# cve.now: HCL

The newest entries naming HCL as an affected vendor (up to 200), of 89 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-62347](https://cve.now/CVE-2025-62347.md): HCL iControl was affected by Improper Input Validation vulnerability. (CVSS 4.3)
- [CVE-2025-59874](https://cve.now/CVE-2025-59874.md): HCL Hive Telco Observability is affected by a Required directives missing from the CSP . (CVSS 8.1)
- [CVE-2025-52606](https://cve.now/CVE-2025-52606.md): HCL iControl was affected by Weak Input Validation vulnerability. . (CVSS 4.3)
- [CVE-2025-52608](https://cve.now/CVE-2025-52608.md): HCL iControl was affected by Missing Cookie Attributes vulnerability. (CVSS 3.1)
- [CVE-2025-52609](https://cve.now/CVE-2025-52609.md): HCL iControl was affected by Missing Security Headers vulnerability. (CVSS 3.7)
- [CVE-2025-52611](https://cve.now/CVE-2025-52611.md): HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability (CVSS 3.1)
- [CVE-2025-52612](https://cve.now/CVE-2025-52612.md): HCL iControl was affected by Export CSV - CSV Injection vulnerability. (CVSS 7.1)
- [CVE-2024-42206](https://cve.now/CVE-2024-42206.md): HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application. (CVSS 3.1)
- [CVE-2025-31985](https://cve.now/CVE-2025-31985.md): HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header (CVSS 3.7)
- [CVE-2025-31973](https://cve.now/CVE-2025-31973.md): HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version' (CVSS 4.0)
- [CVE-2025-62305](https://cve.now/CVE-2025-62305.md): HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions (CVSS 5.1)
- [CVE-2025-62317](https://cve.now/CVE-2025-62317.md): HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. (CVSS 2.6)
- [CVE-2025-62308](https://cve.now/CVE-2025-62308.md): HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed (CVSS 5.1)
- [CVE-2025-62309](https://cve.now/CVE-2025-62309.md): HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. (CVSS 2.6)
- [CVE-2025-62312](https://cve.now/CVE-2025-62312.md): HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication (CVSS 3.0)
- [CVE-2025-62316](https://cve.now/CVE-2025-62316.md): HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured (CVSS 2.3)
- [CVE-2025-62313](https://cve.now/CVE-2025-62313.md): HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. (CVSS 5.4)
- [CVE-2025-62311](https://cve.now/CVE-2025-62311.md): HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. (CVSS 4.3)
- [CVE-2025-62310](https://cve.now/CVE-2025-62310.md): HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations (CVSS 5.4)
- [CVE-2024-30151](https://cve.now/CVE-2024-30151.md): HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability (CVSS 8.3)
- [CVE-2025-31960](https://cve.now/CVE-2025-31960.md): HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module (CVSS 5.3)
- [CVE-2025-31975](https://cve.now/CVE-2025-31975.md): HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. (CVSS 2.6)
- [CVE-2025-52613](https://cve.now/CVE-2025-52613.md): HCL BigFix Service Management (SM) is affected by use of a vulnerable component (CVSS 4.6)
- [CVE-2025-31984](https://cve.now/CVE-2025-31984.md): HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header (CVSS 3.7)
- [CVE-2025-31983](https://cve.now/CVE-2025-31983.md): HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header (CVSS 3.7)
- [CVE-2025-62345](https://cve.now/CVE-2025-62345.md): HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability (CVSS 2.7)
- [CVE-2025-31951](https://cve.now/CVE-2025-31951.md): HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability (CVSS 8.8)
- [CVE-2025-59854](https://cve.now/CVE-2025-59854.md): HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability (CVSS 3.1)
- [CVE-2025-59853](https://cve.now/CVE-2025-59853.md): HCL DFXAnalytics is affected by an Improper Error Handling vulnerability (CVSS 3.1)
