Skip to content
OpenAdvisories
Medium WID-SEC-2023-1208 6 CVEs

HCL BigFix: Mehrere Schwachstellen

Published May 14, 2023 · Updated Oct 5, 2023 · Revision 4 · de-DE

Vendor: Fedora Vendor: HCL Software Vendor: IBM Product: BigFix Product: Linux Product: MQ Product: MQ 9.0 Product: MQ 9.1 Product: MQ 9.2 Product: Tivoli Business Service Manager 6.2.0 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 6

  • Medium 6.4
    CVE-2022-23540

    jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

    In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify…

    auth0 node-jsonwebtoken jsonwebtoken npm
  • Medium 5.9
    CVE-2022-23539

    jsonwebtoken unrestricted key type could lead to legacy keys usage

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key …

    auth0 node-jsonwebtoken jsonwebtoken npm
  • Medium 5.3
    CVE-2023-26116

    angular vulnerable to regular expression denial of service via the angular.copy() utility

    Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large careful…

    angular.js angular.js angular Debian Ubuntu npm
  • Medium 5.3
    CVE-2023-26117

    angular vulnerable to regular expression denial of service via the $resource service

    Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted inpu…

    angular.js angular.js angular Debian Ubuntu npm
  • Medium 5.3
    CVE-2023-26118

    angular vulnerable to regular expression denial of service via the <input type="url"> element

    Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is p…

    angular.js angular.js angular Debian Ubuntu npm
  • Medium 5.0
    CVE-2022-23541

    jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

    jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result…

    auth0 node-jsonwebtoken jsonwebtoken npm

Revision history

  1. #4

    Neue Updates von Fedora aufgenommen

  2. #3

    Neue Updates von IBM aufgenommen

  3. #2

    Neue Updates von IBM aufgenommen

  4. #1

    Initiale Fassung

References