HCL Software vulnerabilities
431 CVEs and advisories name HCL Software as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-35142HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability.
- CVE-2026-35141HCL DFXAnalytics is affected by a Login Replay Attack vulnerability
- CVE-2026-35140HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability
- CVE-2026-35147HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
- CVE-2026-35149HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
- CVE-2026-35148HCL DFXServer is affected by a Missing Access Control vulnerability
- CVE-2026-9007Reflected XSS in HCL Notes
- CVE-2025-59872HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,
- CVE-2025-62340HCL iControl was affected by Inadequate Session Timeout vulnerability
- CVE-2025-31974HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only
- CVE-2025-31976HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials
- CVE-2025-31978HCL BigFix Service Management (SM) does not adequately sanitize or safely render
- CVE-2025-31959HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images.
- CVE-2025-31982HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directl
- CVE-2025-31957HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.
- CVE-2025-59873Session Token Exposure via URL Query Parameters
- CVE-2025-55252HCL AION is affected by a Weak Password Policy vulnerability
- CVE-2025-55250HCL AION is affected by a Technical Error Disclosure vulnerability
- CVE-2025-52661HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability.
- CVE-2025-55249HCL AION is affected by a Missing Security Response Headers vulnerability.
- CVE-2025-52659HCL AION is affected by a Cacheable HTTP Response vulnerability
- CVE-2025-52660HCL AION is affected by an Host Header Injection vulnerability
- CVE-2025-55251HCL AION is affected by an Unrestricted File Upload vulnerability
- CVE-2025-59870Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
- CVE-2025-55254HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)
- CVE-2025-59849HCL BigFix Remote Control is vulnerable to an insecure CSP configuration
- CVE-2025-62329HCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerability
- CVE-2025-62330HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information
- CVE-2024-42197HCL Workload Scheduler is vulnerable to plain text storage of a password
- CVE-2025-52622HCL BigFix SaaS Remediate is affected by a security vulnerability