Filtered by vendor Hcltech Subscriptions
Total 399 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-31992 1 Hcltech 1 Maxai Assistant 2026-04-15 4.6 Medium
HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the context of the user's session.
CVE-2025-31995 1 Hcltech 1 Maxai Workbench 2026-04-15 3.5 Low
HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.
CVE-2025-55278 1 Hcltech 1 Devops Loop 2026-04-15 8.1 High
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.
CVE-2025-31994 1 Hcltech 1 Unica 2026-04-15 4.3 Medium
HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then reflected unsafely in the server's immediate response to the victim's browser, executing the script as if it originated from the trusted website.
CVE-2024-42197 1 Hcltech 1 Workload Scheduler 2026-04-15 5.5 Medium
HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.
CVE-2025-0248 1 Hcltech 1 Hcl Inotes 2026-04-15 8.1 High
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
CVE-2025-31966 1 Hcltech 1 Sametime 2026-04-02 2.7 Low
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.
CVE-2026-21783 1 Hcltech 1 Traveler 2026-04-02 4.3 Medium
HCL Traveler is affected by sensitive information disclosure.  The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.  Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.
CVE-2025-52637 2 Hcl, Hcltech 2 Aion, Aion 2026-03-30 4.5 Medium
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.
CVE-2025-52638 2 Hcl, Hcltech 2 Aion, Aion 2026-03-30 5.6 Medium
HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configurations with security best practices requires minimizing privileges and avoiding root-level execution wherever possible.
CVE-2025-52648 2 Hcl, Hcltech 2 Aion, Aion 2026-03-30 4.8 Medium
HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the system
CVE-2025-55277 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 2.6 Low
HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits available across the internet and craft attacks against the application.
CVE-2025-55276 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 3.1 Low
HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout.
CVE-2025-55275 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 3.7 Low
HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijack or impersonate an admin user.
CVE-2025-55274 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 2.6 Low
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to attackers, unauthorized access to APIs, and possible data manipulation or leakage. If an attacker to exploit CORS misconfiguration, they could steal sensitive data, perform actions on behalf of a legitimate user.
CVE-2025-55273 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 4.3 Medium
HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability where an attacker using external scripts can tamper with the DOM, altering the content or behavior of the application. Malicious scripts can steal cookies or session tokens, leading to session hijacking.
CVE-2025-55272 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 3.1 Low
HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version details which would allow them to craft software specific attacks.
CVE-2025-55271 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 3.1 Low
HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker may be able to execute arbitrary commands or inject harmful content into the response..
CVE-2025-55270 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 3.5 Low
HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks such as XSS, SQL Injection, Command Injection etc.
CVE-2025-55269 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 4.2 Medium
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force techniques to gain unauthorized access to user accounts.