HCL IEM vulnerabilities

Missing X-Content-Type-Options header in HCL IEM allows attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.

Missing Anti Clickjacking X-Frame-Options header in HCL IEM allows attackers to embed the application in malicious pages and induce unauthorized user actions.

HCL IEM does not enforce strict transport security (HSTS), allowing attackers to perform SSL stripping or man-in-the-middle attacks, compromising secure communications.

HCL IEM was affected with an information disclosure issue in the nginx server, which may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.