Filtered by vendor Hcltech
Subscribe
Total
473 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-0276 | 1 Hcltech | 2 Bigfix Mobile, Bigfix Modern Client Management | 2026-10-08 | N/A | 6.5 MEDIUM |
| HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content. | |||||
| CVE-2025-0275 | 1 Hcltech | 2 Bigfix Mobile, Bigfix Modern Client Management | 2026-10-08 | N/A | 5.3 MEDIUM |
| HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions. | |||||
| CVE-2025-31958 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. | |||||
| CVE-2025-31991 | 1 Hcltech | 1 Devops Velocity | 2026-10-07 | N/A | 6.8 MEDIUM |
| Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7. | |||||
| CVE-2025-31981 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 5.3 MEDIUM |
| HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data. | |||||
| CVE-2025-31983 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information. | |||||
| CVE-2025-31984 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly. | |||||
| CVE-2025-59851 | 1 Hcltech | 1 Dfxanalytics | 2026-10-07 | N/A | 3.7 LOW |
| HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which could allow an attacker to identify and exploit publicly known security vulnerabilities to gain unauthorized access or compromise the application. | |||||
| CVE-2025-31976 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 4.8 MEDIUM |
| HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. . | |||||
| CVE-2025-31978 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 4.6 MEDIUM |
| HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content. | |||||
| CVE-2025-31959 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.5 LOW |
| HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. . | |||||
| CVE-2025-59852 | 1 Hcltech | 1 Dfxanalytics | 2026-10-07 | N/A | 3.7 LOW |
| HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which could allow an attacker to compromise the confidentiality, integrity, and authentication of sensitive information. | |||||
| CVE-2025-59854 | 1 Hcltech | 1 Dfxanalytics | 2026-10-07 | N/A | 3.1 LOW |
| HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, which could allow an attacker to exploit browser-specific rendering flaws or bypass security controls that should instead be managed by a robust Content Security Policy (CSP). | |||||
| CVE-2025-31964 | 1 Hcltech | 1 Bigfix Insights For Vulnerability Remediation | 2026-10-07 | N/A | 2.2 LOW |
| Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface. | |||||
| CVE-2025-31974 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.9 LOW |
| HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes. | |||||
| CVE-2025-52641 | 1 Hcltech | 1 Aion | 2026-10-07 | N/A | 2.9 LOW |
| HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information disclosure. | |||||
| CVE-2025-31975 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 2.6 LOW |
| HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities. | |||||
| CVE-2025-31963 | 1 Hcltech | 1 Bigfix Insights For Vulnerability Remediation | 2026-10-07 | N/A | 2.9 LOW |
| Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests. | |||||
| CVE-2025-31982 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality. | |||||
| CVE-2025-31957 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 2.6 LOW |
| HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data. | |||||