Hcl vulnerabilities
90 vulnerabilities
Known vulnerabilities in Hcl products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 20 products.
Products
20- Aion32 vulnerabilities
- Aftermarket DPC17 vulnerabilities
- Bigfix Service Management (SM)8 vulnerabilities
- Dfxanalytics5 vulnerabilities
- Icontrol5 vulnerabilities
- HCL Myxalytics3 vulnerabilities
- Sametime3 vulnerabilities
- Bigfix Runbookai2 vulnerabilities
- HCL AION2 vulnerabilities
- HCL Domino2 vulnerabilities
- HCL Notes2 vulnerabilities
- Appscan Source1 vulnerabilities
- Domino Appdev Pack1 vulnerabilities
- HCL Bigfix Webui1 vulnerabilities
- HCL Connections1 vulnerabilities
- HCL Icontrol1 vulnerabilities
- HCL Traveler1 vulnerabilities
- Hive1 vulnerabilities
- Ireflection1 vulnerabilities
- Unica1 vulnerabilities
CVE-2025-52635hclaion+1
EPSS score0.26%
A
rusted types in scripts not enforced in CSP vulnerability has been identified
in HCL AION.This issue affects AION: 2.0.CVE-2025-52632hclaion+1EPSS score0.15%
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52630hclaion+1EPSS score0.24%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52624hclaion+1EPSS score0.20%
A vulnerability Bypass of the script allowlist configuration in HCL AION.
An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.CVE-2025-52612hclicontrol+1EPSS score0.20%
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .CVE-2025-52644hclaion+1EPSS score0.14%
HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce traceability of user activities and could potentially impact monitoring, accountability, or incident investigation processes.CVE-2025-52634hclhcl aion+1EPSS score0.24%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.CVE-2025-52649hclaion+1EPSS score0.13%
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess system-generated values, potentially leading to limited information disclosure or unintended access under specific conditions.CVE-2025-52629hclaion+1EPSS score0.14%
HCL AION is susceptible to Missing Content-Security-Policy.
An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.CVE-2025-52650hclhcl aion+1EPSS score0.23%
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0CVE-2025-52642hclaion+1EPSS score0.11%
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal paths may reveal environment structure details which could potentially aid in further targeted attacks or information disclosure.CVE-2025-52636hclaion+1EPSS score0.15%
HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resource consumption, which could potentially lead to service degradation or denial-of-service conditions under certain scenarios.CVE-2025-52648hclaionEPSS score0.12%
HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the systemCVE-2025-52626hclaion+1EPSS score0.68%
A Potential Command Injection vulnerability in HCL AION.
An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0CVE-2025-52623hclaion+1EPSS score0.18%
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.CVE-2025-52638hclaionEPSS score0.13%
HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configurations with security best practices requires minimizing privileges and avoiding root-level execution wherever possible.CVE-2025-52641hclaion+1EPSS score0.12%
HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information disclosure.CVE-2025-52655hclhcl myxalyticsEPSS score0.19%
Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6
allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure.CVE-2025-52609hclicontrol+1EPSS score0.16%
HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.CVE-2025-52645hclaion+1EPSS score0.09%
HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow the possibility of unverified or modified model artifacts being used, potentially leading to integrity concerns or unintended behaviour.