Hcl
Monthly
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the product fails to adequately lock out or throttle repeated failed authentication attempts, letting remote unauthenticated attackers (CVSS PR:N/UI:N) make unlimited credential guesses that, if successful, grant full access as scored (C:H/I:H/A:H). The vendor scores this 9.8, but our independent assessment uses AC:H because the missing lockout does not itself grant access - the attacker must still obtain or guess valid credentials, so real-world impact hinges on password strength, MFA, and whether the login page is internet-exposed. Competing signals frame this as a high-severity design weakness with low current urgency: EPSS is 0.25% (17th percentile), SSVC records Exploitation: none with partial technical impact, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis.
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's upload functionality and, if the payload is subsequently triggered, achieve code execution and full server compromise. The public description characterizes the actor as unauthenticated, while the vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a low-privileged authenticated account plus user interaction at high attack complexity; our own independent assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so the two views differ by both privilege requirement and severity and must be reconciled before prioritization. Exploitation is limited to deployments that expose the vulnerable upload feature and whose validation controls can be bypassed, and there is no public exploit identified at time of analysis.
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative screens and functions reserved for higher-privileged roles, effectively escalating their privileges within the ITSM instance. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 High), the attacker must already hold a valid standard-role account and can reach the application over the network without user interaction, obtaining full read and write capability over the exposed administrative functionality with no direct availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV).
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the application's request-handling layer to inject database commands and to manipulate tenant/organization scoping values so that another organization's profile data and PII can be read. The vendor rates this 9.8 Critical using a vector that encodes PR:N, but the advisory text itself states the attack requires an authenticated attacker - an internal contradiction; our independent assessment resolves it as AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so exploitability hinges on whether a valid account is genuinely required, and the cross-tenant half of the impact only applies to multi-tenant deployments hosting multiple organizations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no fix version was disclosed in the provided data; organizations should treat the vendor KB article as the authoritative source for patched builds.
BigFix Platform installations that still ship a Mozilla CA certificate bundle (PEM) dated before 2026/10/20 continue to trust certificates whose private keys are known to be compromised, so an attacker holding an on-path position can impersonate the remote servers BigFix validates and tamper with the files the application downloads. Successful exploitation requires that stale bundle to be present, a privileged man-in-the-middle position, and a certificate chained to one of the compromised keys, which is why the assessed severity is moderate rather than urgent (CVSS 3.1 base 6.8, AV:N/AC:H/PR:N/UI:R). No public exploit code or PoC reference was identified at time of analysis, and the flaw does not affect installations already running the 2026/10/20 or later bundle shipped with BES Support v1520 and above.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
HTML injection in HCL Digital Experience portals allows unauthenticated remote attackers to place attacker-controlled markup into portal pages, spoofing content that appears to be served from the trusted portal domain; exploitation requires the victim to load the crafted page or link (UI:R), and the assessed impact is integrity-only with no confidentiality or availability loss. No public exploit code or confirmed active exploitation was identified at the time of analysis, and signals are consistent in pointing to a moderate, non-urgent issue. A vendor fix is available in HCL Digital Experience 9.5 CF238 or later.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error messages, or rendered page content - allowing anyone able to reach the instance to harvest RFC1918 addressing and infer the internal network topology behind it. The consequence is reconnaissance only: no data modification, no service disruption, and a low vendor base score of 3.1, making this a low-priority item rather than an urgent one. No public exploit code was identified at time of analysis and there is no KEV or EPSS signal in the supplied data. The vendor vector specifies PR:L (a valid session) while the description claims an unauthenticated attacker, so authentication requirements are not confirmed from available data; the vendor's AC:H also implies an additional non-trivial condition or timing is needed to elicit the leak.
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one tenant to read restricted data elements belonging to other tenants because of improper access controls. Affected deployments are those operated in shared or multi-tenant mode; the impact is limited to confidentiality (unauthorized viewing), with no modification or disruption of data, and no user interaction is required on the victim's side (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0). Exploitation requires a legitimate authenticated foothold in at least one tenant, so this is not remotely exploitable by unauthenticated attackers, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (CVSS PR:L) inject unsanitized script into content that executes in another user's browser when that user views it (UI:R), enabling session hijacking, account takeover, and unauthorized actions performed as the victim. Impact is greatest when the viewing victim is a higher-privileged user such as an agent or administrator, because the injected script then runs with that user's session context. No public exploit identified at time of analysis, and because the affected component is a niche enterprise ITSM module rather than broadly deployed software, this remains a moderate-priority issue.
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attackers through a broken input validation mechanism. The implementation flaw in an architectural security tactic fails to enforce type conformance on received input, enabling an attacker to manipulate application logic and circumvent security controls. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the vendor-assigned 'Authentication Bypass' tag elevates operational concern beyond what the CVSS score alone suggests.
Local information exposure in HCL BigFix Cloud Lifecycle Management stems from insufficient input validation, allowing a locally authenticated low-privileged user to access data they should not be authorized to view. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local system access and a low-privilege account. No active exploitation has been confirmed and no public exploit code is known at time of analysis. Despite a tag of 'Authentication Bypass,' the PR:L vector indicates some authentication is required - this discrepancy should be clarified with the vendor advisory.
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attackers to leverage missing CSP directives for client-side attacks against authenticated users. The CVSS 8.1 (AV:N/AC:L/PR:N/UI:R) rating reflects high confidentiality and integrity impact contingent on user interaction, with no public exploit identified at time of analysis. The flaw resides in the web application's browser security headers rather than server-side logic.
