HCL BigFix Service Management vulnerabilities

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior.

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

HCL BigFix Service Management is affected by SQL Injection and Cross-Tenant Data Exposure vulnerabilities, which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability where the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints. This information could enable an attacker to facilitate further attacks.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks.

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems.

HCL BigFix Service Management has an information disclosure vulnerability because two exposed API endpoints return sensitive data, potentially enabling further serious attacks.

HCL BigFix Service Management is affected by an insecure communication vulnerability that allows an attacker with internal network access to intercept unencrypted HTTP traffic between backend services. This enables the extraction of sensitive data and potential man-in-the-middle attacks.

HCL BigFix Service Management has an information disclosure vulnerability that allows an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling discovery of hidden administrative API endpoints.

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject and store malicious scripts within the application. These scripts execute when a victim views the affected page, enabling session hijacking and theft of sensitive data.

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers.

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets.

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.

Security Misconfiguration vulnerability in HCL BigFix Service Management. An authenticated attacker could exploit improper access controls, enabling unauthorized viewing of restricted data elements across tenant boundaries.

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability. A low-privileged user could gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.

Missing or insecure X-Content-Type-Options header in HCL BigFix Service Management (SM) allows browsers to perform MIME-type sniffing. This could cause malicious content to be interpreted and executed incorrectly.

HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment.

HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only issue. An improperly configured root file system may allow unintended modifications to critical system components.

HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.

HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.

HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.

HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.

HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software.

The vulnerability in HCL BigFix Service Management (SM) involves insufficiently protected credentials for a short duration during communication with a backend internal application. This could allow an attacker to intercept and misuse them if exfiltrated.

HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities.

HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared.

HCL BigFix Service Management (SM) is affected by a Cross-Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.

HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.