Hclsoftware vulnerabilities
96 vulnerabilities
Known vulnerabilities in Hclsoftware products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 39 products.
Products
39- Aftermarket EPC14 vulnerabilities
- Connections9 vulnerabilities
- HCL Hive7 vulnerabilities
- Mycloud7 vulnerabilities
- Bigfix Quantum Risk Analyzer4 vulnerabilities
- Devops Loop4 vulnerabilities
- HCL Devops Deploy / HCL Launch4 vulnerabilities
- Intelliops Event Management4 vulnerabilities
- Bigfix IVR3 vulnerabilities
- Digital Experience3 vulnerabilities
- Traveler3 vulnerabilities
- Traveler For Microsoft Outlook3 vulnerabilities
- Bigfix Platform2 vulnerabilities
- Bigfix Service Management (SM)2 vulnerabilities
- Bigfix Webui2 vulnerabilities
- Devops Plan2 vulnerabilities
- Dfxserver2 vulnerabilities
- HCL Bigfix Mobile2 vulnerabilities
- Bigfix Cloud Lifecycle Management1 vulnerabilities
- Bigfix Compliance1 vulnerabilities
- Bigfix Remote Control Server1 vulnerabilities
- Bigfix SCM Reporting1 vulnerabilities
- Commerce1 vulnerabilities
- Devops Deploy1 vulnerabilities
- Dfmpro For Catia1 vulnerabilities
- Dfxanalytics1 vulnerabilities
- Digital Experience & DX Compose1 vulnerabilities
- Dominoiq1 vulnerabilities
- DX Compose1 vulnerabilities
- HCL Bigfix Platform1 vulnerabilities
- HCL Devops Deploy1 vulnerabilities
- HCL Devops Velocity1 vulnerabilities
- HCL Digital Experience And Digital Experience Compose1 vulnerabilities
- HCL Traveler For Microsoft Outlook (Htmo)1 vulnerabilities
- Nomad Server On Domino1 vulnerabilities
- Sametime For Ios1 vulnerabilities
- Unica Marketing Operations (Plan)1 vulnerabilities
- Velocity1 vulnerabilities
- Verse For Android1 vulnerabilities
CVE-2026-67165hclsoftwareconnections
EPSS score0.15%
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.CVE-2025-52603hclsoftwareconnections+1EPSS score0.30%
HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.CVE-2025-59866hclsoftwaredfmpro for catia+2EPSS score0.10%
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.CVE-2025-59868hclsoftwaretraveler for microsoft outlook+1EPSS score0.15%
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.CVE-2025-62328hclsoftwarenomad server on dominoEPSS score0.25%
HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to obtain sensitive information via unspecified vectors.CVE-2025-62338hclsoftwarebigfix cloud lifecycle managementEPSS score0.10%
HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information exposure.CVE-2025-62327hclsoftwaredevops deploy+1EPSS score0.26%
In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.CVE-2025-62341hclsoftwareconnectionsEPSS score0.12%
HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.CVE-2025-62326hclsoftwaredigital experience+1EPSS score0.18%
HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.CVE-2025-68833hclsoftwarehcl hiveEPSS score0.15%
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.CVE-2025-68825hclsoftwarehcl hiveEPSS score0.23%
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.CVE-2025-31962hclsoftwarebigfix ivr+1EPSS score0.18%
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.CVE-2025-31991hclsoftwarevelocity+1EPSS score0.23%
Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.CVE-2025-31963hclsoftwarebigfix ivr+1EPSS score0.09%
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.CVE-2025-31990hclsoftwarehcl devops velocityEPSS score0.29%
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.CVE-2025-31964hclsoftwarebigfix ivr+1EPSS score0.35%
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.CVE-2025-31958hclsoftwarebigfix service management (sm)+1EPSS score0.18%
HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.CVE-2025-31981hclsoftwarebigfix service management (sm)+1EPSS score0.09%
HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data.CVE-2025-15619hclsoftwareconnectionsEPSS score0.16%
HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.CVE-2025-15633hclsoftwarebigfix webui+21EPSS score0.22%
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.