Hcltech Bigfix_compliance
9 CVEs affecting Hcltech Bigfix_compliance. Latest disclosed: 2026-01-28. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27756 | High | 7.5 | 2022-03-04 | "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record… |
CVE-2024-30125 | Medium | 6.2 | 2024-07-18 | HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die. |
CVE-2024-42212 | Medium | 5.4 | 2025-05-05 | HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious… |
CVE-2024-30140 | Medium | 5.4 | 2024-11-07 | HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the… |
CVE-2023-37525 | Medium | 5.3 | 2026-01-28 | A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class… |
CVE-2024-42213 | Medium | 5.3 | 2025-05-05 | HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing… |
CVE-2024-30141 | Medium | 4.7 | 2024-11-07 | HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement infor… |
CVE-2024-30126 | Medium | 4.7 | 2024-07-18 | HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target web… |
CVE-2024-30142 | Low | 3.8 | 2024-11-07 | HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting… |