Total
36 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-56590 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | N/A | 6.4 MEDIUM |
| HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise. | |||||
| CVE-2026-21848 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | N/A | 5.0 MEDIUM |
| HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries. | |||||
| CVE-2026-56592 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | N/A | 6.5 MEDIUM |
| HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access. | |||||
| CVE-2026-56595 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | N/A | 3.1 LOW |
| HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim. | |||||
| CVE-2026-56597 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | N/A | 3.1 LOW |
| HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets. | |||||
| CVE-2026-21806 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | N/A | 3.1 LOW |
| HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions. | |||||
| CVE-2025-31980 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | N/A | 4.3 MEDIUM |
| HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems. | |||||
| CVE-2026-67100 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-08 | N/A | 9.8 CRITICAL |
| HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations. | |||||
| CVE-2026-67101 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-08 | N/A | 9.3 CRITICAL |
| HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet. | |||||
| CVE-2026-67102 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-08 | N/A | 8.1 HIGH |
| HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles. | |||||
| CVE-2026-67103 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-08 | N/A | 7.6 HIGH |
| HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users. | |||||
| CVE-2025-31958 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. | |||||
| CVE-2025-31981 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 5.3 MEDIUM |
| HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data. | |||||
| CVE-2025-31983 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information. | |||||
| CVE-2025-31984 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.7 LOW |
| HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly. | |||||
| CVE-2025-31976 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 4.8 MEDIUM |
| HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. . | |||||
| CVE-2025-31978 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 4.6 MEDIUM |
| HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content. | |||||
| CVE-2025-31959 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.5 LOW |
| HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. . | |||||
| CVE-2025-31974 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 3.9 LOW |
| HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes. | |||||
| CVE-2025-31975 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-07 | N/A | 2.6 LOW |
| HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities. | |||||