HCL Software vulnerabilities, page 2
400 vulnerabilities
Known vulnerabilities in HCL Software products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 119 products.
CVE-2021-27759hcl softwarehcl bigfix inventory+1
EPSS score0.30%
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.CVE-2021-27779hcl softwarehcl versionvault express+1EPSS score0.60%
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.CVE-2021-27770hcl softwaresametime+1EPSS score0.74%
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place.CVE-2021-27786hcl softwarehcl onetest server+1EPSS score0.58%
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.CVE-2021-27773hcl softwaresametime+1EPSS score0.47%
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-27769hcl softwaresametime+1EPSS score0.77%
Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible.CVE-2021-27780hcl softwarehcl bigfix mobile / modern client management+2EPSS score0.77%
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-27764hcl softwarehcl bigfix webui+1EPSS score0.55%
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)CVE-2025-52639hcl softwareconnections+1EPSS score0.23%
HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data.CVE-2025-52620hcl softwarebigfix saas remediate+1EPSS score0.19%
HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the submitted image format.CVE-2025-52661hcl softwareaion+1EPSS score0.18%
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.CVE-2025-52614hcl softwareunica platform+1EPSS score0.14%
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.CVE-2025-52616hcl softwareunica+1EPSS score0.26%
HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.CVE-2025-52654hcl softwarehcl myxalytics+1EPSS score0.18%
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.CVE-2025-52640hcl softwareaionEPSS score0.11%
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.CVE-2025-52618hcl softwarebigfix saas remediate+1EPSS score0.33%
HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries.CVE-2025-52602hcl softwarebigfix queryEPSS score0.17%
HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs). An attacker can use that information to target individuals with phishing or other social-engineering attacks.CVE-2025-52619hcl softwarebigfix saas remediate+1EPSS score0.27%
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform.CVE-2025-52622hcl softwarebigfix saas remediateEPSS score0.18%
The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.CVE-2025-52651hcl softwaremyxalyticsEPSS score0.15%
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.