Vendor
HCL
89 known vulnerabilities.
HCL at a glance
- Last 12 months
- 71
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 7 | 0 |
| May 2026 | 24 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 31 | 1 |
| Feb 2026 | 7 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 10 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Critical max 9.2
Node.js: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
first Oct 21, 2026 -
High max 9.1
Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Oracle Java SE, Oracle GraalVM und OpenJDK ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Daten offenzulegen oder zu verändern.
first Oct 22, 2026 -
High max 9.1
Oracle Java SE: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Oracle Java SE ausnutzen, um Informationen offenzulegen oder Daten zu manipulieren.
first Oct 25, 2026 -
Medium max 7.5
Node.js: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen.
first Mar 24, 2026 -
High max 7.7
Node.js: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
first Jun 18, 2026
89 results · Feed
-
Medium 4.3
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior an…
-
High 8.1
HCL Hive Telco Observability is affected by a Required directives missing from the CSP .
HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.
-
Medium 4.3
HCL iControl was affected by Weak Input Validation vulnerability. .
HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates tha…
-
Low 3.1
HCL iControl was affected by Missing Cookie Attributes vulnerability.
HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.
-
Low 3.7
HCL iControl was affected by Missing Security Headers vulnerability.
HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.
-
Low 3.1
HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability
HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard k…
-
High 7.1
HCL iControl was affected by Export CSV - CSV Injection vulnerability.
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .
-
Low 3.1
HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application.
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application
-
Low 3.7
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and ex…
-
Medium 4.0
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environ…
-
Medium 5.1
HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions
HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behaviour may allow exposure of data to external systems under specific condit…
-
Low 2.6
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosur…
-
Medium 5.1
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further analysis or targete…
-
Low 2.6
HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields.
HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific conditions.
-
Low 3.0
HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication
HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential interception or misuse, especially if not combined with secure transmission practic…
-
Low 2.3
HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured
HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce the effectiveness of browser-based security controls and could expose the application to limited secu…
-
Medium 5.4
HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced.
HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized access or account compromise under certain conditions.
-
Medium 4.3
HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels.
HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to potential interception or unauthorized access during transmission under certain conditions
-
Medium 5.4
HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations
HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to potential interception or unauthorized access under specific conditions.
-
High 8.3
HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of se…
-
Medium 5.3
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing requ…
-
Low 2.6
HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified.
HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities.
-
Medium 4.6
HCL BigFix Service Management (SM) is affected by use of a vulnerable component
HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauth…
-
Low 3.7
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and ex…
-
Low 3.7
HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header
HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive informa…
-
Low 2.7
HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability
HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input handling implementation, increasing the risk of misconfiguration and operational errors.
-
High 8.8
HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability
HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.
-
Low 3.1
HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability
HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, which could allow an attacker to exploit browser-specific rendering flaws or bypass security controls …
-
Low 3.1
HCL DFXAnalytics is affected by an Improper Error Handling vulnerability
HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an attacker to gain insights into the application's internal structure, code logic, and environment co…
-
Low 3.7
HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability
HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which could allow an attacker to compromise the confidentiality, integrity, and authentication of sensitive…
-
Low 3.7
HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability
HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which could allow an attacker to identify and exploit publicly known security vulnerabilities to gain unau…
-
Medium 5.3
HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability
HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vectors such as Cross-S…
-
Low 2.9
Internal Filesystem Exploration vulnerability
HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted…
-
High 8.1
HCL Aftermarket DPC is affected by Missing Functional Level Access Control
HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.
-
High 8.3
HCL Aftermarket DPC is affected by SQL Injection
HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.
-
High 7.3
HCL Aftermarket DPC is affected by Hardcoded Sensitive Data
HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories, they can easily retrieve these hardcoded secrets.
-
Medium 5.5
HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change
HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.
-
Medium 6.5
HCL Aftermarket DPC is affected by File Discovery
HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it to craft further attacks.
-
Medium 5.9
HCL Aftermarket DPC is affected by Session Fixation
HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf of the user.
-
Medium 5.7
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server.