Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE)

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request

HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys

In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege…

SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability

Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2

An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options