CVE-2025-62326

HCL Digital Experience is susceptible to stored cross-site scripting (XSS)

HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Digital Experience

CVE-2025-52603

HCL Connections is vulnerable to information disclosure

HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Connections

CVE-2023-37525

HCL BigFix Compliance is vulnerable to a sensitive information disclosure

A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Compliance

CVE-2025-62327

HCL DevOps Deploy is susceptible to insufficiently protected credentials

In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech Hcltechsw

Products

Devops Deploy Hcl Devops Deploy

CVE-2025-59870

Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Myxalytics

CVE-2025-31963

HCL BigFix IVR is impacted by improper authentication and missing CSRF protection

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Insights For Vulnerability Remediation

CVE-2025-31964

HCL BigFix IVR is impacted by an improper service binding configuration

Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Insights For Vulnerability Remediation

CVE-2025-31962

HCL BigFix IVR is impacted by an insufficient session expiration vulnerability

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Insights For Vulnerability Remediation

CVE-2023-37540

HCL Sametime Chat is affected by an unimplemented feature in the UI

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Sametime

CVE-2024-30150

An unauthenticated privilege escalation vulnerability affects HCL MyCloud

HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dryice Mycloud

CVE-2024-23556

HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiation

SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Platform

CVE-2024-23554

HCL BigFix Platform is susceptible to Cross-Site Request Forgery

Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Platform

CVE-2024-23583

HCL BigFix Platform is susceptible to insufficiently protected credentials

An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech Microsoft

Products

Bigfix Platform Windows

CVE-2024-30124

HCL Sametime is impacted by insecure services

HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Sametime

CVE-2023-45706

HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack

An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Platform

CVE-2023-45715

HCL BigFix Platform is susceptible to a Denial of Service attack

The console may experience a service interruption when processing file names with invalid characters.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Platform

CVE-2024-30149

HCL AppScan Source is affected by an expired TLS/SSL certificate

HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Appscan Source

CVE-2025-62329

HCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerability

HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech Hcltechsw

Products

Devops Deploy Hcl Devops Deploy Hcl Launch

CVE-2025-62330

HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information

HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech Hcltechsw

Products

Devops Deploy Hcl Devops Deploy

CVE-2025-55254

HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)

Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech Hcltechsw

Products

Bigfix Remote Control Hcl Devops Deploy Hcl Launch