CVE-2025-52608

MediumCVSS 4.3/10Last modified Jul 22, 2026

Description

HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-614

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-526095.3HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-CVE-2025-52617.5Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of TrusteCVE-2025-526114.3HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined propertCVE-2025-526128.8HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. TCVE-2025-526138.8HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI serCVE-2025-526144.3HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by fCVE-2025-526155.3HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for tCVE-2025-526167.5HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging knowCVE-2025-526189.8HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipuCVE-2025-526195.3HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages discloseCVE-2025-52627.5A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This couCVE-2025-526205.4HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequate
CVE-2025-52608: Medium severity, CVSS 4.3 | Vulnix