Vulnerabilidades de HCL

CVE-2025-62320 Média · 6.1 CWE-79 17/03/2026

HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

CVE-2025-31966 Baixa · 2.7 CWE-20 17/03/2026

Boolean-Based SQL Injection in Multiple Unica Components

HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.

CVE-2025-62319 Crítica · 9.8 CWE-89 16/03/2026

Boolean-Based SQL Injection in Multiple Unica Components

Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.

CVE-2025-52649 Média · 5.3 CWE-200 16/03/2026

HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature

HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess system-generated values, potentially leading to limited information disclosure or unintended access under specific conditions.

CVE-2025-52646 Média · 5.3 CWE-89 16/03/2026

HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.

HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.

CVE-2025-52645 Média · 5.3 CWE-345 16/03/2026

HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.

HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow the possibility of unverified or modified model artifacts being used, potentially leading to integrity concerns or unintended behaviour.

CVE-2025-52644 Alta · 8.2 CWE-778 16/03/2026

HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged.

HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce traceability of user activities and could potentially impact monitoring, accountability, or incident investigation processes.

CVE-2025-52643 Alta · 7.8 CWE-693 16/03/2026

HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment

HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expose the application to potential security risks, including unintended behaviour or integrity impact when processing specially crafted files.

CVE-2025-52642 Média · 6.5 CWE-538 16/03/2026

HCL AION is affected by an internal filesystem paths disloser vulnerability

HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal paths may reveal environment structure details which could potentially aid in further targeted attacks or information disclosure.

CVE-2025-52636 Alta · 7.5 CWE-400 16/03/2026

HCL AION is affected by a improper handling of uploads files Size

HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resource consumption, which could potentially lead to service degradation or denial-of-service conditions under certain scenarios.

CVE-2025-52648 Crítica · 9.8 CWE-347 16/03/2026

Improper Verification of Cryptographic Signature em HCL Aion

HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the system

CVE-2025-52638 Alta · 7.2 CWE-345 16/03/2026

Multiple security vulnerabilities affect HCL AION

HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configurations with security best practices requires minimizing privileges and avoiding root-level execution wherever possible.

CVE-2025-52637 Alta · 7.3 CWE-89 16/03/2026

Multiple security vulnerabilities affect HCL AION

HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.

CVE-2026-21791 Baixa · 3.3 CWE-532 10/03/2026

HCL Sametime for Android is affected by sensitive information disclosure

HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL

CVE-2025-52633 Média · 5.3 CWE-539 03/02/2026

HCL AION is susceptible to Missing Content-Security-Policy

HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. This issue affects AION: 2.0.

CVE-2025-52631 Alta · 8.1 CWE-200 03/02/2026

HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability.

HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.. This issue affects AION: 2.0.

CVE-2025-52628 Alta · 8.8 CWE-1275 03/02/2026

HCL AION is susceptible to Missing SameSite vulnerability

HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.

CVE-2025-52623 Média · 6.5 CWE-522 03/02/2026

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.

CVE-2025-52629 Média · 6.1 CWE-1032 03/02/2026

HCL AION is susceptible to Missing Content-Security-Policy

HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.

CVE-2025-52627 Alta · 7.5 CWE-732 03/02/2026

HCL AION is susceptible to Incorrect Permission Assignment for Critical Resource

Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0.

CVE-2025-52626 Crítica · 9.8 CWE-78 03/02/2026

Injeção de comando em HCL AION (CWE-78)

Uma potencial vulnerabilidade de injeção de comando em HCL AION. Um Isto pode permitir execução de comando não intencional, potencialmente levando a ações não autorizadas no sistema subjacente.Este problema afeta AION: 2.0

CVE-2025-52635 Crítica · 9.8 CWE-1032 10/10/2025

HCL AION is susceptible to Trusted types in scripts not enforced in CSP

A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.

CVE-2025-52625 Alta · 7.5 CWE-525 10/10/2025

HCL AION is susceptible to Cacheable SSL Page Found vulnerability

A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0.

CVE-2025-52624 Média · 6.1 CWE-79 10/10/2025

HCL AION is susceptible to Bypass of the script allow list configuration vulnerability

A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.

CVE-2025-52650 Média · 6.1 CWE-1032 10/10/2025

HCL AION is susceptible to Inline script execution allowed in CSP vulnerability

Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0