Vulnerabilities

HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity.

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user acc…

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values.

HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths.

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation.

HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses.

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters.

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface.

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface.

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component).

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89).

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78).

HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component).

HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component).

HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component).

HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies.

HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests.

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission.

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application.

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins.

HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses.

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS.

The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.

The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it.

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package..