Hcltech vulnerabilities, page 2
473 vulnerabilities
Known vulnerabilities in Hcltech products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 96 products.
CVE-2021-27777hcl softwarehcl unica+1
EPSS score0.85%
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.CVE-2021-27771hcl softwaresametime+1EPSS score0.73%
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.CVE-2021-27759hcl softwarehcl bigfix inventory+1EPSS score0.30%
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.CVE-2021-27779hcl softwarehcl versionvault express+1EPSS score0.60%
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.CVE-2021-27770hcl softwaresametime+1EPSS score0.74%
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place.CVE-2021-27786hcl softwarehcl onetest server+1EPSS score0.58%
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.CVE-2021-27773hcl softwaresametime+1EPSS score0.47%
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-27769hcl softwaresametime+1EPSS score0.77%
Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible.CVE-2021-27780hcl softwarehcl bigfix mobile / modern client management+2EPSS score0.77%
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-27753hcltechhcl_sametimeEPSS score0.25%
"Sametime Android PathTraversal Vulnerability"CVE-2021-27764hcl softwarehcl bigfix webui+1EPSS score0.55%
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)CVE-2025-63402hcltechdragonEPSS score0.33%
An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requestsCVE-2025-63401hcltechdragonEPSS score0.33%
Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directivesCVE-2025-52639hcl softwareconnections+1EPSS score0.23%
HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data.CVE-2025-52635hclaion+1EPSS score0.26%
A
rusted types in scripts not enforced in CSP vulnerability has been identified
in HCL AION.This issue affects AION: 2.0.CVE-2025-52632hclaion+1EPSS score0.15%
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52630hclaion+1EPSS score0.24%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52624hclaion+1EPSS score0.20%
A vulnerability Bypass of the script allowlist configuration in HCL AION.
An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.CVE-2025-52612hclicontrol+1EPSS score0.20%
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .CVE-2025-52620hcl softwarebigfix saas remediate+1EPSS score0.19%
HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the submitted image format.