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affecting confidentiality and integrity under specific conditions. The vulnerability requires adjacent network access, low privilege authentication, and user interaction to exploit, making it suitable for targeted attacks within trusted environments rather than widespread remote exploitation.
HCL AION exposes sensitive information through URL parameters, allowing disclosure via browser history, server logs, and intermediary systems. The vulnerability requires adjacent network access, high interaction complexity, and authenticated user involvement, resulting in limited confidentiality impact with a CVSS score of 2.6. No active exploitation has been confirmed.
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting authenticated users with local network access and specific user interaction. The exposure reveals internal system architecture and configuration information that could enable reconnaissance for targeted attacks, with limited confidentiality, integrity, and availability impact (CVSS 5.1, CWE-201). No public exploit code or confirmed active exploitation has been identified at time of analysis.
HCL AION stores sensitive information in browser auto-complete caches for certain input fields, potentially exposing credentials or other sensitive data to local attackers or through browser history under specific conditions. The vulnerability requires adjacent network access, high interaction complexity, and local user privilege, limiting real-world exploitation scope but posing risk in shared or compromised workstations.
HCL AION uses basic authorization tokens for authentication, exposing credentials to interception or misuse if not transmitted over encrypted channels. The vulnerability affects authenticated local or adjacent network attackers with low privileges and user interaction, resulting in limited confidentiality impact. CVSS 3.0 reflects low severity, though the underlying authentication weakness may enable credential theft in environments with unencrypted internal traffic.
HCL AION fails to configure security-related HTTP response headers, potentially reducing browser-based protections against cross-site scripting and other client-side attacks. The vulnerability requires adjacent network access, high interaction complexity, low privilege authentication, and user interaction to achieve limited confidentiality impact. CVSS score of 2.3 reflects minimal real-world risk under current attack conditions.
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that could lead to account compromise or unauthorized access. The vulnerability requires adjacent network access and affects all versions of the product. No public exploit code has been identified, but the weak authentication controls represent a significant credential-stuffing and password-guessing risk in multi-tenant or shared-network environments.
HCL AION transmits backend service details over unencrypted HTTP channels under certain conditions, allowing authenticated local or adjacent-network attackers with limited privileges to intercept and read sensitive configuration data through man-in-the-middle attacks. The vulnerability requires user interaction and non-default network positioning, resulting in a CVSS score of 4.3 (low severity) with confirmed vendor awareness and advisory availability.
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive information to interception or unauthorized access. The vulnerability requires adjacent network access, high attack complexity, and user interaction, limiting real-world exploitation scope. No active exploitation has been confirmed at time of analysis.
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) server component, which can expose the application to the known security weaknesses of that unnamed server release and potentially enable unauthorized access or information disclosure. Exploitation requires a network-reachable deployment of the affected SM web front end and a low-privileged authenticated position per the CVSS vector (PR:L), and its real-world risk is gated by whatever specific flaws exist in the pinned WSGI version rather than by a documented, directly triggerable bug. No public exploit code or confirmed active exploitation has been identified (CISA SSVC rates exploitation 'none' and automatable 'no'), and EPSS is very low at 0.02% (7th percentile), so this should be treated as a component-currency and hardening issue rather than an urgent, weaponized threat.
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-site scripting (XSS) attacks. Authenticated users with low privileges can inject malicious scripts by exploiting insufficient CSP directives, potentially exposing sensitive information or hijacking user sessions. The vulnerability requires user interaction (UI:R) and operates in a non-global scope, limiting but not eliminating real-world risk.
HCL BigFix RunBookAI 11.2 contains weak input handling in a text input component that may disclose sensitive information to high-privilege users. The vulnerability stems from continued reliance on less-secure input validation mechanisms, creating operational risk through potential misconfiguration. While the CVSS score is low (2.7) due to requirement for high-privilege access and limited confidentiality impact, the information disclosure channel could expose credentials or operational data to authenticated administrators.
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating system commands. The vulnerability stems from unvalidated input handling in a component that processes commands, enabling command smuggling techniques to bypass input validation. HCL has released a vendor advisory (KB0130444) addressing this issue, which poses significant risk given the product's role in IT automation and runbook orchestration across enterprise environments.
HCL DFXAnalytics relies on the obsolete X-XSS-Protection security header instead of implementing a modern Content Security Policy, allowing attackers with low privileges to potentially exploit browser-specific XSS protections or bypass intended security controls. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation but indicating security posture degradation in a production analytics platform.
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authenticated remote attackers with low privileges to gain insights into the application's internal structure, code logic, and environment configurations. The vulnerability requires high attack complexity and produces limited confidentiality impact, resulting in a CVSS score of 3.1. No active exploitation or public exploit code has been identified at the time of analysis.
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyone who can observe or relay that traffic to read, alter, or replay the information in transit. The vendor's own scoring is severe (CVSS 9.1, AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), but exploitation is not automatable and requires the attacker to already hold a man-in-the-middle or on-path position between DFXAnalytics endpoints; an independent reassessment therefore raises attack complexity to AC:H and yields a materially lower practical severity. There is no CISA KEV entry and no public exploit identified at time of analysis, and EPSS is only 0.01% (2nd percentile), so this is a latent cryptographic-hygiene exposure rather than an actively exploited one.
HCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vulnerabilities, giving remote attackers a potential route to unauthorized access or full compromise of a deployment. The vendor rates this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment downgrades complexity to AC:H because exploitability depends entirely on which outdated component is present, whether its known flaw is reachable, and whether a working exploit for that component exists and applies to this configuration. No public exploit specific to this CVE has been identified at time of analysis, EPSS is negligible at 0.03% (9th percentile), and CISA SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial - so the headline score overstates near-term practical risk despite the high theoretical ceiling.
