14 results · Clear filters · Feed
-
Medium 6.8
HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can imp…
-
Medium 4.0
HCL BigFix Platform is affected by insufficient authentication
HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication.
-
Medium 5.9
HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiation
SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.
-
Medium 5.7
HCL BigFix Platform is susceptible to Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).
-
Medium 6.7
HCL BigFix Platform is susceptible to insufficiently protected credentials
An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.
-
Medium 6.5
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.
-
Medium 5.4
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering conte…
-
Medium 6.9
HCL BigFix Platform is affected by insufficient warnings
There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.
-
Medium 6.0
HCL BigFix Platform is affected by insecure credential storage
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
-
Medium 6.7
HCL BigFix Platform Console is affected by a Privilege Escalation Vulnerability
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the…
-
Medium 6.7
HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability
The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the …
-
Medium 6.7
HCL BigFix Platform Server API is affected by Privilege Escalation Vulnerability
The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with …
-
Medium 4.7
HCL BigFix Platform is affected by misconfigured security-related HTTP headers
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
-
Medium 4.8
HCL BigFix Platform is affected by weak web transport security
Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks