HCL Software vulnerabilities, page 3
400 vulnerabilities
Known vulnerabilities in HCL Software products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 119 products.
CVE-2025-52657hcl softwaremyxalytics
EPSS score0.16%
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.CVE-2025-52621hcl softwarebigfix saas remediate+1EPSS score0.15%
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.CVE-2025-52652hcl softwaremyxalyticsEPSS score0.15%
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.CVE-2025-52615hcl softwareunica platform+1EPSS score0.21%
HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.CVE-2025-52647hcl softwarebigfix webuiEPSS score0.19%
The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks.CVE-2025-52658hcl softwaremyxalytics+1EPSS score0.19%
HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.CVE-2025-52660hcl softwareaion+1EPSS score0.33%
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.CVE-2025-52659hcl softwareaion+1EPSS score0.19%
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.CVE-2025-59873hcl softwarezie for webEPSS score0.30%
An information exposure vulnerability exists in
Vulnerability in HCL Software ZIE for Web.
The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions
This issue affects ZIE for Web: v16.CVE-2025-59872hcl softwarezie+1EPSS score0.45%
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the codeCVE-2025-59870hcl softwaremyxalytics+1EPSS score0.27%
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security riskCVE-2025-59849hcl softwarebigfix remote control+2EPSS score0.19%
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.CVE-2025-55249hcl softwareaion+1EPSS score0.21%
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.CVE-2025-55251hcl softwareaion+1EPSS score0.21%
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.CVE-2025-55254hcl softwarebigfix remote control+2EPSS score0.19%
Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.CVE-2025-55278hcl softwaredevops loopEPSS score0.20%
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.CVE-2025-55250hcl softwareaion+1EPSS score0.16%
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks.CVE-2025-55252hcl softwareaion+1EPSS score0.18%
HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized accessCVE-2025-62343hcl softwarehcl iemEPSS score0.18%
HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion.CVE-2025-62306hcl softwareiemEPSS score0.28%
HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response.