Filtered by vendor Hcltech Subscriptions
Total 399 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-55268 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 4.3 Medium
HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and processing resources which may lead to Denial of Service.
CVE-2025-55267 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 5.7 Medium
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server.
CVE-2025-55266 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 5.9 Medium
HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf of the user.
CVE-2025-55265 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 6.5 Medium
HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it to craft further attacks.
CVE-2025-55264 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 5.5 Medium
HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.
CVE-2025-55263 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 7.3 High
HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories, they can easily retrieve these hardcoded secrets.
CVE-2025-55262 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 8.3 High
HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.
CVE-2025-55261 2 Hcl, Hcltech 2 Aftermarket Dpc, Aftermarket Cloud 2026-03-27 8.1 High
HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.
CVE-2026-21790 1 Hcltech 1 Traveler 2026-03-25 6.3 Medium
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.
CVE-2025-62319 1 Hcltech 1 Unica 2026-03-24 9.8 Critical
Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.
CVE-2025-62320 1 Hcltech 1 Sametime 2026-03-24 4.7 Medium
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.
CVE-2025-52644 1 Hcltech 1 Aion 2026-03-24 5.8 Medium
HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce traceability of user activities and could potentially impact monitoring, accountability, or incident investigation processes.
CVE-2025-52646 1 Hcltech 1 Aion 2026-03-24 2.2 Low
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.
CVE-2025-52642 1 Hcltech 1 Aion 2026-03-24 3.3 Low
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal paths may reveal environment structure details which could potentially aid in further targeted attacks or information disclosure.
CVE-2024-42210 1 Hcltech 1 Unica 2026-03-23 7.6 High
A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower.  Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.
CVE-2025-62328 1 Hcltech 1 Nomad Server On Domino 2026-03-20 3.7 Low
HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to obtain sensitive information via unspecified vectors.
CVE-2026-21788 1 Hcltech 1 Connections 2026-03-20 5.4 Medium
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code.  This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
CVE-2025-62326 1 Hcltech 1 Digital Experience 2026-02-24 6.1 Medium
HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.
CVE-2025-52603 1 Hcltech 1 Connections 2026-02-23 3.5 Low
HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.
CVE-2023-37525 1 Hcltech 1 Bigfix Compliance 2026-02-12 5.3 Medium
A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.