HCL Software vulnerabilities
We track 108 vulnerabilities in HCL Software products across 60+ products. 108 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest HCL Software vulnerabilities
- 9.1 Critical severity
BigFix AEX: Improper Neutralization of Special Elements used in an OS Command
HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.
- 8.6 High severity
BigFix AEX: Improper Neutralization of Input During Web Page Generation
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to infor
- 7.4 High severity
HCL BigFix Service Management: Cleartext Transmission of Sensitive Information
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and poten
- 7.2 High severity
HCL BigFix Service Management: Improper Neutralization of Input During Web Page Generation
HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hija
- 8.8 High severity
iControl: Execution with Unnecessary Privileges
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of se
- 9.8 Critical severity
HCL BigFix Service Management is affected by an Administrative Session Concurrency…
HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or
- 9.8 Critical severity
HCL BigFix Service Management: Improper Restriction of Excessive Authentication Attempts
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulti
- 9.8 Critical severity
HCL BigFix Service Management: Unrestricted Upload of File with Dangerous Type
HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.
- 8.1 High severity
HCL BigFix Service Management: Improper Authorization
HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.
- 9.8 Critical severity
HCL BigFix Service Management: Improper Neutralization of Special Elements used in an SQL Command
HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request va
- 9.1 Critical severity
Aftermarket EPC: Inadequate Encryption Strength
HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes ch
- 7.5 High severity
DFXAnalytics: Stack-based Buffer Overflow
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which c
- 7.5 High severity
DFXAnalytics: Use of a Broken or Risky Cryptographic Algorithm
HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the applicati
- 9.8 Critical severity
DFXAnalytics: Authentication Bypass by Capture-replay
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authent
- 8.2 High severity
DFXAnalytics: Exposure of Sensitive Information to an Unauthorized Actor
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information an
- 7.2 High severity
DFXAnalytics: Exposure of Sensitive Information to an Unauthorized Actor
HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept
- 8.2 High severity
DFXServer: Authentication Bypass by Capture-replay
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain
- 8.2 High severity
DFXServer: Authorization Bypass Through User-Controlled Key
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and
- 9.8 Critical severity
ZIE: Unrestricted Upload of File with Dangerous Type
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbit
- 8.8 High severity
Digital Experience: Improper Neutralization of Special Elements used in an OS Command
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibl
- 7.2 High severity
BigFix Service Management (SM): Initialization of a Resource with an Insecure Default
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintended modifications to critical system components, potentially increasing the risk of system compromise o
- 8.3 High severity
BigFix Service Management (SM): Insertion of Sensitive Information into Log File
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sen
- 8.8 High severity
BigFix Service Management (SM): Exposure of Sensitive Information to an Unauthorized Actor
HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unautho
- 7.5 High severity
BigFix Service Management (SM): Insufficiently Protected Credentials
HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. .
- 8.2 High severity
BigFix Service Management (SM): Inconsistent Interpretation of HTTP Requests
HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsin
- 9.8 Critical severity
Velocity: Improper Restriction of Excessive Authentication Attempts
Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.
- 7.5 High severity
Aftermarket DPC: Use of Hard-coded Credentials
HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories, they can easily retrieve these hardcoded secrets.
- 7.5 High severity
Aftermarket DPC: Improper Neutralization of Special Elements used in an SQL Command
HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.
- 9.8 Critical severity
Aftermarket DPC: Improper Access Control
HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.
- 8.1 High severity
HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an…
HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijack or impersonate an admin user.
- 8.8 High severity
Aftermarket DPC: Improper Neutralization of CRLF Sequences in HTTP Headers
HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker may be able to execute arbitrary commands or inject harmful content into the response..
- 9.8 Critical severity
HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to…
HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks such as XSS, SQL Injection, Command Injection etc.
- 9.8 Critical severity
Aftermarket DPC: Weak Password Requirements
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force techniques to gain unauthorized access to user accounts.
- 9.8 Critical severity
Aftermarket DPC: Unrestricted Upload of File with Dangerous Type
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server.
- 7.5 High severity
Aftermarket DPC: Exposure of Sensitive Information to an Unauthorized Actor
HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it to craft further attacks.
- 9.8 Critical severity
Unica: Improper Neutralization of Special Elements used in an SQL Command
Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds
- 9.8 Critical severity
AION: Weak Password Requirements
HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access
- 9.8 Critical severity
AION: Unrestricted Upload of File with Dangerous Type
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
- 9.8 Critical severity
AION: Improper Neutralization of HTTP Headers for Scripting Syntax
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
- 7.5 High severity
AION: Use of Web Browser Cache Containing Sensitive Information
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.