VYPR
← All vendors
Vendor

Hcl Software

Products
13
CVEs
49
Across products
49
Status
Private

Products

13

Recent CVEs

49
CVESevRiskCVSSEPSSKEVPublishedDescription
CVE-2026-217860.00—0.00Mar 5, 2026HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.
CVE-2023-375250.00—0.00Jan 28, 2026A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.
CVE-2025-552540.00—0.00Dec 17, 2025Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.
CVE-2025-598490.00—0.00Dec 17, 2025Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
CVE-2024-301420.00—0.00Nov 7, 2024HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.
CVE-2024-301410.00—0.00Nov 7, 2024HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement information or expose information about its environment, users, or associated data.
CVE-2024-301400.00—0.00Nov 7, 2024HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the web cache and provide back to users being served the page.
CVE-2024-301170.00—0.00Oct 14, 2024A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.
CVE-2024-301260.00—0.01Jul 18, 2024HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target website in a frame or iframe, tricking users into performing actions on the target website without their knowledge.
CVE-2024-301250.00—0.00Jul 18, 2024HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.
CVE-2024-235560.00—0.00May 17, 2024SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.
CVE-2024-235540.00—0.01May 17, 2024Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).
CVE-2024-235830.00—0.00May 17, 2024An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.
CVE-2023-457150.00—0.00Mar 28, 2024The console may experience a service interruption when processing file names with invalid characters.
CVE-2023-457060.00—0.00Mar 28, 2024An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.
CVE-2023-457050.00—0.00Mar 28, 2024An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.
CVE-2023-375400.00—0.00Feb 23, 2024Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data.
CVE-2023-375280.00—0.00Feb 3, 2024A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.
CVE-2024-235530.00—0.00Feb 2, 2024A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.
CVE-2023-375310.00—0.01Feb 2, 2024A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access.