HCL Software Bigfix Service Management (SM) vulnerabilities
9 vulnerabilities
Known vulnerabilities in HCL Software Bigfix Service Management (SM), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-31959hcl softwarebigfix service management (sm)+1
EPSS score0.14%
HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. .CVE-2025-31974hcl softwarebigfix service management (sm)+1EPSS score0.18%
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow
unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes.CVE-2025-31977hcl softwarebigfix service management (sm)+1EPSS score0.10%
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.CVE-2025-31976hcl softwarebigfix service management (sm)+1EPSS score0.16%
HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. .CVE-2025-31978hcl softwarebigfix service management (sm)+1EPSS score0.14%
HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.CVE-2025-31979hcl softwarebigfix service management (sm)EPSS score0.21%
A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms.CVE-2025-31982hcl softwarebigfix service management (sm)+1EPSS score0.15%
HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.CVE-2025-31972hcl softwarebigfix service management (sm)+1EPSS score0.09%
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.CVE-2025-31957hcl softwarebigfix service management (sm)+1EPSS score0.10%
HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.