HCL Software iControl vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting HCL Software iControl: 6 record(s), with affected versions and fixes.

CVE-2026-66253 Low · 3.1 CWE-613 Oct 1, 2026

HCL iControl is affected by a Session Timeout vulnerability

iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim.

CVE-2026-66249 Low · 3.1 CWE-614 Oct 1, 2026

HCL iControl is affected by a Missing Secure Attribute vulnerability

iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers.

CVE-2026-66248 Low · 3.1 CWE-209 Oct 1, 2026

HCL iControl is affected by an Improper Error Handling vulnerability

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks.

CVE-2026-66247 Medium · 4.3 CWE-942 Oct 1, 2026

Permissive Cross-domain Policy in HCL Software iControl

iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active session.

CVE-2026-66246 High · 8.8 CWE-250 Oct 1, 2026

HCL iControl is affected by multiple security vulnerabilities

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

CVE-2025-62340 Medium · 5.3 CWE-613 Jun 17, 2026

HCL iControl was affected by Inadequate Session Timeout vulnerability

HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity