Total
36 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-31982 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality. | |||||
| CVE-2025-31957 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 2.6 LOW |
| HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data. | |||||
| CVE-2025-31960 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 5.3 MEDIUM |
| HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception. | |||||
| CVE-2025-52613 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 4.6 MEDIUM |
| HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access. | |||||
| CVE-2026-67172 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-06 | N/A | 3.7 LOW |
| HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks. | |||||
| CVE-2026-67171 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-06 | N/A | 5.3 MEDIUM |
| HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks. | |||||
| CVE-2026-56599 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-05 | N/A | 2.2 LOW |
| HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access. | |||||
| CVE-2026-56589 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-05 | N/A | 7.2 HIGH |
| HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data. | |||||
| CVE-2026-67106 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-05 | N/A | 5.3 MEDIUM |
| HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks. | |||||
| CVE-2026-67105 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-05 | N/A | 7.4 HIGH |
| HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks. | |||||
| CVE-2026-67104 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-05 | N/A | 5.3 MEDIUM |
| HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation. | |||||
| CVE-2025-31977 | 1 Hcltech | 1 Bigfix Service Management | 2026-09-26 | N/A | 5.3 MEDIUM |
| HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions. | |||||
| CVE-2025-31972 | 1 Hcltech | 1 Bigfix Service Management | 2026-09-26 | N/A | 6.5 MEDIUM |
| HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components. | |||||
| CVE-2025-31985 | 1 Hcltech | 1 Bigfix Service Management | 2026-07-24 | N/A | 3.7 LOW |
| HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly. | |||||
| CVE-2025-31973 | 1 Hcltech | 1 Bigfix Service Management | 2026-07-24 | N/A | 4.0 MEDIUM |
| HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment. | |||||
| CVE-2024-30151 | 1 Hcltech | 1 Bigfix Service Management | 2026-06-17 | N/A | 8.3 HIGH |
| HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sensitive data or unauthorized system modifications | |||||