Hcltechsw
51 CVEs across 11 Hcltechsw products. Browse Hcltechsw vulnerabilities, severities, and proof-of-concept exploits.
Hcltechsw products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56460 | Medium | 6.5 | 2026-07-09 | HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attack… |
CVE-2026-56459 | Medium | 6.2 | 2026-07-09 | HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that… |
CVE-2026-56458 | Medium | 5.4 | 2026-07-09 | HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as… |
CVE-2026-56457 | Medium | 4.3 | 2026-06-29 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with… |
CVE-2025-62327 | Medium | 4.9 | 2026-01-07 | In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing auth… |
CVE-2025-59849 | Medium | 4.7 | 2025-12-17 | Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicio… |
CVE-2025-55254 | Low | 3.7 | 2025-12-17 | Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malic… |
CVE-2025-62329 | Medium | 5.0 | 2025-12-16 | HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused… |
CVE-2025-62330 | Medium | 5.9 | 2025-12-16 | HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS a… |
CVE-2025-0272 | Medium | 5.4 | 2025-04-03 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2025-0257 | Medium | 6.3 | 2025-04-02 | HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its A… |
CVE-2025-0273 | Medium | 5.5 | 2025-03-27 | HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user. |
CVE-2025-0255 | High | 7.2 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted… |
CVE-2025-0256 | Medium | 4.3 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization f… |
CVE-2024-42196 | Medium | 6.2 | 2024-12-06 | HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs. |
CVE-2024-42195 | Low | 3.1 | 2024-12-05 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2024-23576 | High | 7.1 | 2024-05-14 | Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized admini… |
CVE-2024-23561 | Medium | 4.3 | 2024-04-15 | HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values. |
CVE-2024-23558 | Medium | 6.3 | 2024-04-15 | HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. |
CVE-2024-23560 | Medium | 4.4 | 2024-04-15 | HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. |
CVE-2024-23559 | Medium | 6.1 | 2024-04-15 | HCL DevOps Deploy / Launch is generating an obsolete HTTP header. |
CVE-2024-23550 | Medium | 6.2 | 2024-02-03 | HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent. |
CVE-2023-37523 | Medium | 5.6 | 2024-01-16 | Missing or insecure tags in the HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower could allow an attacker to execute a malicious script on the use… |
CVE-2023-37522 | Medium | 5.6 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower has missing or insecure tags that could allow an attacker to execute a malicious script on the u… |
CVE-2023-37521 | Low | 2.3 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to e… |
CVE-2023-45702 | Medium | 6.2 | 2023-12-28 | An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.. |
CVE-2023-45701 | Medium | 4.3 | 2023-12-28 | HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information c… |
CVE-2023-45700 | Medium | 4.3 | 2023-12-21 | HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive inf… |
CVE-2023-45703 | Medium | 5.3 | 2023-12-21 | HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. |
CVE-2023-23348 | Medium | 5.1 | 2023-07-10 | HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed. |
CVE-2022-42452 | Medium | 4.6 | 2023-04-02 | HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Re… |
CVE-2022-44756 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged ac… |
CVE-2022-42454 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged netw… |
CVE-2022-42445 | Medium | 4.9 | 2022-12-12 | HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for… |
CVE-2022-38661 | Medium | 6.2 | 2022-12-12 | HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash. |
CVE-2022-38656 | High | 8.6 | 2022-12-12 | HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes. |
CVE-2022-27551 | Medium | 5.3 | 2022-08-03 | HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. |
CVE-2021-27785 | Low | 3.9 | 2022-07-30 | HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perfor… |
CVE-2022-27549 | Medium | 4.0 | 2022-07-06 | HCL Launch may store certain data for recurring activities in a plain text format. |
CVE-2022-27548 | Medium | 4.9 | 2022-07-06 | HCL Launch stores user credentials in plain clear text which can be read by a local user. |
CVE-2021-27751 | Medium | 4.4 | 2022-05-06 | HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are st… |
CVE-2021-27746 | Medium | 5.4 | 2021-10-21 | "HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability" |
CVE-2021-27741 | Critical | 9.1 | 2021-08-13 | " Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection" |
CVE-2020-14247 | Medium | 6.5 | 2021-02-04 | HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID. |
CVE-2020-14246 | High | 7.5 | 2021-02-04 | HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials. |
CVE-2020-14245 | Critical | 9.8 | 2021-02-04 | HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant… |
CVE-2020-14275 | Critical | 9.8 | 2021-01-12 | Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of us… |
CVE-2020-14274 | High | 7.5 | 2021-01-12 | Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data… |
CVE-2020-14231 | High | 8.8 | 2020-12-22 | A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attacker resulting in a… |
CVE-2020-14225 | Medium | 6.5 | 2020-12-21 | HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vu… |
CVE-2020-4100 | Medium | 4.4 | 2020-07-15 | "HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be… |