HCL Software vulnerabilities
We track 108 vulnerabilities in HCL Software products across 60+ products. 108 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest HCL Software vulnerabilities
- 8.8 High severity
BigFix ServiceNow Data Flow: Improper Control of Generation of Code
HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user.
- 9.8 Critical severity
HCL BigFix OSD Bare Metal Server WebUI: Improper Neutralization of Input During Web Page Generation
Missing or insecure tags in the HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower could allow an attacker to execute a malicious script on the user's browser.
- 7.5 High severity
DRYiCE MyXalytics: Improper Access Control
HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive informatio
- 9.8 Critical severity
DRYiCE MyXalytics: Unrestricted Upload of File with Dangerous Type
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.
- 9.8 Critical severity
DRYiCE MyXalytics: Improper Limitation of a Pathname to a Restricted Directory
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.
- 9.8 Critical severity
DRYiCE MyXalytics: Improper Limitation of a Pathname to a Restricted Directory
HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory. The product
- 9.1 Critical severity
DRYiCE MyXalytics: Use of a Broken or Risky Cryptographic Algorithm
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.
- 7.5 High severity
DRYiCE MyXalytics: Use of a Broken or Risky Cryptographic Algorithm
HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information.
- 8.8 High severity
HCL Compass: Unrestricted Upload of File with Dangerous Type
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
- 7.8 High severity
HCL AppScan Presence: Unquoted Search Path or Element
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.
- 8.2 High severity
BigFix Insights for Vulnerability Remediation: Insufficiently Protected Credentials
BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.
- 7.1 High severity
HCL DRYiCE iAutomate: Use of a Broken or Risky Cryptographic Algorithm
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
- 7.1 High severity
HCL DRYiCE MyCloud: Use of a Broken or Risky Cryptographic Algorithm
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
- 8.8 High severity
HCL Unica Platform: Improper Restriction of XML External Entity Reference
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
- 8.8 High severity
HCL BigFix WebUI API: Improper Neutralization of Special Elements used in an SQL Command
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
- 8.1 High severity
Workload Automation: Improper Restriction of XML External Entity Reference
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 8.1 High severity
Workload Automation: Improper Restriction of XML External Entity Reference
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 8.8 High severity
HCL Compass2.0: Cross-Site Request Forgery
HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request.
- 7.5 High severity
BigFix Server Automation: Missing Encryption of Sensitive Data
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their S
- 7.8 High severity
Notes: Out-of-bounds Write
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is differen
- 7.8 High severity
Domino: Out-of-bounds Write
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is differe
- 7.8 High severity
Notes: Out-of-bounds Write
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerabilit
- 7.8 High severity
Domino: Out-of-bounds Write
HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. This vulnerabili
- 7.8 High severity
Notes: Out-of-bounds Write
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is differen
- 7.8 High severity
Domino: Out-of-bounds Write
HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is differe
- 8.8 High severity
HCL Domino: Cross-Site Request Forgery
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.
- 7.5 High severity
HCL iNotes: Weak Password Requirements
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
- 7.4 High severity
HCL iNotes: URL Redirection to Untrusted Site
HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.