Hcltech Bigfix Platform vulnerabilities
33 vulnerabilities
Known vulnerabilities in Hcltech Bigfix Platform, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-27761hcl softwarebigfix platform+1
EPSS score0.37%
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacksCVE-2021-27762hcl softwarebigfix platform+1EPSS score0.72%
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responsesCVE-2021-27767hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27765hcl softwarebigfix platform+1EPSS score0.34%
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2021-27766hcl softwarebigfix platform+1EPSS score0.19%
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.CVE-2020-14248hcltechbigfix_platformEPSS score0.67%
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.CVE-2020-14254hcltechbigfix_platformEPSS score0.65%
TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.CVE-2020-4095hcltechbigfix_platformEPSS score0.20%
"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."CVE-2022-42453hcl softwarebigfix platform+1EPSS score0.29%
There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.CVE-2022-27545hcl softwarehcl bigfix+1EPSS score0.34%
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.CVE-2022-27544hcl softwarehcl bigfix+1EPSS score0.46%
BigFix Web Reports authorized users may see SMTP credentials in clear text.CVE-2022-38659hcl softwarebigfix platform+1EPSS score0.13%
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.CVE-2024-42200hcl softwarehcl bigfix platform+1EPSS score0.23%
HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input.CVE-2024-42189hcl softwarehcl bigfix platform+1EPSS score0.30%
HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.CVE-2024-42193hcl softwarehcl bigfix platform+1EPSS score0.27%
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability could potentially lead to unauthorized access.CVE-2024-30117hcl softwarebigfix platform+1EPSS score0.20%
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.CVE-2024-23553hcl softwarebigfix platform+1EPSS score0.26%
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.CVE-2024-23583hcl softwarebigfix platform+1EPSS score0.16%
An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.CVE-2024-23554hcl softwarebigfix platform+1EPSS score0.27%
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).CVE-2024-23556hcl softwarebigfix platform+1EPSS score0.37%
SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.