HCL Software vulnerabilities, page 5
400 vulnerabilities
Known vulnerabilities in HCL Software products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 119 products.
CVE-2025-0273hcl softwarehcl devops deploy / hcl launch+2
EPSS score0.16%
HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.CVE-2025-0257hcl softwarehcl devops deploy / hcl launch+2EPSS score0.31%
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.CVE-2025-0279hcl softwarehcl traveler+1EPSS score0.30%
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.CVE-2025-0280hcl softwarecompassEPSS score0.11%
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.CVE-2025-0251hcl softwareiem+1EPSS score0.23%
HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks.CVE-2025-0249hcl softwareiem+1EPSS score0.23%
HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization.CVE-2025-0248hcl softwareinotesEPSS score0.38%
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.CVE-2025-0272hcl softwarehcl devops deploy / hcl launch+2EPSS score0.26%
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.CVE-2025-0252hcl softwareiem+1EPSS score0.16%
HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit.CVE-2025-0277hcl softwarebigfix mobile+2EPSS score0.30%
HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.CVE-2025-31987hcl softwareconnections docs+1EPSS score0.22%
HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion.CVE-2025-31996hcl softwareunica platform+1EPSS score0.24%
HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.CVE-2025-31953hcl softwareiautomate+1EPSS score0.28%
HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties.CVE-2025-31971hcl softwareaiml solutions for sxEPSS score0.14%
AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery (SSRF) attack enabling unauthorized network calls from the system, potentially exposing internal services or sensitive information.CVE-2025-31993hcl softwareunica centralized offer management+1EPSS score0.24%
HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.CVE-2025-31998hcl softwareunica centralized offer management+1EPSS score0.39%
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service.CVE-2025-31961hcl softwareconnections+1EPSS score0.15%
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2025-31959hcl softwarebigfix service management (sm)+1EPSS score0.14%
HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. .CVE-2025-31974hcl softwarebigfix service management (sm)+1EPSS score0.18%
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow
unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes.CVE-2025-31977hcl softwarebigfix service management (sm)+1EPSS score0.10%
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.