Aion CVE-2025-52643

Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web

Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat

HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing

Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas

HCL AION contains a container base image authentication vulnerability where container images are not properly verified b

Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).

Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po

HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul

HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform

HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe

HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth

Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, pot