HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
CVE-2025-62327 is a medium severity vulnerability in HCL DevOps Deploy versions 8.1 through 8.1.2.3, where users with LLM configuration privileges can recover previously saved credentials used for authenticated LLM queries. The vulnerability stems from insufficient protection of stored credentials (CWE-522). Exploitation requires privileged access but no user interaction and can lead to credential disclosure, impacting confidentiality. There are no known exploits in the wild yet. The CVSS score is 4.9, reflecting a moderate risk primarily due to the need for elevated privileges.
CVE-2025-31964 is a low-severity vulnerability in HCL BigFix IVR version 4.2 caused by improper service binding configuration. This flaw allows privileged attackers to expose administrative services externally instead of restricting them to local interfaces, potentially impacting service availability. Although it does not directly compromise confidentiality or integrity, the exposure could lead to denial-of-service conditions. Exploitation requires high privileges and no user interaction, with a low CVSS score of 2.2. No known exploits are currently reported in the wild. European organizations using BigFix IVR 4.2 should verify service bindings and restrict administrative interfaces to local networks to mitigate risk. Countries with significant HCL BigFix deployments and critical infrastructure relying on this product are more likely to be affected.
CVE-2025-31963 is a vulnerability in HCL BigFix IVR version 4.2 involving missing authentication and lack of CSRF protection in its local setup interface. This flaw allows a local attacker with high privileges to perform unauthorized configuration changes by sending unauthenticated administrative requests. The vulnerability requires local access and user interaction, with a low CVSS score of 2.9, indicating limited impact. Although the confidentiality and integrity of configuration data can be affected, availability remains intact. No known exploits are reported in the wild, and no patches have been published yet. European organizations using BigFix IVR 4.2 should be cautious, especially those with critical infrastructure relying on this product. Mitigation involves restricting local access, monitoring configuration changes, and applying vendor updates once available.
CVE-2025-31962 is a vulnerability in HCL BigFix IVR version 4.2 where insufficient session expiration in the Web UI authentication component allows authenticated attackers to maintain prolonged unauthorized access to protected API endpoints. The flaw arises from excessive session expiration periods, enabling attackers with valid credentials to extend their access beyond intended limits. Although the CVSS score is low (2.0), the issue could lead to confidentiality risks if attackers exploit prolonged sessions. No known exploits are reported in the wild, and the vulnerability requires high privileges and user interaction to exploit. European organizations using HCL BigFix IVR 4.2 should review session management policies and apply any available patches or compensating controls. Countries with significant HCL BigFix deployments and critical infrastructure relying on this product are more likely to be affected. Mitigations include reducing session timeout durations, enforcing re-authentication, and monitoring session activity closely.
Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.
The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint.
HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data.
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.
CVE-2025-31954 is a medium severity vulnerability affecting HCL Software's iAutomate versions 6.5.1 and 6.5.2. The issue arises from the use of HTTP GET requests that include sensitive information within the query string, potentially exposing confidential data. An attacker with at least limited privileges could intercept or access these URLs and gain unauthorized insight into sensitive information. Exploitation does not require user interaction but does require some level of privilege. The vulnerability impacts confidentiality and integrity but not availability. No known exploits are currently in the wild, and no patches have been released yet.