Vendor
HCL Software
433 known vulnerabilities.
Products
59 results · Clear filters · Feed
-
High 8.6
HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to info…
-
High 7.4
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and pote…
-
High 7.2
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hij…
-
High 8.8
HCL iControl is affected by multiple security vulnerabilities
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of s…
-
High 7.6
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized act…
-
High 8.1
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.
-
High 8.2
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs an…
-
High 8.2
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gai…
-
High 7.4
Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
-
High 8.1
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the securit…
-
High 8.1
HCL DevOps Loop is susceptible to an improper authentication vulnerability
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or ta…
-
High 7.5
HCL Compass is affected by a security vulnerability
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
-
High 8.2
HCL BigFix Remote Control is affected by an authorization bypass vulnerability
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
-
High 7.1
HCL iAutomate is affected by an insufficient session expiration
HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.
-
High 7.6
HCL iAutomate is affected by a sensitive data exposure vulnerability
HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system.
-
High 7.1
HCL iAutomate is affected by hardcoded credentials
HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties.
-
High 7.1
HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
-
High 7.1
HCL Leap is affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
-
High 7.2
HCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability
HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.
-
High 7.1
HCL MyXalytics is affected by insecure direct object references
HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.
-
High 8.9
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.
-
High 8.6
An open proxy vulnerability affects HCL Nomad server on Domino
HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may enable an attacker to trick the user into exposing sensitive information.
-
High 8.4
HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability
The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack …
-
High 7.1
HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
-
High 8.8
Path Traversal Arbitrary File Read affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory. The produc…
-
High 8.2
Unauthenticated File Upload affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.
-
High 7.6
Path Traversal which allows file upload capability affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.
-
High 7.6
Improper Access Control affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive informati…
-
High 7.1
Insecure Direct Object Reference (IDOR) affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a result of improper access control.
-
High 8.3
Improper Access Control (Controller APIs) affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.
-
High 8.2
A broken cryptographic algorithm impacts MyXalytics
HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information.
-
High 8.2
Insecure key rotation affects MyXalytics
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.
-
High 7.7
HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.
-
High 7.7
HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server.
-
High 8.1
A weak password requirements vulnerability affects HCL Compass
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.
-
High 7.1
An insufficient session expiration vulnerability affects HCL Compass
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to…
-
High 7.8
HCL AppScan Presence deployed as Windows service might be vulnerable to an Unquoted Service Path vulnerability
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.
-
High 8.2
HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Campaign
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.