CVE Intelligence

Hcltech vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Hcltech products: 187 record(s), with severity, exploitation and fixes.

Bigfix Service Management 34Aion 29Aftermarket Cloud 17Dfxanalytics 14Icontrol 13Unica 12Dryice Mycloud 7Devops Plan 5Connections 5Dryice Myxalytics 4Intelliops Event Management 4Devops Loop 4Dfx Server 4Traveler For Microsoft Outlook 4Bigfix Platform 4Digital Experience 4Bigfix Modern Client Management 4Bigfix Mobile 4Sametime 3Bigfix Insights For Vulnerability Remediation 3Digital Experience Compose 3Unica Centralized Offer Management 3Dragon 2Bigfix Webui Take Action 2Bigfix Webui Software Distribution 2Bigfix Webui Scm 2Bigfix Webui Reports 2Bigfix Webui Query 2Bigfix Webui Profile Management 2Bigfix Webui Permissions And Preferences 2Bigfix Webui Patch Policies 2Bigfix Webui Patch 2Bigfix Webui Mdm 2Bigfix Webui Ivr 2Bigfix Webui Insights 2Bigfix Webui Framework 2Bigfix Webui Data Sync 2Bigfix Webui Custom 2Bigfix Webui Content App 2Bigfix Webui Common 2

Exploited only (KEV) →

CVE-2025-52625 High · 7.5 CWE-525 Oct 10, 2025
HCL AION is susceptible to Cacheable SSL Page Found vulnerability
A vulnerability  Cacheable SSL Page Found vulnerability has been identified in HCL AION.  Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0.
CVE-2025-52624 Medium · 6.1 CWE-79 Oct 10, 2025
HCL AION is susceptible to Bypass of the script allow list configuration vulnerability
A vulnerability  Bypass of the script allowlist configuration in HCL AION.  An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.
CVE-2025-52650 Medium · 6.1 CWE-1032 Oct 10, 2025
HCL AION is susceptible to Inline script execution allowed in CSP vulnerability
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
CVE-2025-52634 High · 7.5 CWE-200 Oct 10, 2025
HCL AION is susceptible to Spring Boot Actuator Endpoints Exposed
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.
CVE-2025-52632 High · 7.5 CWE-614 Oct 10, 2025
HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
CVE-2025-52630 High · 7.5 CWE-200 Oct 10, 2025
HCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.
CVE-2025-52658 Medium · 4.8 CWE-1104 Oct 3, 2025
HCL MyXalytics is affected by the use of vulnerable/outdated versions
HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
CVE-2025-52656 High · 7.6 CWE-915 Oct 3, 2025
HCL MyXalytics product is affected by Mass Assignment vulnerability
HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.
CVE-2025-52654 Medium · 4.6 CWE-80 Oct 3, 2025
HCL MyXalytics is affected by an HTML Injection
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
CVE-2025-52653 Medium · 5.4 CWE-79 Oct 3, 2025
Cross Site Scripting vulnerability in the web application
HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access.
CVE-2022-27545 Medium · 5.4 CWE-79 Jul 19, 2022
HCL BigFix Web Reports authorized users may perform HTML injection.
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
CVE-2022-27544 Medium · 6.5 CWE-522 Jul 19, 2022
HCL BigFix Web Reports authorized users may see sensitive information in clear text
BigFix Web Reports authorized users may see SMTP credentials in clear text.