Hcltech vulnerabilities, page 3
473 vulnerabilities
Known vulnerabilities in Hcltech products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 96 products.
CVE-2025-52661hcl softwareaion+1
EPSS score0.18%
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.CVE-2025-52614hcl softwareunica platform+1EPSS score0.14%
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.CVE-2025-52644hclaion+1EPSS score0.14%
HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce traceability of user activities and could potentially impact monitoring, accountability, or incident investigation processes.CVE-2025-52616hcl softwareunica+1EPSS score0.26%
HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.CVE-2025-52654hcl softwarehcl myxalytics+1EPSS score0.18%
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.CVE-2025-52634hclhcl aion+1EPSS score0.24%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.CVE-2025-52649hclaion+1EPSS score0.13%
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess system-generated values, potentially leading to limited information disclosure or unintended access under specific conditions.CVE-2025-52629hclaion+1EPSS score0.14%
HCL AION is susceptible to Missing Content-Security-Policy.
An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.CVE-2025-52650hclhcl aion+1EPSS score0.23%
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0CVE-2025-52618hcl softwarebigfix saas remediate+1EPSS score0.33%
HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries.CVE-2025-52642hclaion+1EPSS score0.11%
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal paths may reveal environment structure details which could potentially aid in further targeted attacks or information disclosure.CVE-2025-52619hcl softwarebigfix saas remediate+1EPSS score0.27%
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform.CVE-2025-52636hclaion+1EPSS score0.15%
HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resource consumption, which could potentially lead to service degradation or denial-of-service conditions under certain scenarios.CVE-2025-52603hclsoftwareconnections+1EPSS score0.30%
HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.CVE-2025-52626hclaion+1EPSS score0.68%
A Potential Command Injection vulnerability in HCL AION.
An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0CVE-2025-52623hclaion+1EPSS score0.18%
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.CVE-2025-52621hcl softwarebigfix saas remediate+1EPSS score0.15%
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.CVE-2025-52641hclaion+1EPSS score0.12%
HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information disclosure.CVE-2025-52615hcl softwareunica platform+1EPSS score0.21%
HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.CVE-2025-52609hclicontrol+1EPSS score0.16%
HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.