BP
Product
Bigfix Platform
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 12Medium 19Low 1
Watch
Add Bigfix Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-27762 | 9.8 | May 6 | Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses Affected: 9.5 before 9.5.19; 10.0 before 10.0.6 |
| CVE-2024-23554 | 8.8 | May 18 | Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE) Affected: 9.5 before 9.5.25; 10 before 10.0.12; 11.0.1 |
| CVE-2023-37536 | 8.8 | Oct 11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request Affected: 9.0.0 before 9.5.23; 10.0.0 before 10.0.10 |
| CVE-2024-42193 | 8.1 | Apr 15 | HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2026-21765 | 7.8 | Apr 1 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys Affected: 11.0.0 through 11.0.5 |
| CVE-2022-38659 | 7.8 | Dec 19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent Affected: 9.5 through 9.5.20; 10 through 10.0.7 |
| CVE-2021-27767 | 7.8 | May 6 | The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation Affected: 9.5 through 9.5.18; 10 through 10.0.5 |
| CVE-2021-27766 | 7.8 | May 6 | The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation Affected: 9.5 through 9.5.18; 10 through 10.0.5 |
| CVE-2021-27765 | 7.8 | May 6 | The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege… Affected: 9.5 through 9.5.18; 10 through 10.0.5 |
| CVE-2024-23556 | 7.5 | May 18 | SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability Affected: 9.5 before 9.5.25; 10.0.0 before 10.0.12 |
| CVE-2021-27761 | 7.5 | May 6 | Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks Affected: 9.5 before 9.5.19; 10.0 before 10.0.6 |
| CVE-2020-14254 | 7.5 | Dec 16 | TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2 Affected: through 10.0.2 |
| CVE-2023-45705 | 7.2 | Mar 28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options Affected: 10 before 10.0.11; 11.0.0 before 11.0.2 |
| CVE-2024-23583 | 6.7 | May 17 | An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems Affected: 9.5 before 9.5.25; 10 before 10.0.12; 11.0.1 |
| CVE-2024-42189 | 6.5 | Apr 15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2022-42453 | 6.5 | Dec 19 | There are insufficient warnings when a Fixlet is imported by a user Affected: 9.5.0 before 9.5.21; 10.0.0 before 10.0.8 |
| CVE-2022-27544 | 6.5 | Jul 19 | HCL BigFix Web Reports authorized users may see sensitive information in clear text Affected: 9.5 through 9.5.19; 10.0 through 10.0.6 |
| CVE-2023-37528 | 6.1 | Feb 3 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37527 | 6.1 | Feb 2 | A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37520 | 6.1 | Dec 21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration Affected: 9.5 before 9.5.23; 10.0.0 before 10.0.10; 11.0.0 |
| CVE-2023-37519 | 6.1 | Dec 21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability Affected: 9.5 before 9.5.23; 10.0.0 before 10.0.10; 11.0.0 |
| CVE-2020-4095 | 6.0 | Jul 16 | "BigFix Platform is storing clear text credentials within the system's memory Affected: 9.2 through 9.2.19; 9.5 through 9.5.15 |
| CVE-2024-42200 | 5.4 | Apr 15 | HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2023-37530 | 5.4 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37529 | 5.4 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2024-23553 | 5.4 | Feb 2 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2022-27545 | 5.4 | Jul 19 | HCL BigFix Web Reports authorized users may perform HTML injection. Affected: 9.5 through 9.5.19; 10.0 through 10.0.6 |
| CVE-2024-30117 | 5.3 | Oct 14 | A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances Affected: 9.5 before 9.5.25; 10.0.0 before 10.0.12; 11.0.0 before 11.0.3 |
| CVE-2020-14248 | 5.3 | Dec 16 | BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier… Affected: 9.0.0 through 10.0.2 |
| CVE-2023-37531 | 4.8 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-45715 | 4.3 | Mar 28 | The console may experience a service interruption when processing file names with invalid characters Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 through 11.0.1 |
| CVE-2023-45706 | 4.0 | Mar 28 | An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 through 11.0.1 |
| CVE-2026-21767 | 3.3 | Apr 1 | HCL BigFix Platform is affected by insufficient authentication Affected: 11.0.0 through 11.0.5 |
Showing 33