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling attackers to inject and execute arbitrary scripts through cross-site scripting (XSS) vectors without authentication or user interaction. This network-accessible vulnerability affects all versions and results in information disclosure with a CVSS score of 5.3; no active exploitation has been reported.
HCL AION allows local attackers with high privileges to explore internal filesystem structures through certain system behaviors, potentially disclosing information about the underlying environment that could facilitate further targeted attacks. The vulnerability requires local access, high privileges, and user interaction to trigger, with a CVSS score of 2.9 reflecting low immediate risk. No public exploit code or active exploitation has been identified.
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that can compromise application integrity and confidentiality. Unauthenticated attackers can leverage this access control flaw to manipulate and exfiltrate data with user interaction required (CVSS 8.1, AV:N/AC:L/PR:N/UI:R). No public exploit has been identified at time of analysis, with CISA SSVC rating the technical impact as partial and exploitation status as none.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive database contents and potentially compromise data integrity and availability. The vulnerability carries a CVSS score of 8.3 with network-based attack vector requiring user interaction. No public exploit is identified at time of analysis, and SSVC assessment indicates no current exploitation with non-automatable attack characteristics.
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user interaction to extract sensitive secrets from source code or insecure repositories, resulting in high confidentiality compromise and complete denial of service. CVSS score 7.3 reflects network-accessible attack requiring low privileges and user interaction. No public exploit identified at time of analysis, with SSVC framework indicating no current exploitation and non-automatable attack characteristics.
Session invalidation failure in HCL Aftermarket DPC versions up to 1.0.0 allows authenticated attackers to maintain active sessions after a password change, enabling persistent account takeover. An attacker who gains initial session access can continue to operate under a compromised account identity even after the victim resets their password, as the application fails to terminate pre-existing sessions upon credential modification. No public exploit code or active exploitation has been identified at time of analysis.
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read sensitive files from the system without user interaction beyond a single click, potentially enabling reconnaissance for follow-on attacks. The vulnerability carries a CVSS score of 6.5 (Medium) with high confidentiality impact but no integrity or availability consequences. No public exploit code or active exploitation has been reported at the time of analysis.
HCL Aftermarket DPC versions up to 1.0.0 are vulnerable to session fixation attacks that enable attackers to hijack user sessions and perform unauthorized transactions without requiring valid credentials. The vulnerability exploits improper session management to allow an attacker to force a victim to use a predetermined session identifier, then leverage that session for fraudulent activity. This is a network-accessible flaw requiring user interaction (e.g., clicking a malicious link) but no prior authentication. No public exploit code or active exploitation has been identified at the time of analysis.
HCL Aftermarket DPC versions prior to and including 1.0.0 suffer from an unrestricted file upload vulnerability (CWE-434) that enables authenticated remote attackers to upload and execute arbitrary scripts on the affected server, potentially achieving full system compromise. The attack requires user interaction and low-privilege authentication but carries high integrity impact. No public exploit code or active exploitation has been confirmed; however, the vulnerability's straightforward exploitation mechanics and authenticated attack vector make it a moderate-priority issue for organizations deploying this software.
HCL Aftermarket DPC version 1.0.0 is vulnerable to excessive spamming that consumes server bandwidth and processing resources, potentially causing denial of service to legitimate users. The vulnerability requires user interaction (UI:R per CVSS vector) and is remotely exploitable without authentication, resulting in partial availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the low barrier to exploitation (AC:L) makes this a practical attack vector for resource exhaustion.
HCL Aftermarket DPC version 1.0.0 enforces weak password policies that enable attackers to conduct brute-force attacks and guess user credentials, potentially gaining unauthorized account access with low confidentiality and availability impact. The vulnerability requires user interaction and high attack complexity to exploit, but affects unauthenticated threat actors over the network. No public exploit code or active exploitation has been identified at the time of analysis.
HCL Aftermarket DPC version 1.0.0 contains improper input validation (CWE-20) that enables multiple injection attack vectors including Cross-Site Scripting (XSS), SQL Injection, and Command Injection. Authenticated attackers can exploit this vulnerability to inject and execute arbitrary code within the application context. No public exploit code or active exploitation has been identified at time of analysis, and the moderate CVSS score of 3.5 reflects limited confidentiality impact with user interaction required.
HTTP Response Splitting in HCL Aftermarket DPC allows unauthenticated remote attackers to inject arbitrary content or commands into HTTP responses, potentially leading to content spoofing or further exploitation depending on application response handling. The vulnerability affects Aftermarket DPC version 1.0.0 and requires user interaction to exploit. No public exploit identified at time of analysis, and exploitation is not currently automatable according to CISA SSVC assessment, resulting in a low real-world risk profile despite the injection vector.
HCL Aftermarket DPC discloses sensitive system and software version information through banner responses, enabling attackers to enumerate deployed instances and tailor version-specific exploits. Aftermarket DPC version 1.0.0 is confirmed affected. The vulnerability requires user interaction and high attack complexity but results in partial confidentiality loss; no public exploit has been identified at the time of analysis.
HCL Aftermarket DPC is vulnerable to Cross Domain Script Include (CWE-829) that permits unauthenticated remote attackers to inject and execute malicious external scripts, enabling DOM tampering and theft of session credentials without user interaction. Affected versions include Aftermarket DPC 1.0.0. No public exploit code or active exploitation has been identified at time of analysis, though the attack vector is network-accessible and requires only user interaction (rendering this a moderate-impact integrity threat rather than a critical one).
HCL Aftermarket DPC version 1.0.0 contains a Cross-Origin Resource Sharing (CORS) misconfiguration that permits authenticated attackers with low privileges to access sensitive user information and potentially perform unauthorized actions on behalf of legitimate users through browser-based attacks. The vulnerability requires user interaction (such as social engineering to visit a malicious webpage) and operates within a single security context, limiting its scope to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at the time of analysis, and the low CVSS score of 2.6 reflects the high attack complexity and limited practical exploitability despite the theoretical risk of data exposure.
HCL Aftermarket DPC versions up to 1.0.0 contain an admin session concurrency vulnerability that allows authenticated attackers with low privileges to hijack or impersonate administrator sessions through exploitation of improper concurrent session handling. The vulnerability requires user interaction and has moderate attack complexity, resulting in partial confidentiality and availability impact. No public exploit has been identified at time of analysis, and CISA has not listed this in the KEV catalog, indicating limited real-world exploitation pressure despite the administrative access implications.
HCL Aftermarket DPC version 1.0.0 discloses internal IP addresses to unauthenticated remote attackers via a high-complexity attack vector requiring user interaction, enabling network reconnaissance but causing no direct confidentiality, integrity, or availability impact. No public exploit code has been identified; CISA has not flagged this vulnerability as actively exploited. While the CVSS score of 3.1 (low) reflects minimal immediate risk, the information disclosure enables attackers to map organizational network topology for follow-on attacks.
HCL Aftermarket DPC version 1.0.0 contains outdated or vulnerable dependencies (CWE-1104) that expose the application to known public exploits, enabling authenticated attackers with low privileges to obtain limited information disclosure. The vulnerability requires user interaction and carries a low CVSS score of 2.6, but represents a supply chain risk where publicly available exploits targeting the embedded libraries could be weaponized against deployments. No public exploit code has been independently confirmed, and CISA has not flagged this for active exploitation.
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage.
HCL Sametime is vulnerable to broken server-side validation.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend database queries through specially crafted input fields. The vulnerability affects HCL Unica version 25.1.1 and below, enabling unauthenticated attackers to extract sensitive data, modify database contents, or potentially compromise the entire system. With a critical CVSS score of 9.8 and network-based attack vector requiring no authentication, this represents a severe risk to organizations using affected Unica installations.
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature.
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing the traceability of user activities and potentially compromising monitoring, accountability, and incident investigation capabilities. The vulnerability affects AION 2.0 and is classified as an Information Disclosure issue with a CVSS score of 5.8. An attacker with local access and low privileges could exploit this to perform actions without adequate logging, hindering forensic analysis and compliance audit trails.
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in HCL AION (CVSS 1.8). Remediation should follow standard vulnerability management procedures.
A security vulnerability in HCL AION (CVSS 4.8). Remediation should follow standard vulnerability management procedures.
HCL AION contains a container base image authentication vulnerability where container images are not properly verified before deployment, potentially allowing attackers to execute untrusted or malicious container images within the AION environment. This affects AION 2.0 and could enable attackers with local access and high privileges to compromise system integrity and availability. No public evidence of active exploitation or POC availability has been identified in the provided intelligence sources.
HCL AION contains a SQL injection or improper query validation vulnerability that allows authenticated local users with low privileges to execute potentially harmful SQL queries against the database. The vulnerability affects certain offering configurations and could lead to limited information disclosure, data modification, or denial of service under specific conditions. With a CVSS score of 4.5 and local attack vector requirement, this represents a moderate-risk vulnerability primarily exploitable by insider threats or compromised local accounts.
Improper input validation (CWE-20) in HCL Unica MaxAI Workbench, the AI component within HCL's Unica marketing suite, lets an authenticated low-privileged user plant crafted input in a field that is later rendered to a second user, resulting in reflected cross-site scripting rather than the server-side SQL injection or command injection implied by the vendor's generic description. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, base 3.5) limits the demonstrated impact to partial integrity loss with no confidentiality or availability effect, and exploitation requires both a valid low-privileged account and victim user interaction. Risk is low: EPSS is 0.50 percent (40th percentile), no publicly available exploit code and no CISA KEV entry were identified at time of analysis, and the breadth of the advisory text is not supported by the scored vector.
HTML injection in HCL Unica MaxAI Assistant allows an authenticated low-privileged user to insert special characters that are processed client-side in another user's session, but only when a victim interacts with the crafted content. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, score 4.6) confirms remote reachability, low privileges, required user interaction, and limited confidentiality and integrity impact without scope change. EPSS is 0.17% (6th percentile), no CISA KEV entry or public exploit code was identified at time of analysis, and the issue is considered low priority.
Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensitive details through unhandled exception messages, because the application returns verbose error or stack-trace output to clients. The published CVSS is 9.8 Critical, but independent assessment scopes the direct impact to confidentiality only (C:H/I:N/A:N); any follow-on remote code execution or denial of service is contingent on the leaked information revealing a separately exploitable flaw in the target's specific version and stack. No public exploit identified at time of analysis; CISA KEV status is not indicated, and EPSS is low at 0.39% (31st percentile).
Authorization bypass in HCL Unica Centralized Offer Management allows a remote, authenticated user to read database records, offers, and files belonging to other users or tenants by manipulating the object identifiers the application accepts in requests. The impact is confined to confidentiality - no data modification or service disruption is documented - and exploitation requires only network reach to the application's HTTP interface plus a low-privileged session, with no user interaction. Exploitation is not confirmed as active (CISA KEV), no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (12th percentile), so real-world priority sits below the 7.5 CVSS base score.
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the product fails to adequately lock out or throttle repeated failed authentication attempts, letting remote unauthenticated attackers (CVSS PR:N/UI:N) make unlimited credential guesses that, if successful, grant full access as scored (C:H/I:H/A:H). The vendor scores this 9.8, but our independent assessment uses AC:H because the missing lockout does not itself grant access - the attacker must still obtain or guess valid credentials, so real-world impact hinges on password strength, MFA, and whether the login page is internet-exposed. Competing signals frame this as a high-severity design weakness with low current urgency: EPSS is 0.25% (17th percentile), SSVC records Exploitation: none with partial technical impact, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis.
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's upload functionality and, if the payload is subsequently triggered, achieve code execution and full server compromise. The public description characterizes the actor as unauthenticated, while the vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a low-privileged authenticated account plus user interaction at high attack complexity; our own independent assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so the two views differ by both privilege requirement and severity and must be reconciled before prioritization. Exploitation is limited to deployments that expose the vulnerable upload feature and whose validation controls can be bypassed, and there is no public exploit identified at time of analysis.
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative screens and functions reserved for higher-privileged roles, effectively escalating their privileges within the ITSM instance. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 High), the attacker must already hold a valid standard-role account and can reach the application over the network without user interaction, obtaining full read and write capability over the exposed administrative functionality with no direct availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV).
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the application's request-handling layer to inject database commands and to manipulate tenant/organization scoping values so that another organization's profile data and PII can be read. The vendor rates this 9.8 Critical using a vector that encodes PR:N, but the advisory text itself states the attack requires an authenticated attacker - an internal contradiction; our independent assessment resolves it as AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so exploitability hinges on whether a valid account is genuinely required, and the cross-tenant half of the impact only applies to multi-tenant deployments hosting multiple organizations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no fix version was disclosed in the provided data; organizations should treat the vendor KB article as the authoritative source for patched builds.
BigFix Platform installations that still ship a Mozilla CA certificate bundle (PEM) dated before 2026/10/20 continue to trust certificates whose private keys are known to be compromised, so an attacker holding an on-path position can impersonate the remote servers BigFix validates and tamper with the files the application downloads. Successful exploitation requires that stale bundle to be present, a privileged man-in-the-middle position, and a certificate chained to one of the compromised keys, which is why the assessed severity is moderate rather than urgent (CVSS 3.1 base 6.8, AV:N/AC:H/PR:N/UI:R). No public exploit code or PoC reference was identified at time of analysis, and the flaw does not affect installations already running the 2026/10/20 or later bundle shipped with BES Support v1520 and above.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
HTML injection in HCL Digital Experience portals allows unauthenticated remote attackers to place attacker-controlled markup into portal pages, spoofing content that appears to be served from the trusted portal domain; exploitation requires the victim to load the crafted page or link (UI:R), and the assessed impact is integrity-only with no confidentiality or availability loss. No public exploit code or confirmed active exploitation was identified at the time of analysis, and signals are consistent in pointing to a moderate, non-urgent issue. A vendor fix is available in HCL Digital Experience 9.5 CF238 or later.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error messages, or rendered page content - allowing anyone able to reach the instance to harvest RFC1918 addressing and infer the internal network topology behind it. The consequence is reconnaissance only: no data modification, no service disruption, and a low vendor base score of 3.1, making this a low-priority item rather than an urgent one. No public exploit code was identified at time of analysis and there is no KEV or EPSS signal in the supplied data. The vendor vector specifies PR:L (a valid session) while the description claims an unauthenticated attacker, so authentication requirements are not confirmed from available data; the vendor's AC:H also implies an additional non-trivial condition or timing is needed to elicit the leak.
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one tenant to read restricted data elements belonging to other tenants because of improper access controls. Affected deployments are those operated in shared or multi-tenant mode; the impact is limited to confidentiality (unauthorized viewing), with no modification or disruption of data, and no user interaction is required on the victim's side (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0). Exploitation requires a legitimate authenticated foothold in at least one tenant, so this is not remotely exploitable by unauthenticated attackers, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (CVSS PR:L) inject unsanitized script into content that executes in another user's browser when that user views it (UI:R), enabling session hijacking, account takeover, and unauthorized actions performed as the victim. Impact is greatest when the viewing victim is a higher-privileged user such as an agent or administrator, because the injected script then runs with that user's session context. No public exploit identified at time of analysis, and because the affected component is a niche enterprise ITSM module rather than broadly deployed software, this remains a moderate-priority issue.
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attackers through a broken input validation mechanism. The implementation flaw in an architectural security tactic fails to enforce type conformance on received input, enabling an attacker to manipulate application logic and circumvent security controls. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the vendor-assigned 'Authentication Bypass' tag elevates operational concern beyond what the CVSS score alone suggests.
Local information exposure in HCL BigFix Cloud Lifecycle Management stems from insufficient input validation, allowing a locally authenticated low-privileged user to access data they should not be authorized to view. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local system access and a low-privilege account. No active exploitation has been confirmed and no public exploit code is known at time of analysis. Despite a tag of 'Authentication Bypass,' the PR:L vector indicates some authentication is required - this discrepancy should be clarified with the vendor advisory.
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attackers to leverage missing CSP directives for client-side attacks against authenticated users. The CVSS 8.1 (AV:N/AC:L/PR:N/UI:R) rating reflects high confidentiality and integrity impact contingent on user interaction, with no public exploit identified at time of analysis. The flaw resides in the web application's browser security headers rather than server-side logic.
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affecting confidentiality and integrity under specific conditions. The vulnerability requires adjacent network access, low privilege authentication, and user interaction to exploit, making it suitable for targeted attacks within trusted environments rather than widespread remote exploitation.
HCL AION exposes sensitive information through URL parameters, allowing disclosure via browser history, server logs, and intermediary systems. The vulnerability requires adjacent network access, high interaction complexity, and authenticated user involvement, resulting in limited confidentiality impact with a CVSS score of 2.6. No active exploitation has been confirmed.
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting authenticated users with local network access and specific user interaction. The exposure reveals internal system architecture and configuration information that could enable reconnaissance for targeted attacks, with limited confidentiality, integrity, and availability impact (CVSS 5.1, CWE-201). No public exploit code or confirmed active exploitation has been identified at time of analysis.
HCL AION stores sensitive information in browser auto-complete caches for certain input fields, potentially exposing credentials or other sensitive data to local attackers or through browser history under specific conditions. The vulnerability requires adjacent network access, high interaction complexity, and local user privilege, limiting real-world exploitation scope but posing risk in shared or compromised workstations.
HCL AION uses basic authorization tokens for authentication, exposing credentials to interception or misuse if not transmitted over encrypted channels. The vulnerability affects authenticated local or adjacent network attackers with low privileges and user interaction, resulting in limited confidentiality impact. CVSS 3.0 reflects low severity, though the underlying authentication weakness may enable credential theft in environments with unencrypted internal traffic.
HCL AION fails to configure security-related HTTP response headers, potentially reducing browser-based protections against cross-site scripting and other client-side attacks. The vulnerability requires adjacent network access, high interaction complexity, low privilege authentication, and user interaction to achieve limited confidentiality impact. CVSS score of 2.3 reflects minimal real-world risk under current attack conditions.
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that could lead to account compromise or unauthorized access. The vulnerability requires adjacent network access and affects all versions of the product. No public exploit code has been identified, but the weak authentication controls represent a significant credential-stuffing and password-guessing risk in multi-tenant or shared-network environments.
HCL AION transmits backend service details over unencrypted HTTP channels under certain conditions, allowing authenticated local or adjacent-network attackers with limited privileges to intercept and read sensitive configuration data through man-in-the-middle attacks. The vulnerability requires user interaction and non-default network positioning, resulting in a CVSS score of 4.3 (low severity) with confirmed vendor awareness and advisory availability.
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive information to interception or unauthorized access. The vulnerability requires adjacent network access, high attack complexity, and user interaction, limiting real-world exploitation scope. No active exploitation has been confirmed at time of analysis.
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) server component, which can expose the application to the known security weaknesses of that unnamed server release and potentially enable unauthorized access or information disclosure. Exploitation requires a network-reachable deployment of the affected SM web front end and a low-privileged authenticated position per the CVSS vector (PR:L), and its real-world risk is gated by whatever specific flaws exist in the pinned WSGI version rather than by a documented, directly triggerable bug. No public exploit code or confirmed active exploitation has been identified (CISA SSVC rates exploitation 'none' and automatable 'no'), and EPSS is very low at 0.02% (7th percentile), so this should be treated as a component-currency and hardening issue rather than an urgent, weaponized threat.
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-site scripting (XSS) attacks. Authenticated users with low privileges can inject malicious scripts by exploiting insufficient CSP directives, potentially exposing sensitive information or hijacking user sessions. The vulnerability requires user interaction (UI:R) and operates in a non-global scope, limiting but not eliminating real-world risk.
HCL BigFix RunBookAI 11.2 contains weak input handling in a text input component that may disclose sensitive information to high-privilege users. The vulnerability stems from continued reliance on less-secure input validation mechanisms, creating operational risk through potential misconfiguration. While the CVSS score is low (2.7) due to requirement for high-privilege access and limited confidentiality impact, the information disclosure channel could expose credentials or operational data to authenticated administrators.
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating system commands. The vulnerability stems from unvalidated input handling in a component that processes commands, enabling command smuggling techniques to bypass input validation. HCL has released a vendor advisory (KB0130444) addressing this issue, which poses significant risk given the product's role in IT automation and runbook orchestration across enterprise environments.
HCL DFXAnalytics relies on the obsolete X-XSS-Protection security header instead of implementing a modern Content Security Policy, allowing attackers with low privileges to potentially exploit browser-specific XSS protections or bypass intended security controls. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation but indicating security posture degradation in a production analytics platform.
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authenticated remote attackers with low privileges to gain insights into the application's internal structure, code logic, and environment configurations. The vulnerability requires high attack complexity and produces limited confidentiality impact, resulting in a CVSS score of 3.1. No active exploitation or public exploit code has been identified at the time of analysis.
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyone who can observe or relay that traffic to read, alter, or replay the information in transit. The vendor's own scoring is severe (CVSS 9.1, AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), but exploitation is not automatable and requires the attacker to already hold a man-in-the-middle or on-path position between DFXAnalytics endpoints; an independent reassessment therefore raises attack complexity to AC:H and yields a materially lower practical severity. There is no CISA KEV entry and no public exploit identified at time of analysis, and EPSS is only 0.01% (2nd percentile), so this is a latent cryptographic-hygiene exposure rather than an actively exploited one.
HCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vulnerabilities, giving remote attackers a potential route to unauthorized access or full compromise of a deployment. The vendor rates this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment downgrades complexity to AC:H because exploitability depends entirely on which outdated component is present, whether its known flaw is reachable, and whether a working exploit for that component exists and applies to this configuration. No public exploit specific to this CVE has been identified at time of analysis, EPSS is negligible at 0.03% (9th percentile), and CISA SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial - so the headline score overstates near-term practical risk despite the high theoretical ceiling.
