Hcl Software
Monthly
Unauthenticated remote file upload and direct retrieval weaknesses in HCL BigFix AEX allow attackers to place files on the server and then access or download uploaded content without proper authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) shows the issue is reachable over the network at low complexity with no authentication or user interaction, and the supplied CPE identifies the affected product without a narrower version boundary. No CISA KEV entry or public exploit was identified at time of analysis, but the issue is assessed as a credible high-priority item to address this week rather than an emergency.
Remote code execution in HCL BigFix AEX is reachable over the network with low attack complexity, but the CVSS vector requires a high-privilege account (PR:H), so an attacker must already hold privileged access to the product before exploiting the code-injection flaw (CWE-94). The scope change (S:C) indicates that successful exploitation can affect resources beyond the vulnerable component, with high confidentiality, integrity, and availability impact. No public exploit has been identified at the time of analysis, and the vendor advisory KB0134281 is the primary reference; the vuln.today decision label is act_now.
Interception of unencrypted HTTP traffic between backend services in HCL BigFix Service Management lets an on-path attacker extract sensitive data and enables man-in-the-middle manipulation of that inter-service communication. Exploitation requires the attacker to already hold internal network access and an on-path position on the segment carrying that traffic; no authentication to the product and no user interaction are required once positioned, and the high attack complexity reflects the difficulty of establishing and holding that position. The vendor rates this HIGH (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), while our independent assessment re-scores the attack vector as adjacent (AV:A) because practical exploitation is bounded by the internal-segment requirement; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in HCL BigFix Service Management lets an attacker persist malicious script inside the application that executes in a victim's browser when the affected page is viewed, enabling session hijacking and theft of the data that victim can access. The CPE record (cpe:2.3:a:hcl_software:hcl_bigfix_service_management:*) does not enumerate a version range, so all deployments should be treated as potentially affected until the vendor advisory is reviewed. Impact is bounded to the victim's browser and session rather than server compromise, and exploitation depends on a victim subsequently rendering the stored payload; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Broken access control in HCL iControl (CVSS 3.1 score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged authenticated user to bypass authorization checks or manipulate object identifiers directly, resulting in privilege escalation and unauthorized modification or deletion of sensitive application data. Because the exploit requires a valid low-privilege account (PR:L), an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag on the report, but any user with even minimal credentials can escalate to full confidentiality, integrity, and availability impact without user interaction. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; prioritization should focus on environments where low-privilege accounts are broadly provisioned or externally reachable.
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the product fails to adequately lock out or throttle repeated failed authentication attempts, letting remote unauthenticated attackers (CVSS PR:N/UI:N) make unlimited credential guesses that, if successful, grant full access as scored (C:H/I:H/A:H). The vendor scores this 9.8, but our independent assessment uses AC:H because the missing lockout does not itself grant access - the attacker must still obtain or guess valid credentials, so real-world impact hinges on password strength, MFA, and whether the login page is internet-exposed. Competing signals frame this as a high-severity design weakness with low current urgency: EPSS is 0.25% (17th percentile), SSVC records Exploitation: none with partial technical impact, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis.
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's upload functionality and, if the payload is subsequently triggered, achieve code execution and full server compromise. The public description characterizes the actor as unauthenticated, while the vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a low-privileged authenticated account plus user interaction at high attack complexity; our own independent assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so the two views differ by both privilege requirement and severity and must be reconciled before prioritization. Exploitation is limited to deployments that expose the vulnerable upload feature and whose validation controls can be bypassed, and there is no public exploit identified at time of analysis.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprecated TLS 1.0 and TLS 1.1 protocols, whose known cryptographic weaknesses let a suitably positioned attacker intercept and potentially decrypt session traffic. The flaw is an information-disclosure/confidentiality issue reported by HCL; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 3rd percentile). SSVC scores exploitation as none and automatable as no, indicating a real but low-urgency hardening issue rather than an actively targeted vulnerability.
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP responses to defeat client-side authentication or authorization checks and gain unauthorized access to targeted user accounts. HCL rated the flaw critical (CVSS 9.8), but there is no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile), with CISA's SSVC framework marking exploitation as none and technical impact as only partial. The weakness class is authentication bypass (CWE-294), where trust in unverified/manipulable response data lets an attacker forge an authenticated state.
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedded within the application's server responses, allowing a remote unauthenticated attacker to enumerate internal infrastructure for reconnaissance. The issue was reported by HCL and carries a vendor CVSS of 8.2, though it maps to a CWE-200 information exposure with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and CISA SSVC rates exploitation as none and non-automatable.
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are issued without the 'secure' attribute, permitting the browser to transmit them over unencrypted HTTP. A network-positioned attacker able to observe or coerce cleartext traffic can capture session tokens or credentials and impersonate the victim. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC records no known exploitation.
Authentication bypass in HCL DFXServer allows remote unauthenticated attackers to reach specific API endpoints directly and perform unauthorized actions without valid credentials, because the application never verifies authentication status on those routes. The primary impact is high confidentiality exposure with limited integrity impact (CVSS 8.2), and the flaw was self-reported by HCL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HCL DFXServer lets an unauthenticated remote attacker intercept and tamper with the server's authentication responses to be granted access as a legitimate user without presenting valid credentials. Rated CVSS 8.2 (high) with CWE-294 (Authentication Bypass by Capture-replay), the flaw exposes confidential application data to any network-reachable attacker. No public exploit identified at time of analysis and it is not listed in CISA KEV.
HCL BigFix AEX V13.0 contains a flaw in its bundled aws-sdk package that can cause AWS API requests to be directed to unintended or non-AWS endpoints, with limited confidentiality impact. The issue is rated CVSS 3.7 with high attack complexity and no authentication or user interaction required; the specific exploitation preconditions are not described in the available sources. No public exploit code or active exploitation is identified at time of analysis.
Server-side request forgery in HCL BigFix AEX lets an authenticated low-privilege user induce the application to send requests to external resources, which could expose limited information or enable limited unauthorized actions against reachable services. The flaw is rated CVSS 4.2 with high attack complexity and no availability impact, and the supplied intelligence assigns it a this-month remediation priority. No public exploit code or CISA KEV confirmation is present in the supplied data, and exploitation requires a valid low-privilege session rather than being an unauthenticated default-configuration attack.
Clickjacking in the HCL BigFix AEX web interface allows remote attackers to embed the application in a malicious page or iframe and trick a logged-in administrator or operator into performing unintended actions with their own privileges, which can result in unauthorized configuration or account changes. The flaw is a missing or ineffective anti-framing control (CWE-1021); the supplied vendor advisory reference (KB0134281) does not specify which control is absent, and the CPE entry (cpe:2.3:a:hcl_software:bigfix_aex) carries no version boundary, so the affected build range is not enumerated in the available data. Exploitation depends on a victim with an active AEX session being socially engineered into visiting the attacker's page and interacting with the overlaid UI, so it fails against logged-out users and against deployments that already emit X-Frame-Options or a CSP frame-ancestors directive; no public exploit was identified at time of analysis and the issue is not in CISA KEV. Our independent assessment rates this moderate and not urgent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), narrower in impact than the vendor's 6.4 score, with the priority label indicating remediation is appropriate within the current monthly cycle rather than as an emergency.
HCL BigFix AEX discloses sensitive technical detail - stack traces, system information and internal file paths - through improperly handled errors and exceptional conditions, handing low-privilege authenticated users reconnaissance material that can support follow-on attacks. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) makes valid, if limited, credentials the primary limiting factor: this is not a pre-authentication or drive-by issue, and there is no integrity or availability impact. No public exploit has been identified at time of analysis and the CVE is not in CISA KEV; independent assessment rates this a moderate-severity information-disclosure issue rather than a top-tier emergency.
BigFix Platform installations that still ship a Mozilla CA certificate bundle (PEM) dated before 2026/10/20 continue to trust certificates whose private keys are known to be compromised, so an attacker holding an on-path position can impersonate the remote servers BigFix validates and tamper with the files the application downloads. Successful exploitation requires that stale bundle to be present, a privileged man-in-the-middle position, and a certificate chained to one of the compromised keys, which is why the assessed severity is moderate rather than urgent (CVSS 3.1 base 6.8, AV:N/AC:H/PR:N/UI:R). No public exploit code or PoC reference was identified at time of analysis, and the flaw does not affect installations already running the 2026/10/20 or later bundle shipped with BES Support v1520 and above.
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the application, potentially causing injection attacks or errors in downstream processing systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible, low-complexity, unauthenticated access, but exploitation requires user interaction, so an attacker cannot complete the attack alone. Impact is limited to low integrity with no confidentiality or availability effect, making this a moderate-to-low real-world priority; no public exploit identified at time of analysis.
BigFix Service Management API endpoints can disclose sensitive information in error messages when invalid input is submitted, enabling a remote, unauthenticated attacker to perform reconnaissance that may facilitate further attacks. Impact is limited to confidentiality (C:L), with no ability to modify data or execute code, and SSVC rates exploitation as not automatable with no public exploit identified at time of analysis. The vendor-assessed CVSS score is 3.7, while the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; the low severity and reconnaissance-only value make this a low-priority issue despite network reachability without authentication.
An exposed API endpoint in HCL BigFix Service Management returns sensitive internal database information to remote, unauthenticated callers (CVSS 5.3, AV:N/AC:L/PR:N/UI:N), giving attackers reconnaissance material that could support follow-on targeted database attacks. Impact is limited to confidentiality (C:L) with no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis; exploitation is assessed as network-reachable and automatable, so the practical risk depends heavily on whether the management interface is internet-facing or confined to a trusted internal segment.
Information disclosure in HCL BigFix Service Management allows unauthenticated remote attackers to retrieve sensitive data from two exposed API endpoints, with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM). Only confidentiality is affected at a low level; the flaw does not permit data modification or cause denial of service on its own, but the leaked data can be used to stage follow-on attacks against the platform. There is no vendor-released fix identified in the available data, no public exploit code identified at time of analysis, and no confirmed active exploitation (not listed in CISA KEV); the practical risk is driven primarily by whether the BigFix Service Management API tier is reachable from untrusted networks.
Insecure cookie attribute configuration in HCL BigFix Service Management allows attackers to facilitate cross-site request forgery, session hijacking via cross-site scripting, and unauthorized access when a pre-existing enabler - such as an active XSS vector, a cross-site attack page, or an on-path network position - is present. This is a low-priority, defense-in-depth weakness rather than a directly exploitable flaw; no public exploit code has been identified at time of analysis. The vulnerability requires an application deployed without hardened cookie attributes (missing Secure, HttpOnly, SameSite, and restrictive Path), and exploitation yields only low-level confidentiality impact.
Inspection of publicly served JavaScript in BigFix Service Management lets unauthenticated remote users discover hidden administrative API endpoint paths, a low-severity reconnaissance issue that leaks endpoint names without exposing sensitive data, altering data, or causing denial of service. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms no authentication or user interaction is required, but impact is limited to low confidentiality loss; no public exploit code or active exploitation has been identified at time of analysis. The disclosure is only useful if the discovered endpoints have separate exploitable flaws, which this CVE does not provide.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Improper error handling in HCL iControl causes verbose database and system error output to be returned to whoever triggers an unhandled input path, disclosing internal infrastructure details (hostnames, schema or driver information, filesystem paths) that are useful for reconnaissance and planning follow-on attacks. The issue carries a low CVSS v3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - vendor scoring, with our independent assessment re-scoring it slightly higher in attack prerequisites (PR:N) while agreeing on scope and confidentiality-only impact - meaning the exposure is informational and there is no integrity or availability effect. Authentication requirements are not definitively confirmed: the CVSS vector encodes PR:L (a valid low-privileged account) while the vendor description and our assessed vector (PR:N) imply the error disclosure may be reachable without credentials, so defenders should validate which path applies in their deployment. There is no KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue by every available signal and does not warrant emergency response.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Insufficient input sanitization in HCL Sametime allows remote, unauthenticated attackers to expose limited information to a victim who interacts with attacker-controlled content processed by the product's web interface. According to the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3), exploitation cannot occur autonomously - the attacker must socially engineer a target into opening or interacting with crafted input - and the resulting impact is read-only information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, and HCL's advisory (KB0132652) does not specify which feature, input field, or configuration is affected.
Path traversal in the ASReportService component of HCL AppScan 360° allows an authenticated user to supply manipulated file-path input and reach files outside the intended report directory, exposing the surrounding file-system structure or permitting modification of files within the application's directory scope. The flaw is network-reachable but requires a valid account and access to the ASReportService interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), which keeps practical risk moderate and well below the 6.3 base score. There is no public exploit identified at time of analysis and no confirmed active exploitation.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error messages, or rendered page content - allowing anyone able to reach the instance to harvest RFC1918 addressing and infer the internal network topology behind it. The consequence is reconnaissance only: no data modification, no service disruption, and a low vendor base score of 3.1, making this a low-priority item rather than an urgent one. No public exploit code was identified at time of analysis and there is no KEV or EPSS signal in the supplied data. The vendor vector specifies PR:L (a valid session) while the description claims an unauthenticated attacker, so authentication requirements are not confirmed from available data; the vendor's AC:H also implies an additional non-trivial condition or timing is needed to elicit the leak.
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one tenant to read restricted data elements belonging to other tenants because of improper access controls. Affected deployments are those operated in shared or multi-tenant mode; the impact is limited to confidentiality (unauthorized viewing), with no modification or disruption of data, and no user interaction is required on the victim's side (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0). Exploitation requires a legitimate authenticated foothold in at least one tenant, so this is not remotely exploitable by unauthenticated attackers, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-facing fields. Authenticated users can submit arbitrarily long strings into application inputs, potentially degrading system performance or availability due to absent input-length controls. No public exploit code exists and no active exploitation has been observed; the vendor CVSS score of 3.5 (Low) reflects limited real-world impact.
Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated content into the application's user interface, causing it to appear as though the content originates from a trusted source. The vulnerability requires victim interaction - a user must view the attacker-influenced page - and carries a CVSS 3.5 (Low) base score, reflecting its constrained impact on integrity only with no confidentiality or availability effects. No public exploit code or active exploitation has been identified; the primary real-world concern is phishing and social engineering facilitated through the spoofed interface.
Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpected data through the application, causing unintended system behavior or minor integrity-affecting outcomes. The CVSS vector (PR:L/UI:R/I:L) indicates exploitation requires both an authenticated session and user interaction, with impact limited to low-level integrity modification and no confidentiality exposure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Session invalidation failure in HCL IntelliOps Event Management (IEM) v1.3 and v1.4 allows session tokens to persist as valid after an admin explicitly logs out or an administrator deletes the session. An attacker who has previously captured a valid session token - through network interception, XSS, or other means - can replay that token post-logout to retain unauthorized access to admin-level functionality. No public exploit code has been identified at time of analysis, and EPSS/KEV data are not available for this CVE.
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user logs out or an account is deleted, allowing an attacker who has previously captured a legitimate session token to replay it and maintain unauthorized access beyond the intended session lifecycle. The root cause is CWE-613 (Insufficient Session Expiration), where server-side session records are not destroyed upon logout or account removal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.4 Medium score reflects meaningful constraints on exploitation including high attack complexity and required user interaction.
Missing HttpOnly cookie flags in HCL Hive expose session tokens and sensitive credentials to client-side script access, enabling session hijacking when combined with cross-site scripting. The CVE description cites broader infrastructure weaknesses - lateral movement, container breakout, and internal communications exposure - suggesting CWE-1004 is one root cause within a cluster of related configuration flaws. No public exploit has been identified at time of analysis, and no KEV listing exists, but the network-accessible attack surface with no privilege requirement (beyond user interaction) makes this relevant for any internet-exposed Hive deployment.
HCL Hive's software supply chain governance weaknesses expose the application to risk from vulnerable, unmaintained, or malicious third-party dependencies incorporated into its build or runtime environment. The flaw (CWE-1104) reflects insufficient vetting of upstream components, meaning existing dependencies may carry unpatched CVEs or could serve as an introduction vector for malicious code. With a CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R), exploitation is constrained by high attack complexity and user interaction requirements; no public exploit and no CISA KEV listing were identified at time of analysis.
HCL Hive exposes sensitive host environment information through a network-accessible information disclosure flaw, enabling unauthenticated remote attackers - under high attack complexity conditions - to collect reconnaissance data about the underlying system. The CVSS 3.7 (Low) score reflects both the constrained confidentiality impact and the high exploitation complexity. No public exploit code or active exploitation has been identified at time of analysis.
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Insufficient server-side input validation in HCL AION v2.1.0 allows a low-privileged, adjacent-network attacker to submit crafted input that bypasses validation controls, resulting in limited confidentiality disclosure via a scope change to a dependent component. Exploitation requires user interaction, constraining opportunistic use. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypass rate limiting and challenge mechanisms from an adjacent network position. The CVSS vector (AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates exploitation requires adjacent network access, elevated attack complexity, low-privileged credentials, and user interaction - substantially limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-307 root cause represents a well-understood attack class with available tooling in other contexts.
HCL iControl v3.2.0 exposes sensitive data in transit by advertising support for deprecated TLS 1.0 and TLS 1.1 protocol versions, which lack modern cryptographic protections. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates a network-reachable flaw requiring high attack complexity - consistent with a man-in-the-middle positioning requirement for exploitation. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the medium-priority tier despite its network exposure, though organizations with regulatory requirements around cryptographic standards (PCI-DSS, NIST SP 800-52) should treat remediation as mandatory.
Missing granular access control in HCL iControl v3.2.0 exposes administrator-level functionality to unauthorized users over the network. Regular-privilege users can bypass authorization checks to view or access admin-scoped features, resulting in a limited confidentiality impact. No public exploit code exists and no CISA KEV listing is present; however, the 'Authentication Bypass' tag and the network-accessible vector mean the exposure is reachable without physical proximity, though the high attack complexity (AC:H) constrains opportunistic exploitation.
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages triggered by common fault conditions - out of memory events, null pointer exceptions, database unavailability, network timeouts, and system call failures. CWE-209 classifies this as generation of error messages containing sensitive information, meaning stack traces, internal paths, configuration data, or environment details may be disclosed to a network-accessible observer who can trigger or observe these fault states. CVSS scores this at 3.7 (Low), reflecting high attack complexity and limited confidentiality impact; no public exploit identified at time of analysis.
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete functionality on login forms, classified under CWE-522 (Insufficiently Protected Credentials). Valid usernames, email addresses used for login, and account identifiers can be surfaced by the browser's autocomplete engine to subsequent users on shared workstations or kiosk environments. No active exploitation has been identified at time of analysis, and the CVSS score of 3.7 accurately reflects a low-severity, opportunistic information disclosure issue rather than a remotely exploitable critical flaw.
HCL iControl versions 4.3.0 and 4.4.0 expose internal configuration files to local access due to improper web server or application hardening, classified under CWE-497 (Exposure of Sensitive System Information). Local actors without any privileges can read configuration data that should be restricted, potentially revealing sensitive system details usable for follow-on attacks. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.0 (Medium) reflects the limited local attack surface.
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error codes, and authentication status directly to unauthenticated network clients. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exposure but with high attack complexity - specific error-triggering conditions must be crafted. No public exploit exists and this is not in CISA KEV; however, the disclosed metadata constitutes meaningful reconnaissance leverage that can lower the cost of subsequent targeted attacks against the platform.
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system logs, or debugging output rendered by the application dashboard. All versions are affected per the wildcard CPE, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote attackers can trivially trigger and read this disclosure with no special configuration. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the leaked path information materially aids reconnaissance for chained attacks against the underlying server environment.
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attacks by network-positioned adversaries. All versions per the CPE wildcard are affected, and the application fails to include the Strict-Transport-Security response header, leaving browsers without enforcement of HTTPS-only communication. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known, consistent with the low CVSS score of 3.1.
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capture and retransmit valid authentication messages, gaining unauthorized access as a legitimate user. The application lacks message-freshness enforcement - no timestamps or nonce mechanisms are applied to bound the validity window of authentication data, a design gap classified under CWE-294. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the combination of high attack complexity and mandatory user interaction substantially limits realistic exploitation scope.
Unauthenticated API access in HCL DFXServer exposes application endpoints to any network-reachable user without identity verification. The missing access control allows interactions with protected functionality - including read and write operations - from a browser or client that holds no valid session or credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 6.3 medium score and PR:N vector confirm that authentication is not required to reach the affected endpoints.
Reflected cross-site scripting in HCL Notes 12.0.2FP5HF8 enables unauthenticated network attackers to inject and execute arbitrary JavaScript in the browser sessions of targeted users who interact with malicious links. The CVSS 4.0 vector (SC:H/SI:H/SA:H) signals high downstream impact on victim sessions - including potential session hijacking, credential theft, and unauthorized action execution within the Notes web environment. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Unrestricted file upload in HCL ZIE for Web (Z and I Emulator) version 16.0 allows remote attackers to upload a web shell that can yield arbitrary command execution on the server, but only when the server is configured to execute uploaded code and the file lands inside the Webroot. The CVSS 3.1 base score is 9.8, yet CISA's SSVC framework rates exploitation as 'none' and not automatable with only partial technical impact, and EPSS sits at just 0.34% (26th percentile). No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
HCL iControl's web interface fails to automatically expire user sessions after inactivity, leaving authenticated session tokens valid indefinitely until explicit logout. An attacker who obtains a valid session token - through interception or unattended browser access - can reuse it to access the application and read data. CVSS rates this Low (3.1) reflecting high attack complexity and limited confidentiality impact; no public exploit exists and the vulnerability is not listed in CISA KEV.
HCL BigFix Service Management (SM) version 23 ships with - or can be deployed in - a state where the host root filesystem is mounted writable instead of read-only, allowing an attacker who already holds high privileges on that host to modify critical system components that should be immutable. The impact is a hardening deficiency that amplifies an existing foothold rather than a way to gain initial access: remediation requires prior high-privileged (PR:H) access to the local host, and no public exploit code or confirmed active exploitation exists (EPSS 0.03%, 8th percentile; SSVC Exploitation: none, Automatable: no, Technical Impact: partial). This is best treated as a low-priority, defense-in-depth finding despite its 7.2 (High) nominal CVSS.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a brief window while the application communicates with an internal backend service, which an attacker who can capture that traffic could reuse to authenticate to the backend. The flaw was self-reported by HCL and carries a CVSS 7.5 (confidentiality-only) rating; there is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 8th percentile). CISA's SSVC framing rates exploitation as none and the issue as not automatable, indicating low immediate urgency.
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.
Unauthenticated remote file upload and direct retrieval weaknesses in HCL BigFix AEX allow attackers to place files on the server and then access or download uploaded content without proper authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) shows the issue is reachable over the network at low complexity with no authentication or user interaction, and the supplied CPE identifies the affected product without a narrower version boundary. No CISA KEV entry or public exploit was identified at time of analysis, but the issue is assessed as a credible high-priority item to address this week rather than an emergency.
Remote code execution in HCL BigFix AEX is reachable over the network with low attack complexity, but the CVSS vector requires a high-privilege account (PR:H), so an attacker must already hold privileged access to the product before exploiting the code-injection flaw (CWE-94). The scope change (S:C) indicates that successful exploitation can affect resources beyond the vulnerable component, with high confidentiality, integrity, and availability impact. No public exploit has been identified at the time of analysis, and the vendor advisory KB0134281 is the primary reference; the vuln.today decision label is act_now.
Interception of unencrypted HTTP traffic between backend services in HCL BigFix Service Management lets an on-path attacker extract sensitive data and enables man-in-the-middle manipulation of that inter-service communication. Exploitation requires the attacker to already hold internal network access and an on-path position on the segment carrying that traffic; no authentication to the product and no user interaction are required once positioned, and the high attack complexity reflects the difficulty of establishing and holding that position. The vendor rates this HIGH (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), while our independent assessment re-scores the attack vector as adjacent (AV:A) because practical exploitation is bounded by the internal-segment requirement; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in HCL BigFix Service Management lets an attacker persist malicious script inside the application that executes in a victim's browser when the affected page is viewed, enabling session hijacking and theft of the data that victim can access. The CPE record (cpe:2.3:a:hcl_software:hcl_bigfix_service_management:*) does not enumerate a version range, so all deployments should be treated as potentially affected until the vendor advisory is reviewed. Impact is bounded to the victim's browser and session rather than server compromise, and exploitation depends on a victim subsequently rendering the stored payload; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Broken access control in HCL iControl (CVSS 3.1 score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged authenticated user to bypass authorization checks or manipulate object identifiers directly, resulting in privilege escalation and unauthorized modification or deletion of sensitive application data. Because the exploit requires a valid low-privilege account (PR:L), an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag on the report, but any user with even minimal credentials can escalate to full confidentiality, integrity, and availability impact without user interaction. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; prioritization should focus on environments where low-privilege accounts are broadly provisioned or externally reachable.
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the product fails to adequately lock out or throttle repeated failed authentication attempts, letting remote unauthenticated attackers (CVSS PR:N/UI:N) make unlimited credential guesses that, if successful, grant full access as scored (C:H/I:H/A:H). The vendor scores this 9.8, but our independent assessment uses AC:H because the missing lockout does not itself grant access - the attacker must still obtain or guess valid credentials, so real-world impact hinges on password strength, MFA, and whether the login page is internet-exposed. Competing signals frame this as a high-severity design weakness with low current urgency: EPSS is 0.25% (17th percentile), SSVC records Exploitation: none with partial technical impact, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis.
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's upload functionality and, if the payload is subsequently triggered, achieve code execution and full server compromise. The public description characterizes the actor as unauthenticated, while the vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a low-privileged authenticated account plus user interaction at high attack complexity; our own independent assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so the two views differ by both privilege requirement and severity and must be reconciled before prioritization. Exploitation is limited to deployments that expose the vulnerable upload feature and whose validation controls can be bypassed, and there is no public exploit identified at time of analysis.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprecated TLS 1.0 and TLS 1.1 protocols, whose known cryptographic weaknesses let a suitably positioned attacker intercept and potentially decrypt session traffic. The flaw is an information-disclosure/confidentiality issue reported by HCL; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 3rd percentile). SSVC scores exploitation as none and automatable as no, indicating a real but low-urgency hardening issue rather than an actively targeted vulnerability.
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP responses to defeat client-side authentication or authorization checks and gain unauthorized access to targeted user accounts. HCL rated the flaw critical (CVSS 9.8), but there is no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile), with CISA's SSVC framework marking exploitation as none and technical impact as only partial. The weakness class is authentication bypass (CWE-294), where trust in unverified/manipulable response data lets an attacker forge an authenticated state.
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedded within the application's server responses, allowing a remote unauthenticated attacker to enumerate internal infrastructure for reconnaissance. The issue was reported by HCL and carries a vendor CVSS of 8.2, though it maps to a CWE-200 information exposure with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and CISA SSVC rates exploitation as none and non-automatable.
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are issued without the 'secure' attribute, permitting the browser to transmit them over unencrypted HTTP. A network-positioned attacker able to observe or coerce cleartext traffic can capture session tokens or credentials and impersonate the victim. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC records no known exploitation.
Authentication bypass in HCL DFXServer allows remote unauthenticated attackers to reach specific API endpoints directly and perform unauthorized actions without valid credentials, because the application never verifies authentication status on those routes. The primary impact is high confidentiality exposure with limited integrity impact (CVSS 8.2), and the flaw was self-reported by HCL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HCL DFXServer lets an unauthenticated remote attacker intercept and tamper with the server's authentication responses to be granted access as a legitimate user without presenting valid credentials. Rated CVSS 8.2 (high) with CWE-294 (Authentication Bypass by Capture-replay), the flaw exposes confidential application data to any network-reachable attacker. No public exploit identified at time of analysis and it is not listed in CISA KEV.
HCL BigFix AEX V13.0 contains a flaw in its bundled aws-sdk package that can cause AWS API requests to be directed to unintended or non-AWS endpoints, with limited confidentiality impact. The issue is rated CVSS 3.7 with high attack complexity and no authentication or user interaction required; the specific exploitation preconditions are not described in the available sources. No public exploit code or active exploitation is identified at time of analysis.
