Vendor
HCL Software
622 known vulnerabilities.
Products
622 results · Feed
-
Low 3.1
HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing
HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions.
-
Low 3.7
HCL IEM was affected with Strict transport security not enforced
HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.
-
Low 3.7
HCL IEM was affected with the Information disclosure nginx server
HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
-
Medium 6.9
An information disclosure vulnerability affects HCL DevOps Plan
HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.
-
Low 2.3
HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability
HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.
-
High 8.8
A privilege escalation vulnerability affects HCL Commerce
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
-
Low 3.3
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege E…
-
Low 3.1
Insufficient Input Validation in DevOps Loop
HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
-
Low 3.7
Missing HTTP Security Headers in DevOps Loop
HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
-
Medium 4.2
CORS Misconfiguration in DevOps Loop
HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.
-
Medium 4.6
Unauthorized Access to Admin Functionality via Forced Browsing
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected applicat…
-
Medium 4.2
HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk a…
-
Medium 4.3
HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an att…
-
Medium 4.2
HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS)…
-
Medium 4.3
HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header
-
Medium 4.3
HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrar…
-
Medium 5.3
HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to…
-
Medium 5.3
HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method…
-
Medium 5.3
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information…
-
Medium 4.3
HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifyin…
-
Low 3.7
HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13…
-
Medium 5.3
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by t…
-
Medium 5.3
HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism…
-
Medium 6.5
HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lea…
-
Medium 4.3
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensit…
-
Critical 9.1
HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obt…
-
Medium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
-
Medium 5.3
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability.
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or deb…
-
Medium 5.3
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS).
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which …
-
Medium 5.9
HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1.
HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the applicat…
-
Medium 5.5
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authen…
-
Low 3.1
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability.
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the commu…
-
Low 3.0
HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.
HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CS…
-
Low 2.6
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability.
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information a…
-
Low 2.6
HCL DFXAnalytics is affected by a Login Replay Attack vulnerability
HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must…
-
Low 3.0
HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability
HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercep…
-
High 8.2
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs an…
-
High 8.2
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gai…
-
Medium 6.3
HCL DFXServer is affected by a Missing Access Control vulnerability
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the…
-
Medium 6.3
HCL DFXServer is affected by an Unencrypted Communication vulnerability.
HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensit…