Vulnerabilities

TI-2026-17525 CVE-2026-21767 · GHSA-69rx-rvq8-835f

Missing authentication in HCL Software BigFix Platform

LOW 18

HCL BigFix Platform is affected by insufficient authentication.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00116 Published 2026-04-01 No fix listed CWE-306

TI-2026-17523 CVE-2026-21765 · GHSA-cwpc-gq4p-xxwh

Incorrect default permissions in HCL Software BigFix Platform

LOW 39

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00104 Published 2026-04-01 No fix listed CWE-276

TI-2024-28196 CVE-2024-42193 · GHSA-h7q3-qpf8-7vp4

HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attack

LOW 11

HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00275 Published 2025-04-15 No fix listed CWE-295

TI-2024-28192 CVE-2024-42189 · GHSA-37j4-mqr6-6m6x

HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack

LOW 25

HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.

CVSS 4.0MEDIUM 5.6 Network High privileges User interaction EPSS 0.00301 Published 2025-04-15 No fix listed CWE-1287

TI-2024-28201 CVE-2024-42200 · GHSA-2g48-r5cc-hm38

HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attack

LOW 22

HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00234 Published 2025-04-15 No fix listed CWE-79

TI-2024-19877 CVE-2024-30117 · GHSA-fp78-wr5r-r3fr

HCL BigFix Platform is affected by a DLL Hijack vulnerability

LOW 23

A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.002 Published 2024-10-14 No fix listed CWE-427

TI-2024-15585 CVE-2024-23556 · GHSA-64vh-gcrh-6whf

HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiation

LOW 33

SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00371 Published 2024-05-17 No fix listed

TI-2024-15584 CVE-2024-23554 · GHSA-jw9q-cpgg-x45m

HCL BigFix Platform is susceptible to Cross-Site Request Forgery

MEDIUM 40

Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00271 Published 2024-05-17 No fix listed CWE-352

TI-2024-15611 CVE-2024-23583 · GHSA-6q9q-x3xj-g3m7

HCL BigFix Platform is susceptible to insufficiently protected credentials

LOW 31

An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00157 Published 2024-05-17 No fix listed CWE-522

TI-2023-24499 CVE-2023-45715 · GHSA-33r2-8g93-5hm2

HCL BigFix Platform is susceptible to a Denial of Service attack

LOW 20

The console may experience a service interruption when processing file names with invalid characters.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.004 Published 2024-03-28 No fix listed CWE-436

TI-2023-24497 CVE-2023-45706 · GHSA-38mw-3mfv-34fc

HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack

LOW 18

An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.

CVSS 3.1MEDIUM 4.0 Network High privileges User interaction EPSS 0.0026 Published 2024-03-28 No fix listed CWE-79

TI-2023-24496 CVE-2023-45705 · GHSA-3x3h-fcc9-p4px

HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)

LOW 32

An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00371 Published 2024-03-28 No fix listed CWE-918

TI-2023-19127 CVE-2023-37528 · GHSA-g5p5-rhqv-c3qj

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

LOW 29

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00337 Published 2024-02-03 No fix listed CWE-79

TI-2024-15583 CVE-2024-23553 · GHSA-2cwc-8x85-2774

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

LOW 24

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00255 Published 2024-02-02 No fix listed CWE-79

TI-2023-19130 CVE-2023-37531 · GHSA-397m-2h32-p5j6

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

LOW 22

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00359 Published 2024-02-02 No fix listed CWE-79

TI-2023-19129 CVE-2023-37530 · GHSA-f962-cfv2-wvqj

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

LOW 24

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored informati…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00335 Published 2024-02-02 No fix listed CWE-79

TI-2023-19128 CVE-2023-37529 · GHSA-w953-7xrr-xmmq

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

LOW 24

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00335 Published 2024-02-02 No fix listed CWE-79

TI-2023-19126 CVE-2023-37527 · GHSA-v4cg-mf2j-mwp7

A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

LOW 27

A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00356 Published 2024-02-02 No fix listed CWE-79

TI-2023-19119 CVE-2023-37520 · GHSA-hrwf-qr34-wrcx

HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)

LOW 33

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration.

CVSS 3.1HIGH 7.7 Local No auth User interaction EPSS 0.00251 Published 2023-12-21 No fix listed CWE-79

TI-2023-19118 CVE-2023-37519 · GHSA-xhgw-9c9f-wj5v

HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)

LOW 33

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability.

CVSS 3.1HIGH 7.7 Local No auth User interaction EPSS 0.00249 Published 2023-12-21 No fix listed CWE-79

TI-2023-19135 CVE-2023-37536 · GHSA-62mq-p983-gjvx

HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

MEDIUM 44

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0193 Published 2023-10-11 Partial fix CWE-680

TI-2022-20653 CVE-2022-42453 · GHSA-3cf8-mgm4-6mvf

HCL BigFix Platform is affected by insufficient warnings

LOW 32

There are insufficient warnings when a Fixlet is imported by a user.

CVSS 3.1MEDIUM 6.9 Local High privileges User interaction EPSS 0.00285 Published 2022-12-17 No fix listed CWE-287

TI-2022-18192 CVE-2022-38659 · GHSA-hp9j-r2qw-j3vw

HCL BigFix Platform is affected by insecure credential storage

LOW 35

In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00129 Published 2022-12-17 No fix listed CWE-326

TI-2022-10548 CVE-2022-27545 · GHSA-4h8q-jm55-4xg5

HCL BigFix Web Reports authorized users may perform HTML injection.

LOW 24

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00336 Published 2022-07-19 No fix listed CWE-79

TI-2022-10547 CVE-2022-27544 · GHSA-fc76-hxx9-92hh

HCL BigFix Web Reports authorized users may see sensitive information in clear text

LOW 35

BigFix Web Reports authorized users may see SMTP credentials in clear text.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00456 Published 2022-07-19 No fix listed CWE-522

Vulnerabilities

Filters