Hcl Software Bigfix Platform
21 CVEs affecting Hcl Software Bigfix Platform. Latest disclosed: 2024-10-14. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37536 | High | 8.2 | 2023-10-11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. |
CVE-2022-42453 | Medium | 6.9 | 2022-12-19 | There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with… |
CVE-2024-23583 | Medium | 6.7 | 2024-05-17 | An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems. |
CVE-2021-27767 | Medium | 6.7 | 2022-05-06 | The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pr… |
CVE-2021-27766 | Medium | 6.7 | 2022-05-06 | The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a pri… |
CVE-2021-27765 | Medium | 6.7 | 2022-05-06 | The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a… |
CVE-2023-37528 | Medium | 6.5 | 2024-02-03 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter… |
CVE-2022-38659 | Medium | 6.0 | 2022-12-19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent. |
CVE-2024-23556 | Medium | 5.9 | 2024-05-18 | SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability. |
CVE-2024-23554 | Medium | 5.7 | 2024-05-18 | Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE). |
CVE-2023-37527 | Medium | 5.4 | 2024-02-02 | A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious ja… |
CVE-2021-27761 | Medium | 4.8 | 2022-05-06 | Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks |
CVE-2021-27762 | Medium | 4.7 | 2022-05-06 | Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses |
CVE-2023-45715 | Low | 3.5 | 2024-03-28 | The console may experience a service interruption when processing file names with invalid characters. |
CVE-2023-45705 | Low | 3.5 | 2024-03-28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. |
CVE-2023-37531 | Low | 3.3 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37530 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37529 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2024-23553 | Low | 3.0 | 2024-02-02 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. |
CVE-2024-30117 | Low | 2.5 | 2024-10-14 | A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances. |