HCL

HCL BigFix is affected by multiple security flaws, including RCE, SQL injection, XSS, SSRF, and privilege escalation, which could allow an unauthenticated attacker to compromise the integrity and confidentiality of the platform.

HCL BigFix Mobile is affected by multiple security flaws, including cross-site scripting (XSS), information disclosure, and security restriction bypasses, enabling attackers to compromise user sessions and access unauthorized data.

A remote, anonymous attacker can exploit a vulnerability in HCL BigFix to manipulate data and conduct a cross-site scripting attack.

A remote, authenticated attacker can exploit multiple vulnerabilities in HCL BigFix WebUI applications to disclose sensitive information.

Multiple vulnerabilities in HCL BigFix could allow an attacker to disclose information, execute arbitrary code, perform a denial of service attack, and manipulate files.

HCL Aftermarket DPC is vulnerable to hardcoded sensitive data (CVE-2025-55263), potentially enabling attackers to access source code or retrieve hardcoded secrets from insecure repositories.