Vulnerabilidades de HCL Software

CVE-2025-62327 Média · 4.9 CWE-522 07/01/2026

HCL DevOps Deploy is susceptible to insufficiently protected credentials

In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.

CVE-2025-31964 Média · 4.9 CWE-200 07/01/2026

HCL BigFix IVR is impacted by an improper service binding configuration

Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.

CVE-2025-31963 Baixa · 3.3 CWE-352 07/01/2026

HCL BigFix IVR is impacted by improper authentication and missing CSRF protection

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

CVE-2025-31962 Média · 4.3 CWE-613 07/01/2026

HCL BigFix IVR is impacted by an insufficient session expiration vulnerability

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

CVE-2025-59849 Média · 6.1 CWE-693 17/12/2025

HCL BigFix Remote Control is vulnerable to an insecure CSP configuration

Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.

CVE-2025-55254 Média · 4.8 CWE-613 17/12/2025

HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)

Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.

CVE-2025-62329 Média · 5.6 CWE-613 16/12/2025

HCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerability

HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.

CVE-2025-62330 Média · 5.9 CWE-319 16/12/2025

HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information

HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.

CVE-2024-42197 Média · 5.5 CWE-256 11/12/2025

HCL Workload Scheduler is vulnerable to plain text storage of a password

HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.

CVE-2025-0248 Alta · 8.1 CWE-20 25/11/2025

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

CVE-2025-62346 Média · 6.8 CWE-352 20/11/2025

HCL Glovius Cloud is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint.

CVE-2025-52639 Média · 6.5 CWE-201 18/11/2025

HCL Connections is vulnerable to sensitive information disclosure

HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data.

CVE-2025-55278 Alta · 8.1 CWE-347 05/11/2025

HCL DevOps Loop is susceptible to an improper authentication vulnerability

Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.

CVE-2025-31954 Média · 4.3 CWE-598 05/11/2025

HCL iAutomate is susceptible to a sensitive information disclosure

HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or resources they were not intended to see.

CVE-2025-52602 Média · 4.2 CWE-359 05/11/2025

HCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query application

HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs). An attacker can use that information to target individuals with phishing or other social-engineering attacks.

CVE-2024-42192 Média · 5.5 CWE-522 16/10/2025

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.

CVE-2025-0277 Média · 6.1 CWE-79 16/10/2025

HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)

HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

CVE-2025-0276 Média · 6.1 CWE-79 16/10/2025

HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)

HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

CVE-2025-0275 Média · 4.3 CWE-306 16/10/2025

HCL BigFix Mobile 3.3 and earlier is affected by improper access control

HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.

CVE-2025-0274 Média · 4.3 CWE-306 16/10/2025

HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control

HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.

CVE-2025-31995 Baixa · 3.5 CWE-20 13/10/2025

HCL Unica MaxAI Workbench is vulnerable to improper input validation

HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.

CVE-2025-31996 Alta · 7.5 CWE-552 13/10/2025

Unprotected files are impacting HCL Unica Platform

HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.

CVE-2025-31994 Média · 4.3 CWE-79 13/10/2025

HCL Unica Campaign is vulnerable to Reflected Cross-Site Scripting (XSS)

HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then reflected unsafely in the server's immediate response to the victim's browser, executing the script as if it originated from the trusted website.

CVE-2025-52615 Média · 5.3 CWE-693 12/10/2025

HCL Unica Platform is impacted by misconfigured security related HTTP headers

HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.

CVE-2025-52614 Média · 4.3 CWE-614 12/10/2025

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.