Vulnerabilidades de Hcltech

CVEs publicadas que afetam produtos de Hcltech: 187 registro(s), com severidade, exploração e correções.

Bigfix Service Management 34 Aion 29 Aftermarket Cloud 17 Dfxanalytics 14 Icontrol 13 Unica 12 Dryice Mycloud 7 Devops Plan 5 Connections 5 Dryice Myxalytics 4 Intelliops Event Management 4 Devops Loop 4 Dfx Server 4 Traveler For Microsoft Outlook 4 Bigfix Platform 4 Digital Experience 4 Bigfix Modern Client Management 4 Bigfix Mobile 4 Sametime 3 Bigfix Insights For Vulnerability Remediation 3 Digital Experience Compose 3 Unica Centralized Offer Management 3 Dragon 2 Bigfix Webui Take Action 2 Bigfix Webui Software Distribution 2 Bigfix Webui Scm 2 Bigfix Webui Reports 2 Bigfix Webui Query 2 Bigfix Webui Profile Management 2 Bigfix Webui Permissions And Preferences 2 Bigfix Webui Patch Policies 2 Bigfix Webui Patch 2 Bigfix Webui Mdm 2 Bigfix Webui Ivr 2 Bigfix Webui Insights 2 Bigfix Webui Framework 2 Bigfix Webui Data Sync 2 Bigfix Webui Custom 2 Bigfix Webui Content App 2 Bigfix Webui Common 2

Somente exploradas (KEV) →

CVE-2026-35142 Alta · 8.2 CWE-200 16/07/2026

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability.

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.

CVE-2026-35141 Média · 5.3 CWE-294 16/07/2026

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.

CVE-2026-35140 Alta · 7.2 CWE-200 16/07/2026

HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability

HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.

CVE-2026-35149 Alta · 8.2 CWE-294 16/07/2026

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

CVE-2026-35148 Média · 6.3 CWE-284 16/07/2026

HCL DFXServer is affected by a Missing Access Control vulnerability

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.

CVE-2026-35147 Alta · 8.2 CWE-639 16/07/2026

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

CVE-2026-35146 Média · 6.3 CWE-326 16/07/2026

HCL DFXServer is affected by an Unencrypted Communication vulnerability.

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.

CVE-2025-59868 Média · 5.5 CWE-532 26/06/2026

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.

CVE-2023-37524 Alta · 7.8 CWE-1104 26/06/2026

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components.

CVE-2024-23581 Alta · 7.8 CWE-347 26/06/2026

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability

The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.

CVE-2025-62340 Média · 5.3 CWE-613 17/06/2026

HCL iControl was affected by Inadequate Session Timeout vulnerability

HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity

CVE-2025-59872 Crítica · 9.8 CWE-434 17/06/2026

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code

CVE-2026-4096 Média · 6.1 CWE-644 11/06/2026

A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.

IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking

CVE-2026-21837 Alta · 8.8 CWE-78 05/06/2026

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

CVE-2026-21826 Média · 6.1 CWE-601 05/06/2026

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.

CVE-2026-21825 Média · 6.1 CWE-79 05/06/2026

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary JavaScript in the victim's browser.

CVE-2025-52612 Alta · 8.8 CWE-1236 04/06/2026

HCL iControl was affected by Export CSV - CSV Injection vulnerability.

HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .

CVE-2025-52611 Média · 4.3 CWE-209 04/06/2026

HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability

HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object.

CVE-2025-52609 Média · 5.3 CWE-693 04/06/2026

HCL iControl was affected by Missing Security Headers vulnerability.

HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.

CVE-2025-52608 Média · 4.3 CWE-614 04/06/2026

HCL iControl was affected by Missing Cookie Attributes vulnerability.

HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.

CVE-2025-52606 Média · 4.3 CWE-209 04/06/2026

HCL iControl was affected by Weak Input Validation vulnerability. .

HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

CVE-2025-31985 Média · 6.5 CWE-200 20/05/2026

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.

CVE-2025-31973 Crítica · 9.8 20/05/2026

HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'

HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment.

CVE-2025-15634 Média · 4.3 CWE-862 09/05/2026

HCL BigFix WebUI is affected by a missing authorization vulnerability

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

CVE-2025-15633 Média · 6.5 CWE-863 09/05/2026

HCL BigFix WebUI is affected by an improper authorization vulnerability

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.