Threat database

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.

The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.

HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.

The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious content to be executed in certain situations.

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

CVE-2025-62338 is a low-severity vulnerability in HCL BigFix Cloud Lifecycle Management versions 10.9.1 and 10.9.2. It involves a lack of input validation that allows unauthorized actors to access sensitive information. The vulnerability does not require user interaction and has low complexity for an attacker with limited privileges. No known exploits are reported in the wild. The impact is limited to confidentiality with no integrity or availability effects.

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

CVE-2026-21836 is a Broken Access Control vulnerability in the HCL DominoIQ RAG feature. Under certain conditions, document-level access restrictions may be bypassed when processing AI queries, potentially allowing authenticated users to access sensitive data they should not see. The vulnerability affects version 14.5.1 of DominoIQ. The CVSS score is 6.5, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.

HCL BigFix SCM Reporting version 11.0.5 uses an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x is end-of-life and no longer receives security updates, this exposes the application to known security weaknesses. This increases the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components. The vulnerability is tracked as CVE-2026-21821 with a high severity score of 8.3. No official patch or remediation guidance is currently available from the vendor.

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.  An attacker with access to the network traffic can sniff packets from the connection and uncover the data.

HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

CVE-2025-31991 is a vulnerability in HCLSoftware Velocity where rate limiting on user login attempts is not properly enforced. This allows an attacker with high privileges to perform brute-force attacks beyond the intended unsuccessful login attempt limits. The issue is fixed in version 5.1.7. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

CVE-2026-21767 is a medium severity vulnerability in HCL BigFix Platform versions 11.0.0 through 11.0.5. It involves insufficient authentication, potentially allowing unauthorized users to access sensitive areas of the application without proper authentication. The vulnerability has a CVSS v3.1 base score of 4.0, indicating limited impact primarily on confidentiality. There are no known exploits in the wild and no official patch or remediation information is currently available.

CVE-2026-21765 is a vulnerability in HCL BigFix Platform versions 11.0.0 through 11.0.5 where private cryptographic keys on Windows hosts have overly permissive file system permissions. This incorrect permission assignment could allow unauthorized users with local access to read or modify these critical keys. The vulnerability has a high severity with a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.