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling attackers to inject and execute arbitrary scripts through cross-site scripting (XSS) vectors without authentication or user interaction. This network-accessible vulnerability affects all versions and results in information disclosure with a CVSS score of 5.3; no active exploitation has been reported.
HCL AION allows local attackers with high privileges to explore internal filesystem structures through certain system behaviors, potentially disclosing information about the underlying environment that could facilitate further targeted attacks. The vulnerability requires local access, high privileges, and user interaction to trigger, with a CVSS score of 2.9 reflecting low immediate risk. No public exploit code or active exploitation has been identified.
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that can compromise application integrity and confidentiality. Unauthenticated attackers can leverage this access control flaw to manipulate and exfiltrate data with user interaction required (CVSS 8.1, AV:N/AC:L/PR:N/UI:R). No public exploit has been identified at time of analysis, with CISA SSVC rating the technical impact as partial and exploitation status as none.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive database contents and potentially compromise data integrity and availability. The vulnerability carries a CVSS score of 8.3 with network-based attack vector requiring user interaction. No public exploit is identified at time of analysis, and SSVC assessment indicates no current exploitation with non-automatable attack characteristics.
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user interaction to extract sensitive secrets from source code or insecure repositories, resulting in high confidentiality compromise and complete denial of service. CVSS score 7.3 reflects network-accessible attack requiring low privileges and user interaction. No public exploit identified at time of analysis, with SSVC framework indicating no current exploitation and non-automatable attack characteristics.
Session invalidation failure in HCL Aftermarket DPC versions up to 1.0.0 allows authenticated attackers to maintain active sessions after a password change, enabling persistent account takeover. An attacker who gains initial session access can continue to operate under a compromised account identity even after the victim resets their password, as the application fails to terminate pre-existing sessions upon credential modification. No public exploit code or active exploitation has been identified at time of analysis.
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read sensitive files from the system without user interaction beyond a single click, potentially enabling reconnaissance for follow-on attacks. The vulnerability carries a CVSS score of 6.5 (Medium) with high confidentiality impact but no integrity or availability consequences. No public exploit code or active exploitation has been reported at the time of analysis.
HCL Aftermarket DPC versions up to 1.0.0 are vulnerable to session fixation attacks that enable attackers to hijack user sessions and perform unauthorized transactions without requiring valid credentials. The vulnerability exploits improper session management to allow an attacker to force a victim to use a predetermined session identifier, then leverage that session for fraudulent activity. This is a network-accessible flaw requiring user interaction (e.g., clicking a malicious link) but no prior authentication. No public exploit code or active exploitation has been identified at the time of analysis.
HCL Aftermarket DPC versions prior to and including 1.0.0 suffer from an unrestricted file upload vulnerability (CWE-434) that enables authenticated remote attackers to upload and execute arbitrary scripts on the affected server, potentially achieving full system compromise. The attack requires user interaction and low-privilege authentication but carries high integrity impact. No public exploit code or active exploitation has been confirmed; however, the vulnerability's straightforward exploitation mechanics and authenticated attack vector make it a moderate-priority issue for organizations deploying this software.
HCL Aftermarket DPC version 1.0.0 is vulnerable to excessive spamming that consumes server bandwidth and processing resources, potentially causing denial of service to legitimate users. The vulnerability requires user interaction (UI:R per CVSS vector) and is remotely exploitable without authentication, resulting in partial availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the low barrier to exploitation (AC:L) makes this a practical attack vector for resource exhaustion.
HCL Aftermarket DPC version 1.0.0 enforces weak password policies that enable attackers to conduct brute-force attacks and guess user credentials, potentially gaining unauthorized account access with low confidentiality and availability impact. The vulnerability requires user interaction and high attack complexity to exploit, but affects unauthenticated threat actors over the network. No public exploit code or active exploitation has been identified at the time of analysis.
HCL Aftermarket DPC version 1.0.0 contains improper input validation (CWE-20) that enables multiple injection attack vectors including Cross-Site Scripting (XSS), SQL Injection, and Command Injection. Authenticated attackers can exploit this vulnerability to inject and execute arbitrary code within the application context. No public exploit code or active exploitation has been identified at time of analysis, and the moderate CVSS score of 3.5 reflects limited confidentiality impact with user interaction required.
HTTP Response Splitting in HCL Aftermarket DPC allows unauthenticated remote attackers to inject arbitrary content or commands into HTTP responses, potentially leading to content spoofing or further exploitation depending on application response handling. The vulnerability affects Aftermarket DPC version 1.0.0 and requires user interaction to exploit. No public exploit identified at time of analysis, and exploitation is not currently automatable according to CISA SSVC assessment, resulting in a low real-world risk profile despite the injection vector.
HCL Aftermarket DPC discloses sensitive system and software version information through banner responses, enabling attackers to enumerate deployed instances and tailor version-specific exploits. Aftermarket DPC version 1.0.0 is confirmed affected. The vulnerability requires user interaction and high attack complexity but results in partial confidentiality loss; no public exploit has been identified at the time of analysis.
HCL Aftermarket DPC is vulnerable to Cross Domain Script Include (CWE-829) that permits unauthenticated remote attackers to inject and execute malicious external scripts, enabling DOM tampering and theft of session credentials without user interaction. Affected versions include Aftermarket DPC 1.0.0. No public exploit code or active exploitation has been identified at time of analysis, though the attack vector is network-accessible and requires only user interaction (rendering this a moderate-impact integrity threat rather than a critical one).
HCL Aftermarket DPC version 1.0.0 contains a Cross-Origin Resource Sharing (CORS) misconfiguration that permits authenticated attackers with low privileges to access sensitive user information and potentially perform unauthorized actions on behalf of legitimate users through browser-based attacks. The vulnerability requires user interaction (such as social engineering to visit a malicious webpage) and operates within a single security context, limiting its scope to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at the time of analysis, and the low CVSS score of 2.6 reflects the high attack complexity and limited practical exploitability despite the theoretical risk of data exposure.
HCL Aftermarket DPC versions up to 1.0.0 contain an admin session concurrency vulnerability that allows authenticated attackers with low privileges to hijack or impersonate administrator sessions through exploitation of improper concurrent session handling. The vulnerability requires user interaction and has moderate attack complexity, resulting in partial confidentiality and availability impact. No public exploit has been identified at time of analysis, and CISA has not listed this in the KEV catalog, indicating limited real-world exploitation pressure despite the administrative access implications.
HCL Aftermarket DPC version 1.0.0 discloses internal IP addresses to unauthenticated remote attackers via a high-complexity attack vector requiring user interaction, enabling network reconnaissance but causing no direct confidentiality, integrity, or availability impact. No public exploit code has been identified; CISA has not flagged this vulnerability as actively exploited. While the CVSS score of 3.1 (low) reflects minimal immediate risk, the information disclosure enables attackers to map organizational network topology for follow-on attacks.
HCL Aftermarket DPC version 1.0.0 contains outdated or vulnerable dependencies (CWE-1104) that expose the application to known public exploits, enabling authenticated attackers with low privileges to obtain limited information disclosure. The vulnerability requires user interaction and carries a low CVSS score of 2.6, but represents a supply chain risk where publicly available exploits targeting the embedded libraries could be weaponized against deployments. No public exploit code has been independently confirmed, and CISA has not flagged this for active exploitation.
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage.
HCL Sametime is vulnerable to broken server-side validation.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend database queries through specially crafted input fields. The vulnerability affects HCL Unica version 25.1.1 and below, enabling unauthenticated attackers to extract sensitive data, modify database contents, or potentially compromise the entire system. With a critical CVSS score of 9.8 and network-based attack vector requiring no authentication, this represents a severe risk to organizations using affected Unica installations.
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature.
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing the traceability of user activities and potentially compromising monitoring, accountability, and incident investigation capabilities. The vulnerability affects AION 2.0 and is classified as an Information Disclosure issue with a CVSS score of 5.8. An attacker with local access and low privileges could exploit this to perform actions without adequate logging, hindering forensic analysis and compliance audit trails.
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in HCL AION (CVSS 1.8). Remediation should follow standard vulnerability management procedures.
A security vulnerability in HCL AION (CVSS 4.8). Remediation should follow standard vulnerability management procedures.
HCL AION contains a container base image authentication vulnerability where container images are not properly verified before deployment, potentially allowing attackers to execute untrusted or malicious container images within the AION environment. This affects AION 2.0 and could enable attackers with local access and high privileges to compromise system integrity and availability. No public evidence of active exploitation or POC availability has been identified in the provided intelligence sources.
HCL AION contains a SQL injection or improper query validation vulnerability that allows authenticated local users with low privileges to execute potentially harmful SQL queries against the database. The vulnerability affects certain offering configurations and could lead to limited information disclosure, data modification, or denial of service under specific conditions. With a CVSS score of 4.5 and local attack vector requirement, this represents a moderate-risk vulnerability primarily exploitable by insider threats or compromised local accounts.
Improper input validation (CWE-20) in HCL Unica MaxAI Workbench, the AI component within HCL's Unica marketing suite, lets an authenticated low-privileged user plant crafted input in a field that is later rendered to a second user, resulting in reflected cross-site scripting rather than the server-side SQL injection or command injection implied by the vendor's generic description. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, base 3.5) limits the demonstrated impact to partial integrity loss with no confidentiality or availability effect, and exploitation requires both a valid low-privileged account and victim user interaction. Risk is low: EPSS is 0.50 percent (40th percentile), no publicly available exploit code and no CISA KEV entry were identified at time of analysis, and the breadth of the advisory text is not supported by the scored vector.
HTML injection in HCL Unica MaxAI Assistant allows an authenticated low-privileged user to insert special characters that are processed client-side in another user's session, but only when a victim interacts with the crafted content. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, score 4.6) confirms remote reachability, low privileges, required user interaction, and limited confidentiality and integrity impact without scope change. EPSS is 0.17% (6th percentile), no CISA KEV entry or public exploit code was identified at time of analysis, and the issue is considered low priority.
Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensitive details through unhandled exception messages, because the application returns verbose error or stack-trace output to clients. The published CVSS is 9.8 Critical, but independent assessment scopes the direct impact to confidentiality only (C:H/I:N/A:N); any follow-on remote code execution or denial of service is contingent on the leaked information revealing a separately exploitable flaw in the target's specific version and stack. No public exploit identified at time of analysis; CISA KEV status is not indicated, and EPSS is low at 0.39% (31st percentile).
Authorization bypass in HCL Unica Centralized Offer Management allows a remote, authenticated user to read database records, offers, and files belonging to other users or tenants by manipulating the object identifiers the application accepts in requests. The impact is confined to confidentiality - no data modification or service disruption is documented - and exploitation requires only network reach to the application's HTTP interface plus a low-privileged session, with no user interaction. Exploitation is not confirmed as active (CISA KEV), no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (12th percentile), so real-world priority sits below the 7.5 CVSS base score.
The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.