Hcltech Bigfix Platform

Dynamic Search Path Vulnerability Enabling Prerequisite Library Replacement
CVE-2024-30117 5.3 - Medium - October 14, 2024

A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.

DLL preloading

WebReports SSRF via SMTP Config
CVE-2023-45705 7.2 - High - March 28, 2024

An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.

SSRF

XSS in HCL BigFix Platform Web Reports Enables Cookie Theft
CVE-2023-37529 5.4 - Medium - February 29, 2024

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information. This is not the same vulnerability as identified in CVE-2023-37530.

XSS

XSS in HCL BigFix Web Reports enabling JS execution
CVE-2023-37530 5.4 - Medium - February 29, 2024

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.

XSS

XSS in HCL BigFix Web Reports component
CVE-2023-37531 4.8 - Medium - February 29, 2024

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access.

XSS

HCL BigFix XSS in Web Reports Save Report
CVE-2023-37528 6.1 - Medium - February 03, 2024

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.

XSS

HCL BigFix Platform XSS in Web Reports Component
CVE-2024-23553 5.4 - Medium - February 02, 2024

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.

XSS

Reflected XSS in HCL BigFix Web Reports Enables JS Execution
CVE-2023-37527 6.1 - Medium - February 02, 2024

A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.

XSS

BigFix Server 9.5.12.68 Unauth Stored XSS in Relay Gather Status Report
CVE-2023-37520 6.1 - Medium - December 21, 2023

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

XSS

BigFix Server Unauth Stored XSS in Download Status Report
CVE-2023-37519 6.1 - Medium - December 21, 2023

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server. 

XSS

Remote Integer Overflow in xerces-c++ 3.2.3 (BigFix Platform)
CVE-2023-37536 8.8 - High - October 11, 2023

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

Integer Overflow or Wraparound

Windows Credential Encryption Weakness: Non-Machine-Specific Keying
CVE-2022-38659 7.8 - High - December 19, 2022

In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.

Inadequate Encryption Strength

Symantec EPM Fixlet Import Lacks Proper Warnings CVE-2022-42453
CVE-2022-42453 6.5 - Medium - December 19, 2022

There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.

authentification

BigFix Web Reports authorized users may see SMTP credentials in clear text.
CVE-2022-27544 6.5 - Medium - July 19, 2022

BigFix Web Reports authorized users may see SMTP credentials in clear text.

Insufficiently Protected Credentials

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
CVE-2022-27545 5.4 - Medium - July 19, 2022

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.

XSS

Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks
CVE-2021-27761 7.5 - High - May 06, 2022

Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks

Inadequate Encryption Strength

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
CVE-2021-27762 9.8 - Critical - May 06, 2022

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability
CVE-2021-27765 7.8 - High - May 06, 2022

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Improper Privilege Management

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability
CVE-2021-27766 7.8 - High - May 06, 2022

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Improper Privilege Management

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability
CVE-2021-27767 7.8 - High - May 06, 2022

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Improper Privilege Management

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2
CVE-2020-14254 7.5 - High - December 16, 2020

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.

Missing Encryption of Sensitive Data

BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session
CVE-2020-14248 5.3 - Medium - December 16, 2020

BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Cleartext Transmission of Sensitive Information