https://vulnogram.org/ Most recent CVEs assigned by HCL Software (hcl). https://vulnogram.org/seaview/icons/hcl.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-67165 https://vulnogram.org/CVE-2026-67165 HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attack… Medium Tue, 13 Oct 2026 07:20:27 GMT https://vulnogram.org/CVE-2026-56596 https://vulnogram.org/CVE-2026-56596 HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior. Low Tue, 06 Oct 2026 11:57:56 GMT https://vulnogram.org/CVE-2026-21833 https://vulnogram.org/CVE-2026-21833 HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other r… Low Network Exploitable Thu, 01 Oct 2026 16:54:24 GMT https://vulnogram.org/CVE-2025-31980 https://vulnogram.org/CVE-2025-31980 HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing… Medium Network Exploitable Thu, 01 Oct 2026 16:17:54 GMT https://vulnogram.org/CVE-2026-67172 https://vulnogram.org/CVE-2026-67172 HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to… Low Network Exploitable Thu, 01 Oct 2026 16:16:05 GMT https://vulnogram.org/CVE-2026-67171 https://vulnogram.org/CVE-2026-67171 HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks. Medium Network Exploitable Thu, 01 Oct 2026 16:15:22 GMT https://vulnogram.org/CVE-2026-67106 https://vulnogram.org/CVE-2026-67106 HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks. Medium Network Exploitable Thu, 01 Oct 2026 15:01:08 GMT https://vulnogram.org/CVE-2026-56599 https://vulnogram.org/CVE-2026-56599 HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site… Low Thu, 01 Oct 2026 15:00:00 GMT https://vulnogram.org/CVE-2026-67104 https://vulnogram.org/CVE-2026-67104 HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for fur… Medium Network Exploitable Thu, 01 Oct 2026 14:59:31 GMT https://vulnogram.org/CVE-2026-67105 https://vulnogram.org/CVE-2026-67105 HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data… High Network Exploitable Thu, 01 Oct 2026 14:57:45 GMT https://vulnogram.org/CVE-2026-56589 https://vulnogram.org/CVE-2026-56589 HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling se… High Network Exploitable Thu, 01 Oct 2026 14:55:42 GMT https://vulnogram.org/CVE-2026-66253 https://vulnogram.org/CVE-2026-66253 iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim. Low Thu, 01 Oct 2026 13:30:02 GMT https://vulnogram.org/CVE-2026-66249 https://vulnogram.org/CVE-2026-66249 iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifi… Low Thu, 01 Oct 2026 13:29:21 GMT https://vulnogram.org/CVE-2026-66248 https://vulnogram.org/CVE-2026-66248 iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced… Low Thu, 01 Oct 2026 13:26:30 GMT https://vulnogram.org/CVE-2026-66247 https://vulnogram.org/CVE-2026-66247 iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive d… Medium Thu, 01 Oct 2026 13:25:13 GMT https://vulnogram.org/CVE-2026-66246 https://vulnogram.org/CVE-2026-66246 iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or dele… High Thu, 01 Oct 2026 13:23:25 GMT https://vulnogram.org/CVE-2026-67075 https://vulnogram.org/CVE-2026-67075 HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this. Medium Network Exploitable Thu, 01 Oct 2026 05:20:50 GMT https://vulnogram.org/CVE-2025-32000 https://vulnogram.org/CVE-2025-32000 HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerab… Medium Network Exploitable Thu, 24 Sep 2026 15:21:47 GMT https://vulnogram.org/CVE-2026-21806 https://vulnogram.org/CVE-2026-21806 HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to… Low Fri, 18 Sep 2026 11:12:24 GMT https://vulnogram.org/CVE-2026-21822 https://vulnogram.org/CVE-2026-21822 HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling fil… Medium Fri, 18 Sep 2026 08:32:35 GMT https://vulnogram.org/CVE-2026-56595 https://vulnogram.org/CVE-2026-56595 HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauth… Low Network Exploitable Fri, 18 Sep 2026 08:25:39 GMT https://vulnogram.org/CVE-2026-56597 https://vulnogram.org/CVE-2026-56597 HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network t… Low Fri, 18 Sep 2026 08:24:56 GMT https://vulnogram.org/CVE-2026-56592 https://vulnogram.org/CVE-2026-56592 HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interfac… Medium Network Exploitable Fri, 18 Sep 2026 08:23:16 GMT https://vulnogram.org/CVE-2026-56590 https://vulnogram.org/CVE-2026-56590 HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server co… Medium Fri, 18 Sep 2026 08:22:16 GMT https://vulnogram.org/CVE-2026-21848 https://vulnogram.org/CVE-2026-21848 HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant bound… Medium Fri, 18 Sep 2026 08:21:02 GMT https://vulnogram.org/CVE-2026-67103 https://vulnogram.org/CVE-2026-67103 HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unautho… High Fri, 18 Sep 2026 07:55:05 GMT https://vulnogram.org/CVE-2026-67102 https://vulnogram.org/CVE-2026-67102 HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles. High Fri, 18 Sep 2026 07:54:03 GMT https://vulnogram.org/CVE-2026-67100 https://vulnogram.org/CVE-2026-67100 HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate… Critical Network Exploitable Fri, 18 Sep 2026 07:53:02 GMT https://vulnogram.org/CVE-2026-67101 https://vulnogram.org/CVE-2026-67101 HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible fr… Critical Network Exploitable Fri, 18 Sep 2026 07:50:10 GMT https://vulnogram.org/CVE-2026-67071 https://vulnogram.org/CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engin… Medium Thu, 17 Sep 2026 20:21:26 GMT https://vulnogram.org/CVE-2025-52657 https://vulnogram.org/CVE-2025-52657 HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability. Low Mon, 07 Sep 2026 10:38:04 GMT https://vulnogram.org/CVE-2025-52652 https://vulnogram.org/CVE-2025-52652 HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft. Low Mon, 07 Sep 2026 10:37:31 GMT https://vulnogram.org/CVE-2025-52651 https://vulnogram.org/CVE-2025-52651 HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues. Low Mon, 07 Sep 2026 10:36:47 GMT https://vulnogram.org/CVE-2026-21827 https://vulnogram.org/CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handl… Low Network Exploitable Mon, 31 Aug 2026 15:48:17 GMT https://vulnogram.org/CVE-2025-62343 https://vulnogram.org/CVE-2025-62343 HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion. Low Network Exploitable Thu, 27 Aug 2026 13:11:58 GMT https://vulnogram.org/CVE-2025-62342 https://vulnogram.org/CVE-2025-62342 HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion. Medium Thu, 27 Aug 2026 13:11:29 GMT https://vulnogram.org/CVE-2025-62341 https://vulnogram.org/CVE-2025-62341 HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass. Low Wed, 26 Aug 2026 22:15:56 GMT https://vulnogram.org/CVE-2026-21808 https://vulnogram.org/CVE-2026-21808 HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details. Medium Wed, 26 Aug 2026 22:03:20 GMT https://vulnogram.org/CVE-2026-21807 https://vulnogram.org/CVE-2026-21807 HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow. Low Wed, 26 Aug 2026 22:02:27 GMT https://vulnogram.org/CVE-2026-21810 https://vulnogram.org/CVE-2026-21810 HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary. Medium Wed, 26 Aug 2026 21:55:07 GMT https://vulnogram.org/CVE-2026-21809 https://vulnogram.org/CVE-2026-21809 HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing… Low Wed, 26 Aug 2026 21:05:16 GMT https://vulnogram.org/CVE-2026-56547 https://vulnogram.org/CVE-2026-56547 The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile gener… Low Wed, 26 Aug 2026 18:54:50 GMT https://vulnogram.org/CVE-2026-21754 https://vulnogram.org/CVE-2026-21754 HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications. Medium Network Exploitable Tue, 25 Aug 2026 10:51:48 GMT https://vulnogram.org/CVE-2026-21753 https://vulnogram.org/CVE-2026-21753 HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment. Medium Network Exploitable Tue, 25 Aug 2026 10:50:27 GMT https://vulnogram.org/CVE-2026-21758 https://vulnogram.org/CVE-2026-21758 HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment. Low Network Exploitable Tue, 25 Aug 2026 10:49:13 GMT https://vulnogram.org/CVE-2025-68825 https://vulnogram.org/CVE-2025-68825 HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications. High Network Exploitable Mon, 24 Aug 2026 15:37:00 GMT https://vulnogram.org/CVE-2026-21752 https://vulnogram.org/CVE-2026-21752 HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws. High Network Exploitable Mon, 24 Aug 2026 15:21:00 GMT https://vulnogram.org/CVE-2026-21755 https://vulnogram.org/CVE-2026-21755 HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service. Medium Network Exploitable Mon, 24 Aug 2026 14:16:02 GMT https://vulnogram.org/CVE-2025-68833 https://vulnogram.org/CVE-2025-68833 HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources. Medium Network Exploitable Mon, 24 Aug 2026 13:42:32 GMT https://vulnogram.org/CVE-2026-21751 https://vulnogram.org/CVE-2026-21751 HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached. High Network Exploitable Mon, 24 Aug 2026 13:18:15 GMT