BP
Product
Bigfix Platform
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 12Medium 19Low 1
Watch
Add Bigfix Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-27762 | 9.8 | May 6 | Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses Affected: 9.5 before 9.5.19; 10.0 before 10.0.6 |
| CVE-2024-23554 | 8.8 | May 17 | HCL BigFix Platform is susceptible to Cross-Site Request Forgery Affected: 9.5 before 9.5.25; 10 before 10.0.12; 11.0.1 |
| CVE-2023-37536 | 8.8 | Oct 11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request Affected: 9.0.0 before 9.5.23; 10.0.0 before 10.0.10 |
| CVE-2024-42193 | 8.1 | Apr 15 | HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attack Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2026-21765 | 7.8 | Apr 1 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys Affected: 11.0.0 through 11.0.5 |
| CVE-2022-38659 | 7.8 | Dec 19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent Affected: 9.5 through 9.5.20; 10 through 10.0.7 |
| CVE-2021-27767 | 7.8 | May 6 | The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation Affected: 9.5 through 9.5.18; 10 through 10.0.5 |
| CVE-2021-27766 | 7.8 | May 6 | The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation Affected: 9.5 through 9.5.18; 10 through 10.0.5 |
| CVE-2021-27765 | 7.8 | May 6 | The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege… Affected: 9.5 through 9.5.18; 10 through 10.0.5 |
| CVE-2024-23556 | 7.5 | May 17 | HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiation Affected: 9.5 before 9.5.25; 10.0.0 before 10.0.12 |
| CVE-2021-27761 | 7.5 | May 6 | Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks Affected: 9.5 before 9.5.19; 10.0 before 10.0.6 |
| CVE-2020-14254 | 7.5 | Dec 16 | TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2 Affected: through 10.0.2 |
| CVE-2023-45705 | 7.2 | Mar 28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options Affected: 10 before 10.0.11; 11.0.0 before 11.0.2 |
| CVE-2024-23583 | 6.7 | May 17 | HCL BigFix Platform is susceptible to insufficiently protected credentials Affected: 9.5 before 9.5.25; 10 before 10.0.12; 11.0.1 |
| CVE-2024-42189 | 6.5 | Apr 15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2022-42453 | 6.5 | Dec 19 | There are insufficient warnings when a Fixlet is imported by a user Affected: 9.5.0 before 9.5.21; 10.0.0 before 10.0.8 |
| CVE-2022-27544 | 6.5 | Jul 19 | HCL BigFix Web Reports authorized users may see sensitive information in clear text Affected: 9.5 through 9.5.19; 10.0 through 10.0.6 |
| CVE-2023-37528 | 6.1 | Feb 3 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37527 | 6.1 | Feb 2 | A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37520 | 6.1 | Dec 21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration Affected: 9.5 before 9.5.23; 10.0.0 before 10.0.10; 11.0.0 |
| CVE-2023-37519 | 6.1 | Dec 21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability Affected: 9.5 before 9.5.23; 10.0.0 before 10.0.10; 11.0.0 |
| CVE-2020-4095 | 6.0 | Jul 16 | "BigFix Platform is storing clear text credentials within the system's memory Affected: 9.2 through 9.2.19; 9.5 through 9.5.15 |
| CVE-2024-42200 | 5.4 | Apr 15 | HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attack Affected: 10.0.0 before 10.0.13; 11.0.0 before 11.0.4 |
| CVE-2023-37530 | 5.4 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-37529 | 5.4 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2024-23553 | 5.4 | Feb 2 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2022-27545 | 5.4 | Jul 19 | HCL BigFix Web Reports authorized users may perform HTML injection. Affected: 9.5 through 9.5.19; 10.0 through 10.0.6 |
| CVE-2024-30117 | 5.3 | Oct 14 | HCL BigFix Platform is affected by a DLL Hijack vulnerability Affected: 9.5 before 9.5.25; 10.0.0 before 10.0.12; 11.0.0 before 11.0.3 |
| CVE-2020-14248 | 5.3 | Dec 16 | BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier… Affected: 9.0.0 through 10.0.2 |
| CVE-2023-37531 | 4.8 | Feb 29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form… Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 |
| CVE-2023-45715 | 4.3 | Mar 28 | The console may experience a service interruption when processing file names with invalid characters Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 through 11.0.1 |
| CVE-2023-45706 | 4.0 | Mar 28 | An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration Affected: 9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 through 11.0.1 |
| CVE-2026-21767 | 3.3 | Apr 1 | HCL BigFix Platform is affected by insufficient authentication Affected: 11.0.0 through 11.0.5 |
Showing 33