Hcltechsw vulnerabilities
51 vulnerabilities
Known vulnerabilities in Hcltechsw products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 11 products.
Products
11- Hcl Launch28 vulnerabilities
- Hcl Devops Deploy20 vulnerabilities
- Hcl Commerce7 vulnerabilities
- Bigfix Bare Osd Metal Server Webui3 vulnerabilities
- Onetest Performance3 vulnerabilities
- Bigfix Insights For Vulnerability Remediation2 vulnerabilities
- Connections1 vulnerabilities
- Hcl Client Application Access1 vulnerabilities
- Hcl Inotes1 vulnerabilities
- Hcl Verse1 vulnerabilities
- Hcl Workload Automation1 vulnerabilities
CVE-2021-27746hcltechswconnections
EPSS score0.47%
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"CVE-2021-27751hcl softwarehcl commerce+1EPSS score0.19%
HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.CVE-2021-27785hcl softwarehcl commerce+1EPSS score0.18%
HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.CVE-2021-27741hcltechswhcl_commerceEPSS score1.15%
" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"CVE-2025-59849hcl softwarebigfix remote control+2EPSS score0.19%
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.CVE-2025-55254hcl softwarebigfix remote control+2EPSS score0.19%
Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.CVE-2025-62330hcl softwaredevops deploy+1EPSS score0.15%
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.CVE-2025-62327hclsoftwaredevops deploy+1EPSS score0.26%
In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.CVE-2025-62329hcl softwaredevops deploy / launch+2EPSS score0.19%
HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.CVE-2025-0256hcl softwarehcl devops deploy / hcl launch+2EPSS score0.28%
HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.CVE-2025-0255hcl softwarehcl devops deploy / hcl launch+2EPSS score0.69%
HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.CVE-2025-0273hcl softwarehcl devops deploy / hcl launch+2EPSS score0.15%
HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.CVE-2025-0257hcl softwarehcl devops deploy / hcl launch+2EPSS score0.31%
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.CVE-2025-0272hcl softwarehcl devops deploy / hcl launch+2EPSS score0.26%
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.CVE-2020-14246hcltechswonetest_performanceEPSS score0.69%
HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials.CVE-2020-14275hcltechswhcl_commerceEPSS score1.46%
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.CVE-2020-14245hcltechswonetest_performanceEPSS score1.21%
HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant amount of resources.CVE-2020-14274hcltechswhcl_commerceEPSS score1.33%
Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors.CVE-2020-14225hcltechhcl_inotes+1EPSS score1.27%
HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack.CVE-2020-14231hcltechswhcl_client_application_accessEPSS score1.03%
A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attacker resulting in a stack buffer overflow. This could allow the attacker to crash the program or inject code into the system which would execute with the privileges of the currently logged in user.