Vendor
HCLSoftware
100 known vulnerabilities.
HCLSoftware at a glance
- Last 12 months
- 100
- Critical · all time
- 2
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 2 | 0 |
| Oct 2026 | 4 | 2 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 17 | 0 |
| Jul 2026 | 41 | 0 |
| Jun 2026 | 10 | 0 |
| May 2026 | 6 | 0 |
| Apr 2026 | 5 | 0 |
| Mar 2026 | 6 | 0 |
| Feb 2026 | 3 | 0 |
| Jan 2026 | 5 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
100 results · Feed
-
Medium 6.3
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side…
-
Medium 6.3
The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. I…
-
Critical 9.1
eMudhra Compromised Certificate vulnerability impacts HCL Notes Client
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could sp…
-
Critical 9.1
eMudhra Compromised Certificate vulnerability impacts HCL Domino Server
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could s…
-
Medium 5.4
HCL Connections is vulnerable to cross-site scripting (XSS)
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal …
-
Medium 6.5
HCL Digital Experience is affected by improper input sanitation
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.
-
Medium 6.5
HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer
HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fai…
-
Low 3.1
HCL Connections is vulnerable to an information disclosure vulnerability
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of re…
-
Low 3.7
HCL Connections is vulnerable to server-side request forgery (SSRF)
HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.
-
Medium 4.1
HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information
HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details.
-
Low 3.9
HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow
HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow.
-
Medium 4.4
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.
-
Low 3.9
HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information
HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to …
-
Low 3.5
An input reflection vulnerability affects HCL Traveler
The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation pa…
-
High 7.5
HCL Hive is affected by incorrect default permissions
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
-
High 7.5
HCL Hive is affected by a use of vulnerable third-party components
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.
-
Medium 5.3
HCL Hive is affected by a missing rate limit
HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.
-
Medium 5.3
HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.
-
High 7.4
HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.
-
High 7.2
HCL Hive is affected by a broken access control vulnerability
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
-
Medium 4.3
HCL Hive is affected by an information exposure vulnerability
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase …
-
Medium 5.4
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
-
Medium 4.3
HCL BigFix Mobile is vulnerable to information disclosure
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.
-
Medium 5.4
HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only aff…
-
Low 3.5
HCL Connections is vulnerable to information disclosure
An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.
-
Low 3.5
HCL Connections is vulnerable to information disclosure
HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data.
-
Low 3.1
HCL MyCloud was affected with Concurrent Login Vulnerability.
HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.
-
Low 3.1
HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.
HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack.
-
Low 2.6
HCL MyCloud was affected with Cookie Attribute Path Not Set
HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.
-
Low 2.2
HCL MyCloud was affected by Using Components with Known Vulnerability
HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.
-
Low 3.1
HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.
HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.
-
Low 2.2
HCL MyCloud was affected by Server Version Disclosure
HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.
-
Low 3.1
HCL MyCloud affected by Weak Password Policy
HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.
-
Low 3.1
HCL IEM was affected with X-Content-Type-Options Header Missing
HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.
-
Low 3.1
HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing
HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions.
-
Low 3.7
HCL IEM was affected with Strict transport security not enforced
HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.
-
Low 3.7
HCL IEM was affected with the Information disclosure nginx server
HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
-
Medium 6.9
An information disclosure vulnerability affects HCL DevOps Plan
HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.
-
Low 2.3
HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability
HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.
-
High 8.8
A privilege escalation vulnerability affects HCL Commerce
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.