CVE-2026-67171

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

HCL BigFix Service Management is affected by SQL Injection and Cross-Tenant Data Exposure vulnerabilities, which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability where the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints. This information could enable an attacker to facilitate further attacks.

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems.

HCL BigFix Service Management has an information disclosure vulnerability because two exposed API endpoints return sensitive data, potentially enabling further serious attacks.

HCL BigFix Service Management is affected by an insecure communication vulnerability that allows an attacker with internal network access to intercept unencrypted HTTP traffic between backend services. This enables the extraction of sensitive data and potential man-in-the-middle attacks.

HCL BigFix Service Management has an information disclosure vulnerability that allows an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling discovery of hidden administrative API endpoints.

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject and store malicious scripts within the application. These scripts execute when a victim views the affected page, enabling session hijacking and theft of sensitive data.

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers.