Hcltech
Monthly
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative screens and functions reserved for higher-privileged roles, effectively escalating their privileges within the ITSM instance. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 High), the attacker must already hold a valid standard-role account and can reach the application over the network without user interaction, obtaining full read and write capability over the exposed administrative functionality with no direct availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV).
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the application's request-handling layer to inject database commands and to manipulate tenant/organization scoping values so that another organization's profile data and PII can be read. The vendor rates this 9.8 Critical using a vector that encodes PR:N, but the advisory text itself states the attack requires an authenticated attacker - an internal contradiction; our independent assessment resolves it as AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so exploitability hinges on whether a valid account is genuinely required, and the cross-tenant half of the impact only applies to multi-tenant deployments hosting multiple organizations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no fix version was disclosed in the provided data; organizations should treat the vendor KB article as the authoritative source for patched builds.
Local privilege escalation in HCL BigFix Platform on Windows allows authenticated users with low privileges to access cryptographic private keys due to overly permissive file system permissions, potentially enabling complete system compromise with cross-scope impact. Authentication required (PR:L). No public exploit identified at time of analysis, though the attack is rated low complexity and fully automated. CVSS 8.8 severity driven by scope change and complete confidentiality/integrity/availability impact.
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (CVSS PR:L) inject unsanitized script into content that executes in another user's browser when that user views it (UI:R), enabling session hijacking, account takeover, and unauthorized actions performed as the victim. Impact is greatest when the viewing victim is a higher-privileged user such as an agent or administrator, because the injected script then runs with that user's session context. No public exploit identified at time of analysis, and because the affected component is a niche enterprise ITSM module rather than broadly deployed software, this remains a moderate-priority issue.
Insufficient input validation in HCL DevOps Loop permits special characters in fields where they should be restricted, enabling authenticated network-accessible attackers under high-complexity conditions to trigger unintended application behavior resulting in limited information disclosure. The CVSS score of 3.1 (Low) reflects constrained real-world impact: exploitation requires prior authentication and specific conditions to materialize. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacking, MIME-type sniffing, and cross-site scripting for all users of the application. The absence of headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options does not introduce a standalone exploit path but removes a layer of defense-in-depth that browsers rely on to block client-side attack chains. CVSS assigns a low score of 3.7 with high attack complexity, reflecting that meaningful impact requires chaining this weakness with a secondary technique; no public exploit has been identified and the vulnerability is not listed in CISA KEV.
CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-origin requests against the application. The improper CORS policy potentially allows untrusted domains to read application responses, exposing session-bound resources to attacker-controlled origins. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the tag 'Authentication Bypass' suggests resource exposure can undermine access control assumptions.
Forced browsing vulnerability in HCL DevOps Loop allows authenticated low-privileged users to access restricted administrative endpoints by directly navigating to protected URLs without proper authorization enforcement. The application fails to validate that the requesting user holds sufficient privileges before serving administrative responses, enabling unauthorized access to admin functionality over the network. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting and CSV formula injection in HCL iControl 4.0.0 let a remote attacker embed unsanitized input that executes when a victim clicks a crafted link or opens an exported CSV report. Insufficient sanitization of input parameters (CWE-1236) allows malicious script or spreadsheet formulas to run in the victim's browser or spreadsheet application. No public exploit identified at time of analysis, and EPSS is very low (0.04%, 13th percentile), indicating negligible observed exploitation activity.
Stack trace disclosure in HCL iControl v4.0.0 exposes internal application details to authenticated remote attackers via unhandled JavaScript exceptions. The application fails to catch a runtime error when attempting to read the 'dashboard' key from an undefined object, returning a full stack trace to the requesting client. No public exploit exists and no active exploitation has been observed; CVSS scores this Low (3.1), reflecting strictly limited confidentiality impact with no integrity or availability consequences.
Missing HTTP security response headers in HCL iControl fail to instruct client browsers to engage their built-in XSS filtering mechanisms, creating an exploitable gap classified under CWE-693 (Protection Mechanism Failure). The flaw is network-accessible and requires no authentication (PR:N per CVSS), but carries a CVSS 3.7 Low score due to high attack complexity (AC:H) and limited integrity-only impact (I:L). No public exploit code exists and this vulnerability is not listed in CISA KEV, placing it in the compliance/hardening category rather than immediate critical risk.
HCL iControl exposes session cookies without the Secure or SameSite attributes set, and with the cookie path scoped to root, enabling network-adjacent attackers with authenticated sessions to perform limited integrity modifications under high-complexity conditions. The missing Secure attribute allows cookies to be transmitted over unencrypted HTTP channels, while the absent SameSite attribute opens a cross-site request forgery vector. CVSS scores this at 3.1 (Low); no public exploit code exists and it is not listed in CISA KEV.
Weak input validation in HCL iControl allows authenticated remote attackers to submit input of an unexpected type, resulting in limited integrity impact against the target system. The vulnerability stems from an implementation deficiency in an architectural security tactic - specifically, the application's failure to correctly validate received input against its expected type. No public exploit code exists and no active exploitation has been confirmed; however, the low-complexity, network-accessible attack vector lowers the bar for authenticated users to abuse this flaw.
Missing X-Content-Type-Options response header in HCL BigFix Service Management (SM) leaves browsers without MIME-type sniffing protection, creating conditions where malicious or ambiguously typed content served through the application could be misinterpreted and executed by a victim's browser. The CVSS score of 3.7 (Low) reflects genuine constraints: high attack complexity, required low-privilege authentication, and mandatory user interaction all limit realistic exploitability. No public exploit code exists and this vulnerability is not confirmed actively exploited (CISA KEV), consistent with its classification as a security misconfiguration rather than a critical flaw.
HCL BigFix Service Management (SM) ships container deployments built on outdated or insecure base images, inheriting known vulnerabilities from those upstream layers rather than introducing a discrete code-level flaw. The CVSS vector (AV:L/PR:H/UI:R) constrains real-world risk significantly: exploitation requires local access, high privileges, and user interaction, making opportunistic remote attack unlikely. The actual exploitability and impact depend entirely on which specific vulnerabilities are present in the underlying base image versions in use. No public exploit code and no CISA KEV listing exist at the time of analysis.
HCL BigFix Platform allows local attackers to bypass authentication and access sensitive application areas without credentials, affecting confidentiality of data. The vulnerability requires local access but no privileges or user interaction, and is classified as a moderate-risk authentication bypass (CVSS 4.0) with limited technical complexity. Patches are available through HCL vendor advisories.
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.
A security vulnerability in HCL AION (CVSS 1.9). Remediation should follow standard vulnerability management procedures.
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour.
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL [CVSS 3.3 LOW]
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs. [CVSS 3.3 LOW]
HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit. [CVSS 6.1 MEDIUM]
Connections versions up to 7.0 contains a vulnerability that allows attackers to obtain limited information when a single piece of internal metadata is returned (CVSS 3.5).
HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. [CVSS 3.1 LOW]
HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.. [CVSS 3.7 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, potentially increasing exposure to cr (CVSS 4.6).
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. [CVSS 3.7 LOW]
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0. [CVSS 3.7 LOW]
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0 [CVSS 4.5 MEDIUM]
A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals. [CVSS 5.3 MEDIUM]
Aion versions up to 2.0 contains a vulnerability that allows attackers to the use of easily guessable passwords, potentially resulting in unauthorized acc (CVSS 3.1).
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks. [CVSS 1.8 LOW]
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. [CVSS 3.1 LOW]
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks. [CVSS 3.5 LOW]
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised. [CVSS 2.4 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to malicious file uploads, potentially resulting in unauthorized code execution or (CVSS 2.7).
Aion versions up to 2.0 contains a vulnerability that allows attackers to unintended storage of sensitive or dynamic content, potentially resulting in una (CVSS 2.8).
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk [CVSS 7.4 HIGH]
Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by information exposure (CVSS 2.2).
Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by missing authentication for critical function (CVSS 2.9).
Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by insufficient session expiration (CVSS 2.0).
An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests
Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives
File upload vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CSV formula injection vulnerability in HCL Technologies Ltd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Unica Platform exposes unprotected files to network-reachable clients because of improper access controls, allowing an unauthenticated remote attacker to read sensitive application or system data (CVSS 3.1 base 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no credentials or user interaction are required - the only real precondition is that the Unica instance is reachable over the network and the affected files remain served without authorization checks in the default/unpatched state. There is no public exploit identified at time of analysis, but the flaw is low-complexity and trivially automatable once the readable paths are located; EPSS and KEV data were not provided, and the impact is confined to confidentiality (no integrity or availability effect) per the vendor and independent assessment.
Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensitive details through unhandled exception messages, because the application returns verbose error or stack-trace output to clients. The published CVSS is 9.8 Critical, but independent assessment scopes the direct impact to confidentiality only (C:H/I:N/A:N); any follow-on remote code execution or denial of service is contingent on the leaked information revealing a separately exploitable flaw in the target's specific version and stack. No public exploit identified at time of analysis; CISA KEV status is not indicated, and EPSS is low at 0.39% (31st percentile).
Server-side request forgery in HCL Unica Centralized Offer Management lets unauthenticated, remote attackers steer the application server into issuing requests to attacker-chosen URLs or internal hosts, exposing internal services, management interfaces, or cloud metadata endpoints reachable from the server. The vendor rates this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) treats only confidentiality as high, with limited integrity effect and no availability impact, so the signals are divergent and a tempered priority is warranted rather than treating the 9.8 at face value. Exploitation status is no public exploit identified at time of analysis, EPSS is low at 0.24% (~14th percentile), and there is no evidence of confirmed actively exploited (CISA KEV) activity.
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-depth control disabled rather than directly enabling remote code execution. The vendor scores this 9.8, but our assessment identifies a sharp conflict with that label: exploitation is client-side, requires high complexity and user interaction, and is limited to low confidentiality and integrity impact within the victim's browser context. No public exploit was identified at time of analysis, and EPSS is 0.03% (percentile 9%), so active exploitation is not indicated.
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because the application fails to set cache-prevention headers (CWE-525). An attacker with local access to a browser cache, shared endpoint, or disk image could recover this data without authenticating to AION, but the independent assessment rates this as low confidentiality impact (CVSS AV:L) rather than the vendor’s 7.5 (AV:N), since prior cache access is required. No public exploit code or active exploitation has been identified, and EPSS is 0.03%.
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Policy header, potentially enabling cross-site scripting (XSS) and injection attacks. No active exploitation or public exploit code is known; EPSS score is 0.02%, indicating a very low probability of real-world exploitation.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclosure vulnerability (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). This flaw requires only network reachability to the AION instance and has high confidentiality impact with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.03% (9th percentile).
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker who can observe traffic between a victim's browser and the server can capture the session token in cleartext and hijack the authenticated session. The issue affects AION 2.0.0 (CPE cpe:2.3:a:hcltech:aion:2.0.0) and is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) by the vendor, though our independent assessment adjusts the attack complexity to High because exploitation additionally requires cleartext HTTP reachability or downgradability plus a man-in-the-middle/passive sniffing position; if AION is served strictly over HTTPS with HSTS and no HTTP listener, the cookie never leaves the browser in plaintext and the flaw is effectively unexploitable. No public exploit code has been identified and there is no evidence of active exploitation, and the EPSS score is negligible at 0.02% (5th percentile), consistent with a low-likelihood, moderate-severity configuration/hygiene flaw rather than a remote pre-auth compromise vector.
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user interaction (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score is very low at 0.03% (9th percentile), indicating limited real-world targeting despite the high base score. The vendor advisory does not detail the affected feature or protocol, and the product's niche deployment footprint further reduces exposure.
A security vulnerability in HCL MyXalytics (CVSS 3.5). Remediation should follow standard vulnerability management procedures.
HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
Cross-site scripting in HCL MyXalytics 6.6 (tracked as DRYiCE MyXalytics, CPE cpe:2.3:a:hcltech:dryice_myxalytics:6.6) allows an authenticated low-privilege user to inject script that executes in a second user's browser within the web application, potentially driving unauthorized actions or access on the victim's behalf. Exploitation requires a valid low-privilege session plus victim interaction with the crafted page, and impact is confined to the web application context with low confidentiality and integrity effect and no availability impact. All exploitation signals point to a low-priority issue despite the medium CVSS 5.4: no public exploit identified at time of analysis, no CISA KEV listing, and an EPSS score of just 0.03% (9th percentile).
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable. No vendor patch available.
HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable. No vendor patch available.
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL BigFix Compliance is affected by an improper or missing SameSite attribute. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable. No vendor patch available.
Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insufficient default configuration in HCL Leap allows anonymous access to directory information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing "no cache" headers in HCL Leap permits sensitive data to be cached. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL SX v21 is affected by usage of a weak cryptographic algorithm. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing "no cache" headers in HCL Leap permits sensitive data to be cached. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.
Missing "no cache" headers in HCL Leap permits user directory information to be cached. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.
Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative screens and functions reserved for higher-privileged roles, effectively escalating their privileges within the ITSM instance. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 High), the attacker must already hold a valid standard-role account and can reach the application over the network without user interaction, obtaining full read and write capability over the exposed administrative functionality with no direct availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV).
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the application's request-handling layer to inject database commands and to manipulate tenant/organization scoping values so that another organization's profile data and PII can be read. The vendor rates this 9.8 Critical using a vector that encodes PR:N, but the advisory text itself states the attack requires an authenticated attacker - an internal contradiction; our independent assessment resolves it as AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so exploitability hinges on whether a valid account is genuinely required, and the cross-tenant half of the impact only applies to multi-tenant deployments hosting multiple organizations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no fix version was disclosed in the provided data; organizations should treat the vendor KB article as the authoritative source for patched builds.
Local privilege escalation in HCL BigFix Platform on Windows allows authenticated users with low privileges to access cryptographic private keys due to overly permissive file system permissions, potentially enabling complete system compromise with cross-scope impact. Authentication required (PR:L). No public exploit identified at time of analysis, though the attack is rated low complexity and fully automated. CVSS 8.8 severity driven by scope change and complete confidentiality/integrity/availability impact.
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (CVSS PR:L) inject unsanitized script into content that executes in another user's browser when that user views it (UI:R), enabling session hijacking, account takeover, and unauthorized actions performed as the victim. Impact is greatest when the viewing victim is a higher-privileged user such as an agent or administrator, because the injected script then runs with that user's session context. No public exploit identified at time of analysis, and because the affected component is a niche enterprise ITSM module rather than broadly deployed software, this remains a moderate-priority issue.
Insufficient input validation in HCL DevOps Loop permits special characters in fields where they should be restricted, enabling authenticated network-accessible attackers under high-complexity conditions to trigger unintended application behavior resulting in limited information disclosure. The CVSS score of 3.1 (Low) reflects constrained real-world impact: exploitation requires prior authentication and specific conditions to materialize. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacking, MIME-type sniffing, and cross-site scripting for all users of the application. The absence of headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options does not introduce a standalone exploit path but removes a layer of defense-in-depth that browsers rely on to block client-side attack chains. CVSS assigns a low score of 3.7 with high attack complexity, reflecting that meaningful impact requires chaining this weakness with a secondary technique; no public exploit has been identified and the vulnerability is not listed in CISA KEV.
CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-origin requests against the application. The improper CORS policy potentially allows untrusted domains to read application responses, exposing session-bound resources to attacker-controlled origins. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the tag 'Authentication Bypass' suggests resource exposure can undermine access control assumptions.
Forced browsing vulnerability in HCL DevOps Loop allows authenticated low-privileged users to access restricted administrative endpoints by directly navigating to protected URLs without proper authorization enforcement. The application fails to validate that the requesting user holds sufficient privileges before serving administrative responses, enabling unauthorized access to admin functionality over the network. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting and CSV formula injection in HCL iControl 4.0.0 let a remote attacker embed unsanitized input that executes when a victim clicks a crafted link or opens an exported CSV report. Insufficient sanitization of input parameters (CWE-1236) allows malicious script or spreadsheet formulas to run in the victim's browser or spreadsheet application. No public exploit identified at time of analysis, and EPSS is very low (0.04%, 13th percentile), indicating negligible observed exploitation activity.
Stack trace disclosure in HCL iControl v4.0.0 exposes internal application details to authenticated remote attackers via unhandled JavaScript exceptions. The application fails to catch a runtime error when attempting to read the 'dashboard' key from an undefined object, returning a full stack trace to the requesting client. No public exploit exists and no active exploitation has been observed; CVSS scores this Low (3.1), reflecting strictly limited confidentiality impact with no integrity or availability consequences.
Missing HTTP security response headers in HCL iControl fail to instruct client browsers to engage their built-in XSS filtering mechanisms, creating an exploitable gap classified under CWE-693 (Protection Mechanism Failure). The flaw is network-accessible and requires no authentication (PR:N per CVSS), but carries a CVSS 3.7 Low score due to high attack complexity (AC:H) and limited integrity-only impact (I:L). No public exploit code exists and this vulnerability is not listed in CISA KEV, placing it in the compliance/hardening category rather than immediate critical risk.
