High WID-SEC-2024-1590 5 CVEs

HCL BigFix: Mehrere Schwachstellen

Published Jul 10, 2024 · Updated Dec 18, 2024 · Revision 3 · de-DE

Vendor: HCL Software Product: BigFix Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um einen Denial of Service Angriff durchzuführen, ertrauliche Informationen preiszugeben, Daten zu manipulieren und Sicherheitsmaßnahmen zu umgehen.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 5

Critical 9.8

CVE-2023-42282

NPM IP package incorrectly identifies some private IP addresses as public

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

renovate nodejs lerna sqlpad Debian Ubuntu Azure Linux Wolfi npm

Feb 8, 2024
High 7.5

CVE-2022-31147 Public exploit

jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2…

jquery-validation jquery-validation civicrm jquery-validation Ubuntu npm

Jul 14, 2022
Medium 6.1

CVE-2024-29041

Express.js Open Redirect in malformed URLs

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a use…

expressjs express kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm

Mar 25, 2024
Medium 5.9

CVE-2021-43306

Exponential ReDoS in jquery-validation

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method

jquery-validation jquery-validation civicrm jquery-validation Ubuntu npm

Jun 1, 2022
Medium 4.0

CVE-2024-33883 Public exploit

ejs lacks certain pollution protection

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

lerna node-ejs ejs node-ejs Debian Ubuntu Wolfi npm

Apr 28, 2024

Revision history

2024-12-18 #3
Neue Updates aufgenommen
2024-07-28 #2
Neue Updates von HCL aufgenommen
2024-07-10 #1
Initiale Fassung

References

HCL Security Bulletin vom 2024-07-10
https://support.hcltechsw.com/community?id=community_blog&sys_id=41c2808e1b930ad0534c4159cc4bcba7
HCL Security Bulletin vom 2024-07-10
https://support.hcltechsw.com/community?id=community_blog&sys_id=944daab91b1786d0534c4159cc4bcb58
HCL Security Bulletin vom 2024-07-10
https://support.hcltechsw.com/community?id=community_blog&sys_id=cef753bd1bd3c6d0534c4159cc4bcbaa
HCL Security Bulletin vom 2024-07-10
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0114657
HCL Article KB0114591 vom 2024-07-28
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0114591
HCL Security Bulletin vom 2024-12-18
https://support.hcl-software.com/community?id=community_blog&sys_id=1af3c435fb2216d0db10f2797befdc15