- [CVE-2025-59852](https://cve.now/CVE-2025-59852.md): HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability (CVSS 3.7)
- [CVE-2025-59851](https://cve.now/CVE-2025-59851.md): HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability (CVSS 3.7)
- [CVE-2025-31970](https://cve.now/CVE-2025-31970.md): HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability (CVSS 5.3)
- [CVE-2025-52641](https://cve.now/CVE-2025-52641.md): Internal Filesystem Exploration vulnerability (CVSS 2.9)
- [CVE-2025-55261](https://cve.now/CVE-2025-55261.md): HCL Aftermarket DPC is affected by Missing Functional Level Access Control (CVSS 8.1)
- [CVE-2025-55262](https://cve.now/CVE-2025-55262.md): HCL Aftermarket DPC is affected by SQL Injection (CVSS 8.3)
- [CVE-2025-55263](https://cve.now/CVE-2025-55263.md): HCL Aftermarket DPC is affected by Hardcoded Sensitive Data (CVSS 7.3)
- [CVE-2025-55264](https://cve.now/CVE-2025-55264.md): HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change (CVSS 5.5)
- [CVE-2025-55265](https://cve.now/CVE-2025-55265.md): HCL Aftermarket DPC is affected by File Discovery (CVSS 6.5)
- [CVE-2025-55266](https://cve.now/CVE-2025-55266.md): HCL Aftermarket DPC is affected by Session Fixation (CVSS 5.9)
- [CVE-2025-55267](https://cve.now/CVE-2025-55267.md): HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability (CVSS 5.7)
- [CVE-2025-55268](https://cve.now/CVE-2025-55268.md): HCL Aftermarket DPC is affected by Spamming Vulnerability (CVSS 4.3)
- [CVE-2025-55269](https://cve.now/CVE-2025-55269.md): HCL Aftermarket DPC is affected by Weak Password Policy vulnerability (CVSS 4.2)
- [CVE-2025-55270](https://cve.now/CVE-2025-55270.md): HCL Aftermarket DPC is affected by Improper Input Validation (CVSS 3.5)
- [CVE-2025-55271](https://cve.now/CVE-2025-55271.md): HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability (CVSS 3.1)
- [CVE-2025-55272](https://cve.now/CVE-2025-55272.md): HCL Aftermarket DPC is affected by Banner Disclosure vulnerability (CVSS 3.1)
- [CVE-2025-55273](https://cve.now/CVE-2025-55273.md): HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability (CVSS 4.3)
- [CVE-2025-55274](https://cve.now/CVE-2025-55274.md): HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability (CVSS 2.6)
- [CVE-2025-55275](https://cve.now/CVE-2025-55275.md): HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability (CVSS 3.7)
- [CVE-2025-55276](https://cve.now/CVE-2025-55276.md): HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability (CVSS 3.1)
- [CVE-2025-55277](https://cve.now/CVE-2025-55277.md): HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability (CVSS 2.6)
- [CVE-2025-62320](https://cve.now/CVE-2025-62320.md): HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform (CVSS 4.7)
- [CVE-2025-31966](https://cve.now/CVE-2025-31966.md): Boolean-Based SQL Injection in Multiple Unica Components (CVSS 2.7)
- [CVE-2025-62319](https://cve.now/CVE-2025-62319.md): Boolean-Based SQL Injection in Multiple Unica Components (CVSS 9.8)
- [CVE-2025-52642](https://cve.now/CVE-2025-52642.md): HCL AION is affected by an internal filesystem paths disloser vulnerability (CVSS 3.3)
- [CVE-2025-52646](https://cve.now/CVE-2025-52646.md): HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. (CVSS 2.2)
- [CVE-2025-52645](https://cve.now/CVE-2025-52645.md): HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. (CVSS 1.9)
- [CVE-2025-52649](https://cve.now/CVE-2025-52649.md): HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature (CVSS 1.8)
- [CVE-2025-52644](https://cve.now/CVE-2025-52644.md): HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. (CVSS 5.8)
- [CVE-2025-52643](https://cve.now/CVE-2025-52643.md): HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment (CVSS 4.7)
- [CVE-2025-52636](https://cve.now/CVE-2025-52636.md): HCL AION is affected by a improper handling of uploads files Size (CVSS 1.8)
- [CVE-2025-52648](https://cve.now/CVE-2025-52648.md): HCL AION is affected by a vulnerability where offering images are not digitally signed. (CVSS 4.8)
- [CVE-2025-52638](https://cve.now/CVE-2025-52638.md): Multiple security vulnerabilities affect HCL AION (CVSS 5.6)
- [CVE-2025-52637](https://cve.now/CVE-2025-52637.md): Multiple security vulnerabilities affect HCL AION (CVSS 4.5)
- [CVE-2026-21791](https://cve.now/CVE-2026-21791.md): HCL Sametime for Android is affected by sensitive information disclosure (CVSS 3.3)
- [CVE-2025-52631](https://cve.now/CVE-2025-52631.md): HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. (CVSS 3.7)
- [CVE-2025-52623](https://cve.now/CVE-2025-52623.md): HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability (CVSS 3.7)
- [CVE-2025-52628](https://cve.now/CVE-2025-52628.md): HCL AION is susceptible to Missing SameSite vulnerability (CVSS 4.6)
- [CVE-2025-52633](https://cve.now/CVE-2025-52633.md): HCL AION is susceptible to Missing Content-Security-Policy (CVSS 3.1)
- [CVE-2025-52629](https://cve.now/CVE-2025-52629.md): HCL AION is susceptible to Missing Content-Security-Policy (CVSS 3.7)
- [CVE-2025-52626](https://cve.now/CVE-2025-52626.md): HCL AION is susceptible to Potential Command Injection vulnerability (CVSS 4.5)
- [CVE-2025-52627](https://cve.now/CVE-2025-52627.md): HCL AION is susceptible to Incorrect Permission Assignment for Critical Resource (CVSS 5.5)
- [CVE-2025-52625](https://cve.now/CVE-2025-52625.md): HCL AION is susceptible to Cacheable SSL Page Found vulnerability (CVSS 3.7)
- [CVE-2025-52624](https://cve.now/CVE-2025-52624.md): HCL AION is susceptible to Bypass of the script allow list configuration vulnerability (CVSS 5.4)
- [CVE-2025-52635](https://cve.now/CVE-2025-52635.md): HCL AION is susceptible to Trusted types in scripts not enforced in CSP (CVSS 3.7)
- [CVE-2025-52632](https://cve.now/CVE-2025-52632.md): HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability (CVSS 6.5)
- [CVE-2025-52630](https://cve.now/CVE-2025-52630.md): HCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerability (CVSS 3.7)
- [CVE-2025-52634](https://cve.now/CVE-2025-52634.md): HCL AION is susceptible to Spring Boot Actuator Endpoints Exposed (CVSS 3.7)
- [CVE-2025-52650](https://cve.now/CVE-2025-52650.md): HCL AION is susceptible to Inline script execution allowed in CSP vulnerability (CVSS 8.2)
- [CVE-2025-52655](https://cve.now/CVE-2025-52655.md): HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability. (CVSS 3.1)
- [CVE-2025-52656](https://cve.now/CVE-2025-52656.md): HCL MyXalytics product is affected by Mass Assignment vulnerability (CVSS 7.6)
- [CVE-2025-52653](https://cve.now/CVE-2025-52653.md): Cross Site Scripting vulnerability in the web application (CVSS 7.6)
- [CVE-2020-14230](https://cve.now/CVE-2020-14230.md): HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. (no CVSS)
- [CVE-2020-14258](https://cve.now/CVE-2020-14258.md): HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. (no CVSS)
- [CVE-2020-14234](https://cve.now/CVE-2020-14234.md): HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an atta (no CVSS)
- [CVE-2020-4104](https://cve.now/CVE-2020-4104.md): HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps-\>Software module. (no CVSS)
- [CVE-2020-4089](https://cve.now/CVE-2020-4089.md): HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. (no CVSS)
- [CVE-2019-4209](https://cve.now/CVE-2019-4209.md): HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing att (no CVSS)
- [CVE-2019-4388](https://cve.now/CVE-2019-4388.md): HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript (no CVSS)
- [CVE-2019-4409](https://cve.now/CVE-2019-4409.md): HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hcl
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.