HCL Software vulnerabilities, page 4
400 vulnerabilities
Known vulnerabilities in HCL Software products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 119 products.
CVE-2025-62330hcl softwaredevops deploy+1
EPSS score0.15%
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.CVE-2025-62318hcl softwareaionEPSS score0.12%
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.CVE-2025-62346hcl softwareglovius cloudEPSS score0.11%
A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint.CVE-2025-62340hcl softwareicontrol+1EPSS score0.20%
HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivityCVE-2025-62342hcl softwareiemEPSS score0.19%
HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion.CVE-2025-62307hcl softwareiemEPSS score0.25%
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.CVE-2025-62300hcl softwareiemEPSS score0.23%
HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.CVE-2025-62299hcl softwareiemEPSS score0.26%
HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.CVE-2025-62315hcl softwareaionEPSS score0.21%
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.CVE-2025-62314hcl softwareaionEPSS score0.15%
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.CVE-2025-62329hcl softwaredevops deploy / launch+2EPSS score0.19%
HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.CVE-2025-0254hcl softwarehcl digital experienceEPSS score0.30%
HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept and potentially alter communication between two parties.CVE-2025-0250hcl softwareiem+1EPSS score0.19%
HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.CVE-2025-0275hcl softwarebigfix mobile+2EPSS score0.26%
HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.CVE-2025-0274hcl softwarebigfix modern client management+2EPSS score0.26%
HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.CVE-2025-0256hcl softwarehcl devops deploy / hcl launch+2EPSS score0.28%
HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.CVE-2025-0278hcl softwarehcl traveler+1EPSS score0.30%
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.CVE-2025-0255hcl softwarehcl devops deploy / hcl launch+2EPSS score0.69%
HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.CVE-2025-0253hcl softwareiem+1EPSS score0.23%
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities.CVE-2025-0276hcl softwarebigfix modern client management+2EPSS score0.30%
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.