HCL iControl exposes session cookies without the Secure or SameSite attributes set, and with the cookie path scoped to root, enabling network-adjacent attackers with authenticated sessions to perform limited integrity modifications under high-complexity conditions. The missing Secure attribute allows cookies to be transmitted over unencrypted HTTP channels, while the absent SameSite attribute opens a cross-site request forgery vector. CVSS scores this at 3.1 (Low); no public exploit code exists and it is not listed in CISA KEV.
Weak input validation in HCL iControl allows authenticated remote attackers to submit input of an unexpected type, resulting in limited integrity impact against the target system. The vulnerability stems from an implementation deficiency in an architectural security tactic - specifically, the application's failure to correctly validate received input against its expected type. No public exploit code exists and no active exploitation has been confirmed; however, the low-complexity, network-accessible attack vector lowers the bar for authenticated users to abuse this flaw.
Missing X-Content-Type-Options response header in HCL BigFix Service Management (SM) leaves browsers without MIME-type sniffing protection, creating conditions where malicious or ambiguously typed content served through the application could be misinterpreted and executed by a victim's browser. The CVSS score of 3.7 (Low) reflects genuine constraints: high attack complexity, required low-privilege authentication, and mandatory user interaction all limit realistic exploitability. No public exploit code exists and this vulnerability is not confirmed actively exploited (CISA KEV), consistent with its classification as a security misconfiguration rather than a critical flaw.
HCL BigFix Service Management (SM) ships container deployments built on outdated or insecure base images, inheriting known vulnerabilities from those upstream layers rather than introducing a discrete code-level flaw. The CVSS vector (AV:L/PR:H/UI:R) constrains real-world risk significantly: exploitation requires local access, high privileges, and user interaction, making opportunistic remote attack unlikely. The actual exploitability and impact depend entirely on which specific vulnerabilities are present in the underlying base image versions in use. No public exploit code and no CISA KEV listing exist at the time of analysis.
HCL BigFix Platform allows local attackers to bypass authentication and access sensitive application areas without credentials, affecting confidentiality of data. The vulnerability requires local access but no privileges or user interaction, and is classified as a moderate-risk authentication bypass (CVSS 4.0) with limited technical complexity. Patches are available through HCL vendor advisories.
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.
A security vulnerability in HCL AION (CVSS 1.9). Remediation should follow standard vulnerability management procedures.
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour.
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL [CVSS 3.3 LOW]
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs. [CVSS 3.3 LOW]
HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit. [CVSS 6.1 MEDIUM]
Connections versions up to 7.0 contains a vulnerability that allows attackers to obtain limited information when a single piece of internal metadata is returned (CVSS 3.5).
HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. [CVSS 3.1 LOW]
HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.. [CVSS 3.7 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, potentially increasing exposure to cr (CVSS 4.6).
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. [CVSS 3.7 LOW]
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0. [CVSS 3.7 LOW]
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0 [CVSS 4.5 MEDIUM]
A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals. [CVSS 5.3 MEDIUM]
Aion versions up to 2.0 contains a vulnerability that allows attackers to the use of easily guessable passwords, potentially resulting in unauthorized acc (CVSS 3.1).
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks. [CVSS 1.8 LOW]
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. [CVSS 3.1 LOW]
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks. [CVSS 3.5 LOW]
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised. [CVSS 2.4 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to malicious file uploads, potentially resulting in unauthorized code execution or (CVSS 2.7).
Aion versions up to 2.0 contains a vulnerability that allows attackers to unintended storage of sensitive or dynamic content, potentially resulting in una (CVSS 2.8).
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk [CVSS 7.4 HIGH]
Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by information exposure (CVSS 2.2).
Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by missing authentication for critical function (CVSS 2.9).
Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by insufficient session expiration (CVSS 2.0).
An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests
Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives
File upload vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CSV formula injection vulnerability in HCL Technologies Ltd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Unica Platform exposes unprotected files to network-reachable clients because of improper access controls, allowing an unauthenticated remote attacker to read sensitive application or system data (CVSS 3.1 base 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no credentials or user interaction are required - the only real precondition is that the Unica instance is reachable over the network and the affected files remain served without authorization checks in the default/unpatched state. There is no public exploit identified at time of analysis, but the flaw is low-complexity and trivially automatable once the readable paths are located; EPSS and KEV data were not provided, and the impact is confined to confidentiality (no integrity or availability effect) per the vendor and independent assessment.
Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensitive details through unhandled exception messages, because the application returns verbose error or stack-trace output to clients. The published CVSS is 9.8 Critical, but independent assessment scopes the direct impact to confidentiality only (C:H/I:N/A:N); any follow-on remote code execution or denial of service is contingent on the leaked information revealing a separately exploitable flaw in the target's specific version and stack. No public exploit identified at time of analysis; CISA KEV status is not indicated, and EPSS is low at 0.39% (31st percentile).
Server-side request forgery in HCL Unica Centralized Offer Management lets unauthenticated, remote attackers steer the application server into issuing requests to attacker-chosen URLs or internal hosts, exposing internal services, management interfaces, or cloud metadata endpoints reachable from the server. The vendor rates this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) treats only confidentiality as high, with limited integrity effect and no availability impact, so the signals are divergent and a tempered priority is warranted rather than treating the 9.8 at face value. Exploitation status is no public exploit identified at time of analysis, EPSS is low at 0.24% (~14th percentile), and there is no evidence of confirmed actively exploited (CISA KEV) activity.
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-depth control disabled rather than directly enabling remote code execution. The vendor scores this 9.8, but our assessment identifies a sharp conflict with that label: exploitation is client-side, requires high complexity and user interaction, and is limited to low confidentiality and integrity impact within the victim's browser context. No public exploit was identified at time of analysis, and EPSS is 0.03% (percentile 9%), so active exploitation is not indicated.
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because the application fails to set cache-prevention headers (CWE-525). An attacker with local access to a browser cache, shared endpoint, or disk image could recover this data without authenticating to AION, but the independent assessment rates this as low confidentiality impact (CVSS AV:L) rather than the vendor’s 7.5 (AV:N), since prior cache access is required. No public exploit code or active exploitation has been identified, and EPSS is 0.03%.
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Policy header, potentially enabling cross-site scripting (XSS) and injection attacks. No active exploitation or public exploit code is known; EPSS score is 0.02%, indicating a very low probability of real-world exploitation.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclosure vulnerability (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). This flaw requires only network reachability to the AION instance and has high confidentiality impact with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.03% (9th percentile).
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker who can observe traffic between a victim's browser and the server can capture the session token in cleartext and hijack the authenticated session. The issue affects AION 2.0.0 (CPE cpe:2.3:a:hcltech:aion:2.0.0) and is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) by the vendor, though our independent assessment adjusts the attack complexity to High because exploitation additionally requires cleartext HTTP reachability or downgradability plus a man-in-the-middle/passive sniffing position; if AION is served strictly over HTTPS with HSTS and no HTTP listener, the cookie never leaves the browser in plaintext and the flaw is effectively unexploitable. No public exploit code has been identified and there is no evidence of active exploitation, and the EPSS score is negligible at 0.02% (5th percentile), consistent with a low-likelihood, moderate-severity configuration/hygiene flaw rather than a remote pre-auth compromise vector.
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user interaction (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score is very low at 0.03% (9th percentile), indicating limited real-world targeting despite the high base score. The vendor advisory does not detail the affected feature or protocol, and the product's niche deployment footprint further reduces exposure.
A security vulnerability in HCL MyXalytics (CVSS 3.5). Remediation should follow standard vulnerability management procedures.
HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
Cross-site scripting in HCL MyXalytics 6.6 (tracked as DRYiCE MyXalytics, CPE cpe:2.3:a:hcltech:dryice_myxalytics:6.6) allows an authenticated low-privilege user to inject script that executes in a second user's browser within the web application, potentially driving unauthorized actions or access on the victim's behalf. Exploitation requires a valid low-privilege session plus victim interaction with the crafted page, and impact is confined to the web application context with low confidentiality and integrity effect and no availability impact. All exploitation signals point to a low-priority issue despite the medium CVSS 5.4: no public exploit identified at time of analysis, no CISA KEV listing, and an EPSS score of just 0.03% (9th percentile).
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable. No vendor patch available.
HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable. No vendor patch available.
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL BigFix Compliance is affected by an improper or missing SameSite attribute. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable. No vendor patch available.
Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insufficient default configuration in HCL Leap allows anonymous access to directory information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing "no cache" headers in HCL Leap permits sensitive data to be cached. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL SX v21 is affected by usage of a weak cryptographic algorithm. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing "no cache" headers in HCL Leap permits sensitive data to be cached. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.
Missing "no cache" headers in HCL Leap permits user directory information to be cached. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.
Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.