Skip to content
OpenAdvisories
High WID-SEC-2025-1854 8 CVEs

HCL BigFix Komponente: Mehrere Schwachstellen

Published Aug 17, 2025 · Updated Oct 12, 2025 · Revision 2 · de-DE

Vendor: HCL Software Product: BigFix Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in HCL BigFix Komponente ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 8

  • Critical 9.4
    CVE-2025-7783 Public exploit

    Usage of unsafe random function in form-data for choosing boundary

    Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

    katib-suggestion-hyperopt katib-earlystopping katib-suggestion-hyperband katib-suggestion-optuna-enas Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2025-7338 Public exploit

    Multer vulnerable to Denial of Service via unhandled exception from malformed request

    Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload requ…

    expressjs multer multer npm
  • Medium 5.3
    CVE-2023-3817

    Excessive time spent checking DH q parameter value

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-5678

    Excessive time spent in DH check / generation with large Q parameter value

    Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2025-52619

    HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure

    HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform.

    HCL Software BigFix SaaS Remediate
  • Medium 5.3
    CVE-2025-52621

    HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning

    HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning.  The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache…

    HCL Software BigFix SaaS Remediate
  • Medium 4.3
    CVE-2025-52618

    HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability

    HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries.

    HCL Software BigFix SaaS Remediate
  • Medium 4.3
    CVE-2025-52620

    HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability

    HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the submitted image format.

    HCL Software BigFix SaaS Remediate

Revision history

  1. #2

    Neue Updates von HCL aufgenommen

  2. #1

    Initiale Fassung

References