low | 3.7 | 2025-10-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0. |
CVE-2025-55249 | Low | 3.5 | 2026-01-19 | HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall securi… |
CVE-2025-52642 | Low | 3.3 | 2026-03-16 | HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal… |
CVE-2025-52633 | Low | 3.1 | 2026-02-03 | HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies m… |
CVE-2025-55252 | Low | 3.1 | 2026-01-19 | HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauth… |
CVE-2025-55251 | Low | 3.1 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |