Product
8 published CVES affecting hcltech appscan, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header."
"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."
"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files."
HCL AppScan Standard is vulnerable to excessive authorization attempts
HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data
HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.