HCL Software vulnerabilities
We track 108 vulnerabilities in HCL Software products across 60+ products. 108 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest HCL Software vulnerabilities
- 9.8 Critical severity
MyXalytics: Reusing a Nonce, Key Pair in Encryption
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
- 8.1 High severity
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by…
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security
- 8.1 High severity
DevOps Loop: Improper Verification of Cryptographic Signature
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tam
- 7.5 High severity
Unica Platform: Files or Directories Accessible to External Parties
HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.
- 7.5 High severity
Unica: Exposure of Sensitive System Information to an Unauthorized Control Sphere
HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.
- 9.8 Critical severity
Unica Centralized Offer Management: Generation of Error Message Containing Sensitive Information
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denia
- 7.5 High severity
Unica Centralized Offer Management: Authorization Bypass Through User-Controlled Key
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.
- 9.8 Critical severity
Unica Centralized Offer Management: Server-Side Request Forgery
HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.
- 7.6 High severity
HCL MyXalytics: Improperly Controlled Modification of Dynamically-Determined Object Attributes
HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fi
- 7.5 High severity
BigFix SaaS Remediate: Origin Validation Error
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache p
- 9.8 Critical severity
BigFix SaaS Remediate: Improper Neutralization of Special Elements used in an SQL Command
HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries.
- 8.2 High severity
BigFix Remote Control: Authentication Bypass by Primary Weakness
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
- 7.1 High severity
HCL iAutomate is affected by an insufficient session expiration.
HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.
- 9.8 Critical severity
HCL Traveler for Microsoft Outlook (HTMO): Uncontrolled Search Path Element
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- 9.8 Critical severity
HCL Traveler for Microsoft Outlook (HTMO): Uncontrolled Search Path Element
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- 9.8 Critical severity
HCL SX: Use of a Broken or Risky Cryptographic Algorithm
HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify data, or other impacts.
- 7.5 High severity
HCL MyXalytics: Missing Authentication for Critical Functionality
HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential information, creating a risk of misuse, manipulation, or unauthorized distribution.
- 8.1 High severity
HCL BigFix Platform: Improper Certificate Validation
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability could
- 7.6 High severity
HCL DevOps Deploy / HCL Launch: Improper Neutralization of Input During Web Page Generation
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
- 7.5 High severity
HCL DevOps Deploy / HCL Launch: Missing Authentication for Critical Functionality
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.
- 7.2 High severity
HCL DevOps Deploy / HCL Launch: Improper Neutralization of Special Elements used in an OS Command
HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.
- 8.0 High severity
HCL MyXalytics: Improper Restriction of Excessive Authentication Attempts
HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive infor
- 9.1 Critical severity
MyCloud: Server-Side Request Forgery
HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated use
- 7.5 High severity
DRYiCE MyXalytics: Cleartext Transmission of Sensitive Information
HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- 9.8 Critical severity
DRYiCE MyXalytics: Unrestricted Upload of File with Dangerous Type
HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious file
- 9.8 Critical severity
HCL MyXalytics is affected by a weak input validation vulnerability.
HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can lead to security vulnerabilities like SQL injection, XSS, and buffer overflow.
- 9.8 Critical severity
DRYiCE MyXalytics: Insufficiently Protected Credentials
HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software b
- 8.1 High severity
DRYiCE MyXalytics: Authorization Bypass Through User-Controlled Key
HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.
- 9.4 Critical severity
DRYiCE MyXalytics: Server-Side Request Forgery
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.
- 7.5 High severity
Nomad server on Domino: Insecure Storage of Sensitive Information
HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.
- 7.5 High severity
HCL Nomad is susceptible to an insufficient session expiration vulnerability.
HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old session information.
- 7.5 High severity
Nomad server on Domino: Use of Web Browser Cache Containing Sensitive Information
HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.
- 7.5 High severity
Domino Server: Exposure of Sensitive Information to an Unauthorized Actor
A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vulnerability to obtain information to launch further attacks against the affected system.
- 7.5 High severity
DRYiCE AEX: Missing Immutable Root of Trust in Hardware
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, compromising security an
- 9.8 Critical severity
HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular…
HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system which can cause the system to behave in unexpected ways.
- 7.1 High severity
Commerce: Improper Authorization
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
- 9.8 Critical severity
DRYiCE MyXalytics: Improper Neutralization of Special Elements used in an SQL Command
HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malicious user can run arbitrary SQL commands including changing system configuration.
- 7.5 High severity
HCL Sametime: Use of Cache Containing Sensitive Information
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
- 7.5 High severity
HCL Sametime: Session Fixation
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.
- 8.8 High severity
HCL Sametime: Cross-Site Request Forgery
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.