Aion (Hcltech) - vulnerabilities (CVEs)

29 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2026-04-15. Vendor: Hcltech.

CVEs of Aion

CVE-2025-52641 - CVSS 5.3 (medium), 2026-04-15: HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information…
CVE-2025-52649 - CVSS 5.3 (medium), 2026-03-16: HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or…
CVE-2025-52643 - CVSS 7.8 (high), 2026-03-16: HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may…
CVE-2025-52646 - CVSS 5.3 (medium), 2026-03-16: HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or…
CVE-2025-52642 - CVSS 6.5 (medium), 2026-03-16: HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal…
CVE-2025-52645 - CVSS 5.3 (medium), 2026-03-16: HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow…
CVE-2025-52644 - CVSS 8.2 (high), 2026-03-16: HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce…
CVE-2025-52636 - CVSS 7.5 (high), 2026-03-16: HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive…
CVE-2025-52623 - CVSS 6.5 (medium), 2026-02-03: HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead…
CVE-2025-52633 - CVSS 5.3 (medium), 2026-02-03: HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies…
CVE-2025-52631 - CVSS 8.1 (high), 2026-02-03: HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially…
CVE-2025-52628 - CVSS 8.8 (high), 2026-02-03: HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests,…
CVE-2025-52629 - CVSS 6.1 (medium), 2026-02-03: HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content…
CVE-2025-52627 - CVSS 7.5 (high), 2026-02-03: Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially…
CVE-2025-52626 - CVSS 9.8 (critical), 2026-02-03: A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the…
CVE-2025-55252 - CVSS 9.8 (critical), 2026-01-19: HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in…
CVE-2025-55250 - CVSS 5.3 (medium), 2026-01-19: HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in…
CVE-2025-55251 - CVSS 9.8 (critical), 2026-01-19: HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution…
CVE-2025-55249 - CVSS 5.3 (medium), 2026-01-19: HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall…
CVE-2025-52659 - CVSS 7.5 (high), 2026-01-19: HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially…
CVE-2025-52661 - CVSS 5.3 (medium), 2026-01-19: HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized…
CVE-2025-52660 - CVSS 9.8 (critical), 2026-01-19: HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution…
CVE-2025-52624 - CVSS 6.1 (medium), 2025-10-10: A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized…
CVE-2025-52635 - CVSS 9.8 (critical), 2025-10-10: A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.
CVE-2025-52625 - CVSS 7.5 (high), 2025-10-10: A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal…
CVE-2025-52650 - CVSS 8.2 (high), 2025-10-10: Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
CVE-2025-52634 - CVSS 7.5 (high), 2025-10-10: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.
CVE-2025-52632 - CVSS 7.5 (high), 2025-10-10: A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
CVE-2025-52630 - CVSS 7.5 (high), 2025-10-10: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.