BP
Product
Bigfix Platform
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 12Medium 19Low 1
Watch
Add Bigfix Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-23583 | 6.7 | May 17 | An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems Affected: 9.5 before 9.5.25; 10 before 10.0.12; 11.0.1 |
| CVE-2024-42189 | 6.5 | Apr 15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2022-42453 | 6.5 | Dec 19 | There are insufficient warnings when a Fixlet is imported by a user Affected: 9.5.0 before 9.5.21; 10.0.0 before 10.0.8 |
| CVE-2022-27544 | 6.5 | Jul 19 | HCL BigFix Web Reports authorized users may see sensitive information in clear text Affected: 9.5 through 9.5.19; 10.0 through 10.0.6 |
| CVE-2023-37528 | 6.1 | Feb 3 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37527 | 6.1 | Feb 2 | A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37520 | 6.1 | Dec 21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration Affected: 9.5 before 9.5.23; 10.0.0 before 10.0.10; 11.0.0 |
| CVE-2023-37519 | 6.1 | Dec 21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability Affected: 9.5 before 9.5.23; 10.0.0 before 10.0.10; 11.0.0 |
| CVE-2020-4095 | 6.0 | Jul 16 | "BigFix Platform is storing clear text credentials within the system's memory Affected: 9.2 through 9.2.19; 9.5 through 9.5.15 |
| CVE-2024-42200 | 5.4 | Apr 15 | HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2023-37530 | 5.4 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37529 | 5.4 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2024-23553 | 5.4 | Feb 2 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2022-27545 | 5.4 | Jul 19 | HCL BigFix Web Reports authorized users may perform HTML injection. Affected: 9.5 through 9.5.19; 10.0 through 10.0.6 |
| CVE-2024-30117 | 5.3 | Oct 14 | A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances Affected: 9.5 before 9.5.25; 10.0.0 before 10.0.12; 11.0.0 before 11.0.3 |
| CVE-2020-14248 | 5.3 | Dec 16 | BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier… Affected: 9.0.0 through 10.0.2 |
| CVE-2023-37531 | 4.8 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-45715 | 4.3 | Mar 28 | The console may experience a service interruption when processing file names with invalid characters Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 through 11.0.1 |
| CVE-2023-45706 | 4.0 | Mar 28 | An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 through 11.0.1 |
Showing 19