Skip to content
OpenAdvisories
High WID-SEC-2022-2368 16 CVEs

HCL BigFix: Mehrere Schwachstellen

Published Dec 19, 2022 · Updated Jan 9, 2023 · Revision 3 · de-DE

Vendor: HCL Software Vendor: IBM Product: BigFix Product: BigFix < 10.0.8  Product: BigFix < 9.5.21 Product: License Metric Tool Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um die Verfügbarkeit, die Vertraulichkeit und die Integrität zu gefährden.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 16

  • High 7.5
    CVE-2022-31129

    Inefficient Regular Expression Complexity in moment

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

    moment moment mediawiki wordpress Debian Ubuntu npm NuGet
  • High 7.4
    CVE-2022-39299 Public exploit

    Signature bypass via multiple root elements in Passport-SAML

    Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession…

    node-saml passport-saml @node-saml/node-saml passport-saml npm
  • Medium 6.5
    CVE-2021-41182 Public exploit EPSS 39%

    XSS in the `altField` option of the Datepicker widget

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value…

    jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  • Medium 6.5
    CVE-2021-41183

    XSS in `*Text` options of the Datepicker widget

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values pas…

    jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems
  • Medium 6.5
    CVE-2021-41184 Public exploit EPSS 41%

    XSS in the `of` option of the `.position()` util

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…

    jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems
  • Medium 6.4
    CVE-2022-38655

    HCL BigFix WebUI is affected by a missing-permission-check vulnerability

    BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.

    HCL Software BigFix WebUI
  • Medium 6.4
    CVE-2022-42454

    HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper certificate validation

    Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.  This requires privileged network access.

    HCL Software BigFix Insights for Vulnerability Remediation
  • Medium 6.4
    CVE-2022-44756

    HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation

    Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged access. 

    HCL Software BigFix Insights for Vulnerability Remediation
  • Medium 6.1
    CVE-2022-31160 Public exploit

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

    jquery jquery-ui jquery-ui jquery-ui-rails Debian Ubuntu npm Maven NuGet RubyGems
  • Medium 5.5
    CVE-2021-32012

    Denial of Service in SheetJS Pro

    SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).

    xlsx org.webjars.npm:xlsx npm Maven
  • Medium 5.5
    CVE-2021-32013

    Denial of Service in SheetsJS Pro

    SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).

    xlsx org.webjars.npm:xlsx npm Maven
  • Medium 5.5
    CVE-2021-32014

    Denial of Service in SheetJS Pro

    SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.

    xlsx org.webjars.npm:xlsx npm Maven
  • Medium 5.3
    CVE-2022-25887

    Regular Expression Denial of Service (ReDoS)

    The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

    sanitize-html jupyter-notebook node-sanitize-html node-sanitize-html Debian Ubuntu npm
  • Medium 5.3
    CVE-2022-33987

    Got allows a redirect to a UNIX socket

    The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

    node-got node-got got Debian Ubuntu npm
  • Medium 4.8
    CVE-2022-25896

    Session Fixation

    This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

    passportjs passport passportjs Debian Ubuntu npm
  • Unscored —
    CVE-2022-37616

    A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) p…

    python-tensorboard node-xmldom node-xmldom Debian Ubuntu Azure Linux

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Neue Updates von HCL aufgenommen

  3. #1

    Initiale Fassung

References