HCL vulnerabilities and threats

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions.

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets.

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries.

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

HCL DevOps Deploy / HCL Launch contains an information disclosure vulnerability related to improper redaction of secure property values. When a deployment uses a secure property starting with certain non-ASCII characters, the redaction engine may fail to mask ASCII secure values embedded in insecure properties, potentially exposing sensitive information.

CVE-2025-52657 is a low-severity vulnerability in HCL Software MyXalytics involving allocation of resources without limits or throttling. It allows users to input data without restrictions on the number of characters, potentially impacting system performance or availability. There is no evidence of confidentiality or integrity impact. No patch or remediation information is currently available.

CVE-2025-52652 is a content spoofing vulnerability in HCL Software MyXalytics that allows an attacker with limited privileges to manipulate displayed content, making it appear as if it originates from a trusted source. This misrepresentation could potentially facilitate phishing or data theft. The vulnerability has a low CVSS score of 3.5, indicating limited impact. No affected versions or patch information are provided.

CVE-2025-52651 is an improper input validation vulnerability in HCL Software MyXalytics. This flaw allows malicious or unexpected input to cause unintended system behavior or security issues. The vulnerability has a low severity rating with a CVSS score of 3.5. No affected versions or patches are explicitly stated in the available data.

HCL Connections versions 7.0 and 8.0 contain an information disclosure vulnerability (CWE-359) that allows unauthorized users to access sensitive information due to improper handling of request data. The vulnerability has a low severity with a CVSS score of 3.1. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

HCL IntelliOps Event Management (IEM) has a concurrency vulnerability where admin user sessions may remain active after logout or session deletion. This issue could allow sessions to persist longer than intended, potentially leading to unauthorized session reuse. The vulnerability is rated as low severity with a CVSS score of 3.1. No affected versions or patches have been specified yet.

HCL IntelliOps Event Management (IEM) has a session deletion vulnerability (CVE-2025-62342) where user sessions may not be fully terminated after logout or deletion. This insufficient session expiration could allow sessions to remain active longer than intended. The vulnerability has a CVSS score of 6.4, indicating medium severity. No patch or official remediation guidance is currently available. There are no known exploits in the wild, and affected versions have not been specified.

HCL Connections contains a server-side request forgery (SSRF) vulnerability that may allow an attacker with limited privileges and user interaction to send unauthorized requests from the server. This could lead to limited information disclosure or security bypass in certain scenarios. The vulnerability has a low CVSS score of 3.7 and no known exploits in the wild. No patch or official remediation guidance is currently available.