Hcltech Bigfix Service Management
36 CVEs affecting Hcltech Bigfix Service Management. Latest disclosed: 2026-10-01. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67100 | Critical | 9.8 | 2026-09-18 | HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attac… |
CVE-2026-67101 | Critical | 9.3 | 2026-09-18 | HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to f… |
CVE-2024-30151 | High | 8.3 | 2026-05-06 | HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users t… |
CVE-2026-67102 | High | 8.1 | 2026-09-18 | HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized… |
CVE-2026-67103 | High | 7.6 | 2026-09-18 | HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts th… |
CVE-2026-67105 | High | 7.4 | 2026-10-01 | HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept u… |
CVE-2026-56589 | High | 7.2 | 2026-10-01 | HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scr… |
CVE-2026-56592 | Medium | 6.5 | 2026-09-18 | HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an u… |
CVE-2025-31972 | Medium | 6.5 | 2025-08-28 | HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker… |
CVE-2026-56590 | Medium | 6.4 | 2026-09-18 | HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthent… |
CVE-2026-67171 | Medium | 5.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database inform… |
CVE-2026-67106 | Medium | 5.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information… |
CVE-2026-67104 | Medium | 5.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessi… |
CVE-2025-31960 | Medium | 5.3 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that suppl… |
CVE-2025-31981 | Medium | 5.3 | 2026-04-21 | HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker… |
CVE-2025-31977 | Medium | 5.3 | 2025-08-28 | HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness… |
CVE-2026-21848 | Medium | 5.0 | 2026-09-18 | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access… |
CVE-2025-31976 | Medium | 4.8 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appl… |
CVE-2025-52613 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the… |
CVE-2025-31978 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An… |