HCL Software Bigfix Platform vulnerabilities
21 vulnerabilities
Known vulnerabilities in HCL Software Bigfix Platform, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-27761hcl softwarebigfix platform+1
EPSS score0.37%
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacksCVE-2021-27762hcl softwarebigfix platform+1EPSS score0.72%
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responsesCVE-2021-27767hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27765hcl softwarebigfix platform+1EPSS score0.34%
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27766hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2022-42453hcl softwarebigfix platform+1EPSS score0.29%
There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.CVE-2022-38659hcl softwarebigfix platform+1EPSS score0.13%
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.CVE-2024-30117hcl softwarebigfix platform+1EPSS score0.20%
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.CVE-2024-23553hcl softwarebigfix platform+1EPSS score0.26%
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.CVE-2024-23583hcl softwarebigfix platform+1EPSS score0.16%
An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.CVE-2024-23554hcl softwarebigfix platform+1EPSS score0.27%
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).CVE-2024-23556hcl softwarebigfix platform+1EPSS score0.37%
SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.CVE-2023-37529hcl softwarebigfix platform+1EPSS score0.34%
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information. This is not the same vulnerability as identified in CVE-2023-37530.CVE-2023-37527hcl softwarebigfix platform+1EPSS score0.36%
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.CVE-2023-37531hcl softwarebigfix platform+1EPSS score0.36%
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access.CVE-2023-37528hcl softwarebigfix platform+1EPSS score0.34%
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.CVE-2023-37530hcl softwarebigfix platform+1EPSS score0.34%
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.CVE-2023-37536apachexerces-c\+\++24EPSS score1.93%
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.CVE-2023-45715hcl softwarebigfix platform+1EPSS score0.40%
The console may experience a service interruption when processing file names with invalid characters.CVE-2023-45706hcl softwarebigfix platform+1EPSS score0.26%
An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.