HCL vulnerabilities and threats

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS).  Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects HCL Notes: Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1.

HCL BigFix Platform has a user enumeration vulnerability due to observable timing discrepancies. An attacker could potentially infer valid usernames by analyzing response times from the BigFix service. The vulnerability is classified as CWE-208 and has a low severity rating with a CVSS score of 3.1. No specific affected versions or patches are currently identified.

HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure.  The application stores potentially sensitive information in log files that could be read by a local user.

HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with access to the logs to potentially obtain sensitive values related to that step.

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.

The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.

HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.

The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious content to be executed in certain situations.

HCL ZIE for Web version 16.0 is affected by an unrestricted file upload vulnerability. If the server is configured to execute uploaded code within the webroot, an attacker may upload a web shell to execute arbitrary code or operating system commands. The vulnerability relates to CWE-209, indicating error messages may contain sensitive information. The CVSS score is 4.3, indicating medium severity. No official patch or remediation guidance is currently available.

HCL Software iControl version 4.2.0 is affected by an insufficient session expiration vulnerability (CWE-613). This issue occurs when the web application does not automatically terminate user sessions after a period of inactivity, potentially allowing sessions to remain active longer than intended. The vulnerability has a low severity rating with a CVSS score of 3.1. No official patch or remediation guidance has been provided by the vendor at this time.

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

CVE-2025-62338 is a low-severity vulnerability in HCL BigFix Cloud Lifecycle Management versions 10.9.1 and 10.9.2. It involves a lack of input validation that allows unauthorized actors to access sensitive information. The vulnerability does not require user interaction and has low complexity for an attacker with limited privileges. No known exploits are reported in the wild. The impact is limited to confidentiality with no integrity or availability effects.