Server-side request forgery in HCL BigFix AEX lets an authenticated low-privilege user induce the application to send requests to external resources, which could expose limited information or enable limited unauthorized actions against reachable services. The flaw is rated CVSS 4.2 with high attack complexity and no availability impact, and the supplied intelligence assigns it a this-month remediation priority. No public exploit code or CISA KEV confirmation is present in the supplied data, and exploitation requires a valid low-privilege session rather than being an unauthenticated default-configuration attack.
Clickjacking in the HCL BigFix AEX web interface allows remote attackers to embed the application in a malicious page or iframe and trick a logged-in administrator or operator into performing unintended actions with their own privileges, which can result in unauthorized configuration or account changes. The flaw is a missing or ineffective anti-framing control (CWE-1021); the supplied vendor advisory reference (KB0134281) does not specify which control is absent, and the CPE entry (cpe:2.3:a:hcl_software:bigfix_aex) carries no version boundary, so the affected build range is not enumerated in the available data. Exploitation depends on a victim with an active AEX session being socially engineered into visiting the attacker's page and interacting with the overlaid UI, so it fails against logged-out users and against deployments that already emit X-Frame-Options or a CSP frame-ancestors directive; no public exploit was identified at time of analysis and the issue is not in CISA KEV. Our independent assessment rates this moderate and not urgent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), narrower in impact than the vendor's 6.4 score, with the priority label indicating remediation is appropriate within the current monthly cycle rather than as an emergency.
HCL BigFix AEX discloses sensitive technical detail - stack traces, system information and internal file paths - through improperly handled errors and exceptional conditions, handing low-privilege authenticated users reconnaissance material that can support follow-on attacks. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) makes valid, if limited, credentials the primary limiting factor: this is not a pre-authentication or drive-by issue, and there is no integrity or availability impact. No public exploit has been identified at time of analysis and the CVE is not in CISA KEV; independent assessment rates this a moderate-severity information-disclosure issue rather than a top-tier emergency.
BigFix Platform installations that still ship a Mozilla CA certificate bundle (PEM) dated before 2026/10/20 continue to trust certificates whose private keys are known to be compromised, so an attacker holding an on-path position can impersonate the remote servers BigFix validates and tamper with the files the application downloads. Successful exploitation requires that stale bundle to be present, a privileged man-in-the-middle position, and a certificate chained to one of the compromised keys, which is why the assessed severity is moderate rather than urgent (CVSS 3.1 base 6.8, AV:N/AC:H/PR:N/UI:R). No public exploit code or PoC reference was identified at time of analysis, and the flaw does not affect installations already running the 2026/10/20 or later bundle shipped with BES Support v1520 and above.
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the application, potentially causing injection attacks or errors in downstream processing systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible, low-complexity, unauthenticated access, but exploitation requires user interaction, so an attacker cannot complete the attack alone. Impact is limited to low integrity with no confidentiality or availability effect, making this a moderate-to-low real-world priority; no public exploit identified at time of analysis.
BigFix Service Management API endpoints can disclose sensitive information in error messages when invalid input is submitted, enabling a remote, unauthenticated attacker to perform reconnaissance that may facilitate further attacks. Impact is limited to confidentiality (C:L), with no ability to modify data or execute code, and SSVC rates exploitation as not automatable with no public exploit identified at time of analysis. The vendor-assessed CVSS score is 3.7, while the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; the low severity and reconnaissance-only value make this a low-priority issue despite network reachability without authentication.
An exposed API endpoint in HCL BigFix Service Management returns sensitive internal database information to remote, unauthenticated callers (CVSS 5.3, AV:N/AC:L/PR:N/UI:N), giving attackers reconnaissance material that could support follow-on targeted database attacks. Impact is limited to confidentiality (C:L) with no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis; exploitation is assessed as network-reachable and automatable, so the practical risk depends heavily on whether the management interface is internet-facing or confined to a trusted internal segment.
Information disclosure in HCL BigFix Service Management allows unauthenticated remote attackers to retrieve sensitive data from two exposed API endpoints, with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM). Only confidentiality is affected at a low level; the flaw does not permit data modification or cause denial of service on its own, but the leaked data can be used to stage follow-on attacks against the platform. There is no vendor-released fix identified in the available data, no public exploit code identified at time of analysis, and no confirmed active exploitation (not listed in CISA KEV); the practical risk is driven primarily by whether the BigFix Service Management API tier is reachable from untrusted networks.
Insecure cookie attribute configuration in HCL BigFix Service Management allows attackers to facilitate cross-site request forgery, session hijacking via cross-site scripting, and unauthorized access when a pre-existing enabler - such as an active XSS vector, a cross-site attack page, or an on-path network position - is present. This is a low-priority, defense-in-depth weakness rather than a directly exploitable flaw; no public exploit code has been identified at time of analysis. The vulnerability requires an application deployed without hardened cookie attributes (missing Secure, HttpOnly, SameSite, and restrictive Path), and exploitation yields only low-level confidentiality impact.
Inspection of publicly served JavaScript in BigFix Service Management lets unauthenticated remote users discover hidden administrative API endpoint paths, a low-severity reconnaissance issue that leaks endpoint names without exposing sensitive data, altering data, or causing denial of service. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms no authentication or user interaction is required, but impact is limited to low confidentiality loss; no public exploit code or active exploitation has been identified at time of analysis. The disclosure is only useful if the discovered endpoints have separate exploitable flaws, which this CVE does not provide.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Improper error handling in HCL iControl causes verbose database and system error output to be returned to whoever triggers an unhandled input path, disclosing internal infrastructure details (hostnames, schema or driver information, filesystem paths) that are useful for reconnaissance and planning follow-on attacks. The issue carries a low CVSS v3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - vendor scoring, with our independent assessment re-scoring it slightly higher in attack prerequisites (PR:N) while agreeing on scope and confidentiality-only impact - meaning the exposure is informational and there is no integrity or availability effect. Authentication requirements are not definitively confirmed: the CVSS vector encodes PR:L (a valid low-privileged account) while the vendor description and our assessed vector (PR:N) imply the error disclosure may be reachable without credentials, so defenders should validate which path applies in their deployment. There is no KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue by every available signal and does not warrant emergency response.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Insufficient input sanitization in HCL Sametime allows remote, unauthenticated attackers to expose limited information to a victim who interacts with attacker-controlled content processed by the product's web interface. According to the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3), exploitation cannot occur autonomously - the attacker must socially engineer a target into opening or interacting with crafted input - and the resulting impact is read-only information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, and HCL's advisory (KB0132652) does not specify which feature, input field, or configuration is affected.
Path traversal in the ASReportService component of HCL AppScan 360° allows an authenticated user to supply manipulated file-path input and reach files outside the intended report directory, exposing the surrounding file-system structure or permitting modification of files within the application's directory scope. The flaw is network-reachable but requires a valid account and access to the ASReportService interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), which keeps practical risk moderate and well below the 6.3 base score. There is no public exploit identified at time of analysis and no confirmed active exploitation.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error messages, or rendered page content - allowing anyone able to reach the instance to harvest RFC1918 addressing and infer the internal network topology behind it. The consequence is reconnaissance only: no data modification, no service disruption, and a low vendor base score of 3.1, making this a low-priority item rather than an urgent one. No public exploit code was identified at time of analysis and there is no KEV or EPSS signal in the supplied data. The vendor vector specifies PR:L (a valid session) while the description claims an unauthenticated attacker, so authentication requirements are not confirmed from available data; the vendor's AC:H also implies an additional non-trivial condition or timing is needed to elicit the leak.
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one tenant to read restricted data elements belonging to other tenants because of improper access controls. Affected deployments are those operated in shared or multi-tenant mode; the impact is limited to confidentiality (unauthorized viewing), with no modification or disruption of data, and no user interaction is required on the victim's side (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0). Exploitation requires a legitimate authenticated foothold in at least one tenant, so this is not remotely exploitable by unauthenticated attackers, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-facing fields. Authenticated users can submit arbitrarily long strings into application inputs, potentially degrading system performance or availability due to absent input-length controls. No public exploit code exists and no active exploitation has been observed; the vendor CVSS score of 3.5 (Low) reflects limited real-world impact.
Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated content into the application's user interface, causing it to appear as though the content originates from a trusted source. The vulnerability requires victim interaction - a user must view the attacker-influenced page - and carries a CVSS 3.5 (Low) base score, reflecting its constrained impact on integrity only with no confidentiality or availability effects. No public exploit code or active exploitation has been identified; the primary real-world concern is phishing and social engineering facilitated through the spoofed interface.
Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpected data through the application, causing unintended system behavior or minor integrity-affecting outcomes. The CVSS vector (PR:L/UI:R/I:L) indicates exploitation requires both an authenticated session and user interaction, with impact limited to low-level integrity modification and no confidentiality exposure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Session invalidation failure in HCL IntelliOps Event Management (IEM) v1.3 and v1.4 allows session tokens to persist as valid after an admin explicitly logs out or an administrator deletes the session. An attacker who has previously captured a valid session token - through network interception, XSS, or other means - can replay that token post-logout to retain unauthorized access to admin-level functionality. No public exploit code has been identified at time of analysis, and EPSS/KEV data are not available for this CVE.
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user logs out or an account is deleted, allowing an attacker who has previously captured a legitimate session token to replay it and maintain unauthorized access beyond the intended session lifecycle. The root cause is CWE-613 (Insufficient Session Expiration), where server-side session records are not destroyed upon logout or account removal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.4 Medium score reflects meaningful constraints on exploitation including high attack complexity and required user interaction.
Missing HttpOnly cookie flags in HCL Hive expose session tokens and sensitive credentials to client-side script access, enabling session hijacking when combined with cross-site scripting. The CVE description cites broader infrastructure weaknesses - lateral movement, container breakout, and internal communications exposure - suggesting CWE-1004 is one root cause within a cluster of related configuration flaws. No public exploit has been identified at time of analysis, and no KEV listing exists, but the network-accessible attack surface with no privilege requirement (beyond user interaction) makes this relevant for any internet-exposed Hive deployment.
HCL Hive's software supply chain governance weaknesses expose the application to risk from vulnerable, unmaintained, or malicious third-party dependencies incorporated into its build or runtime environment. The flaw (CWE-1104) reflects insufficient vetting of upstream components, meaning existing dependencies may carry unpatched CVEs or could serve as an introduction vector for malicious code. With a CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R), exploitation is constrained by high attack complexity and user interaction requirements; no public exploit and no CISA KEV listing were identified at time of analysis.
HCL Hive exposes sensitive host environment information through a network-accessible information disclosure flaw, enabling unauthenticated remote attackers - under high attack complexity conditions - to collect reconnaissance data about the underlying system. The CVSS 3.7 (Low) score reflects both the constrained confidentiality impact and the high exploitation complexity. No public exploit code or active exploitation has been identified at time of analysis.
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Insufficient server-side input validation in HCL AION v2.1.0 allows a low-privileged, adjacent-network attacker to submit crafted input that bypasses validation controls, resulting in limited confidentiality disclosure via a scope change to a dependent component. Exploitation requires user interaction, constraining opportunistic use. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypass rate limiting and challenge mechanisms from an adjacent network position. The CVSS vector (AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates exploitation requires adjacent network access, elevated attack complexity, low-privileged credentials, and user interaction - substantially limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-307 root cause represents a well-understood attack class with available tooling in other contexts.
HCL iControl v3.2.0 exposes sensitive data in transit by advertising support for deprecated TLS 1.0 and TLS 1.1 protocol versions, which lack modern cryptographic protections. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates a network-reachable flaw requiring high attack complexity - consistent with a man-in-the-middle positioning requirement for exploitation. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the medium-priority tier despite its network exposure, though organizations with regulatory requirements around cryptographic standards (PCI-DSS, NIST SP 800-52) should treat remediation as mandatory.
Missing granular access control in HCL iControl v3.2.0 exposes administrator-level functionality to unauthorized users over the network. Regular-privilege users can bypass authorization checks to view or access admin-scoped features, resulting in a limited confidentiality impact. No public exploit code exists and no CISA KEV listing is present; however, the 'Authentication Bypass' tag and the network-accessible vector mean the exposure is reachable without physical proximity, though the high attack complexity (AC:H) constrains opportunistic exploitation.
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages triggered by common fault conditions - out of memory events, null pointer exceptions, database unavailability, network timeouts, and system call failures. CWE-209 classifies this as generation of error messages containing sensitive information, meaning stack traces, internal paths, configuration data, or environment details may be disclosed to a network-accessible observer who can trigger or observe these fault states. CVSS scores this at 3.7 (Low), reflecting high attack complexity and limited confidentiality impact; no public exploit identified at time of analysis.
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete functionality on login forms, classified under CWE-522 (Insufficiently Protected Credentials). Valid usernames, email addresses used for login, and account identifiers can be surfaced by the browser's autocomplete engine to subsequent users on shared workstations or kiosk environments. No active exploitation has been identified at time of analysis, and the CVSS score of 3.7 accurately reflects a low-severity, opportunistic information disclosure issue rather than a remotely exploitable critical flaw.
HCL iControl versions 4.3.0 and 4.4.0 expose internal configuration files to local access due to improper web server or application hardening, classified under CWE-497 (Exposure of Sensitive System Information). Local actors without any privileges can read configuration data that should be restricted, potentially revealing sensitive system details usable for follow-on attacks. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.0 (Medium) reflects the limited local attack surface.
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error codes, and authentication status directly to unauthenticated network clients. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exposure but with high attack complexity - specific error-triggering conditions must be crafted. No public exploit exists and this is not in CISA KEV; however, the disclosed metadata constitutes meaningful reconnaissance leverage that can lower the cost of subsequent targeted attacks against the platform.
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system logs, or debugging output rendered by the application dashboard. All versions are affected per the wildcard CPE, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote attackers can trivially trigger and read this disclosure with no special configuration. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the leaked path information materially aids reconnaissance for chained attacks against the underlying server environment.
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attacks by network-positioned adversaries. All versions per the CPE wildcard are affected, and the application fails to include the Strict-Transport-Security response header, leaving browsers without enforcement of HTTPS-only communication. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known, consistent with the low CVSS score of 3.1.
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capture and retransmit valid authentication messages, gaining unauthorized access as a legitimate user. The application lacks message-freshness enforcement - no timestamps or nonce mechanisms are applied to bound the validity window of authentication data, a design gap classified under CWE-294. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the combination of high attack complexity and mandatory user interaction substantially limits realistic exploitation scope.
Unauthenticated API access in HCL DFXServer exposes application endpoints to any network-reachable user without identity verification. The missing access control allows interactions with protected functionality - including read and write operations - from a browser or client that holds no valid session or credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 6.3 medium score and PR:N vector confirm that authentication is not required to reach the affected endpoints.
Reflected cross-site scripting in HCL Notes 12.0.2FP5HF8 enables unauthenticated network attackers to inject and execute arbitrary JavaScript in the browser sessions of targeted users who interact with malicious links. The CVSS 4.0 vector (SC:H/SI:H/SA:H) signals high downstream impact on victim sessions - including potential session hijacking, credential theft, and unauthorized action execution within the Notes web environment. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Unrestricted file upload in HCL ZIE for Web (Z and I Emulator) version 16.0 allows remote attackers to upload a web shell that can yield arbitrary command execution on the server, but only when the server is configured to execute uploaded code and the file lands inside the Webroot. The CVSS 3.1 base score is 9.8, yet CISA's SSVC framework rates exploitation as 'none' and not automatable with only partial technical impact, and EPSS sits at just 0.34% (26th percentile). No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
HCL iControl's web interface fails to automatically expire user sessions after inactivity, leaving authenticated session tokens valid indefinitely until explicit logout. An attacker who obtains a valid session token - through interception or unattended browser access - can reuse it to access the application and read data. CVSS rates this Low (3.1) reflecting high attack complexity and limited confidentiality impact; no public exploit exists and the vulnerability is not listed in CISA KEV.
HCL BigFix Service Management (SM) version 23 ships with - or can be deployed in - a state where the host root filesystem is mounted writable instead of read-only, allowing an attacker who already holds high privileges on that host to modify critical system components that should be immutable. The impact is a hardening deficiency that amplifies an existing foothold rather than a way to gain initial access: remediation requires prior high-privileged (PR:H) access to the local host, and no public exploit code or confirmed active exploitation exists (EPSS 0.03%, 8th percentile; SSVC Exploitation: none, Automatable: no, Technical Impact: partial). This is best treated as a low-priority, defense-in-depth finding despite its 7.2 (High) nominal CVSS.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a brief window while the application communicates with an internal backend service, which an attacker who can capture that traffic could reuse to authenticate to the backend. The flaw was self-reported by HCL and carries a CVSS 7.5 (confidentiality-only) rating; there is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 8th percentile). CISA's SSVC framing rates exploitation as none and the issue as not automatable, indicating low immediate urgency.
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.