Skip to content
OpenAdvisories
High WID-SEC-2024-0290 7 CVEs

HCL BigFix: Mehrere Schwachstellen

Published Feb 4, 2024 · Updated Feb 4, 2024 · de-DE

Vendor: HCL Software Product: BigFix Product: BigFix < 10.0.11 Product: BigFix < 11.0.1 Product: BigFix < 9.5.24 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, beliebigen Code auszuführen und vertrauliche Informationen offenzulegen.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 7

  • High 8.8
    CVE-2023-38545 Public exploit EPSS 78%

    This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2023-37528

    A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

    A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.

    HCL Software BigFix Platform
  • Medium 5.4
    CVE-2023-37527

    A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

    A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering conte…

    HCL Software BigFix Platform
  • Low 3.3
    CVE-2023-37531

    A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

    A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access.

    HCL Software BigFix Platform
  • Low 3.0
    CVE-2023-37529

    A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

    A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information. This is not the same vulnerability …

    HCL Software BigFix Platform
  • Low 3.0
    CVE-2023-37530

    A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

    A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a webpage trying to retrieve cookie stored information.

    HCL Software BigFix Platform
  • Low 3.0
    CVE-2024-23553

    A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform

    A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.

    HCL Software BigFix Platform

Revision history

  1. #1

    Initiale Fassung

References