Hclsoftware vulnerabilities, page 4
96 vulnerabilities
Known vulnerabilities in Hclsoftware products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 39 products.
CVE-2026-21783hclsoftwaretraveler+1
EPSS score0.28%
HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.CVE-2026-21764hclsoftwaredevops loop+1EPSS score0.22%
HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions.CVE-2026-21761hclsoftwaredevops loop+1EPSS score0.20%
HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.CVE-2026-21767hclsoftwarebigfix platform+1EPSS score0.11%
HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication.CVE-2026-21762hclsoftwaredevops loop+1EPSS score0.29%
HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.CVE-2026-21770hclsoftwarehcl traveler for microsoft outlook (htmo)EPSS score0.16%
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.CVE-2026-21824hclsoftwarecommerceEPSS score0.42%
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.CVE-2026-21785hclsoftwarebigfix remote control serverEPSS score0.15%
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.CVE-2026-21760hclsoftwaredevops loop+1EPSS score0.21%
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.CVE-2026-56457hclsoftwarehcl devops deploy / hcl launch+2EPSS score0.30%
HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with access to the logs to potentially obtain sensitive values related to that step.CVE-2026-56620hclsoftwarehcl bigfix mobileEPSS score0.29%
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.CVE-2026-56458hclsoftwarehcl devops deploy+1EPSS score0.26%
HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.CVE-2026-56547hclsoftwaretravelerEPSS score0.28%
The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects them back in the generated Apple profile. The Apple profile is not usable without additional information and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values submitted and reflected back in the Apple profile are found in the Domino directory entry for the already authenticated user.CVE-2026-56619hclsoftwarehcl bigfix mobileEPSS score0.23%
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.CVE-2026-56577hclsoftwaremycloud+1EPSS score0.28%
HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.CVE-2026-56587hclsoftwareintelliops event management+1EPSS score0.24%
HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.CVE-2026-56580hclsoftwaremycloud+1EPSS score0.28%
HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.CVE-2026-56538hclsoftwareconnections+1EPSS score0.27%
An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.CVE-2026-56578hclsoftwaremycloud+1EPSS score0.26%
HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.CVE-2026-56459hclsoftwarehcl devops deploy / hcl launch+2EPSS score0.15%
HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that could be read by a local user.