CVSS: 9.0EPSS: 1%CPEs: 4EXPL: 0CVE-2023-37536 – HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3
https://notcve.org/view.php?id=CVE-2023-37536
11 Oct 2023 — An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. Un desbordamiento de enteros de xerces-c++ 3.2.3 en BigFix Platform permite a atacantes remotos provocar acceso fuera de límites a través de una solicitud HTTP. An integer overflow exists in xerces-c++. This flaw allows an attacker using a specially crafted HTTP request payload to trigger an out-of-bounds read, resulting in a loss of confidentiality, integrity, and availability. ... • https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html • CWE-190: Integer Overflow or Wraparound CWE-680: Integer Overflow to Buffer Overflow •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14248
https://notcve.org/view.php?id=CVE-2020-14248
16 Dec 2020 — BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. BigFix Inventory versiones hasta v10.0.2, no establece el indicador de seguridad para la cookie de sesión en una sesión https, lo que puede causar que la cookie se envíe en peticiones http y facilita a unos atacantes remotos capturar esta cookie • https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085735 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14254
https://notcve.org/view.php?id=CVE-2020-14254
16 Dec 2020 — TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it. Los conjuntos de cifrado TLS-RSA no están deshabilitados en HCL BigFix Inventory versiones hasta v10.0.2. Si TLS versión 2.0 y los cifrados seguros no están habilitados, un atacante puede registrar el tráfico de forma pasiva y luego descifrarlo • https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085733 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-4095
https://notcve.org/view.php?id=CVE-2020-4095
16 Jul 2020 — "BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access." BigFix Platform está almacenando credenciales de texto sin cifrar dentro de la memoria del sistema. • https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080772 • CWE-312: Cleartext Storage of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-4058
https://notcve.org/view.php?id=CVE-2019-4058
20 May 2019 — IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to administrators. IBM X-Force ID: 156570. IBM BigFix Platform 9.2 y 9.5 podría permitir que un usuario con pocos privilegios manipule la Interfaz de Usuario para exponer los elementos de la interfaz y la información normalmente restringida a los administradores. ID de IBM X-Force: 156570. • https://exchange.xforce.ibmcloud.com/vulnerabilities/156570 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2019-4011
https://notcve.org/view.php?id=CVE-2019-4011
20 May 2019 — IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885. IBM BigFix Platform 9.2 y 9.5 es vulnerable a una secuencia de comandos del tipo cross-site. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la Interfaz de Usuario Web, por lo tanto, alt... • https://exchange.xforce.ibmcloud.com/vulnerabilities/155885 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2005
https://notcve.org/view.php?id=CVE-2018-2005
20 May 2019 — IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IBM X-Force ID: 155007 IBM BigFix Platform 9.2 y 9.5 almacena información potencialmente confidencial en la memoria de proceso que puede ser leída por un atacante local con permisos elevados. ID de IBM X-Force: 155007 • https://exchange.xforce.ibmcloud.com/vulnerabilities/155007 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 59%CPEs: 2EXPL: 1CVE-2019-4061 – IBM BigFix Relay Server Sites and Package Enum
https://notcve.org/view.php?id=CVE-2019-4061
27 Feb 2019 — IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associated sites due to not enabling authenticated access. IBM X-Force ID: 156869. IBM BigFix Platform, en sus versiones 9.2 y 9.5, podría permitir a un atacante consultar el relay de manera remota y obtener información sobre las actualizaciones y fixlets desplegados en los sitios asociados debido a la no habilitación de un acceso autenticado. IBM X-Force I... • https://packetstorm.news/files/id/180698 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1474
https://notcve.org/view.php?id=CVE-2018-1474
12 Dec 2018 — IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information. IBM X-force ID: 140692. IBM BigFi... • https://exchange.xforce.ibmcloud.com/vulnerabilities/140692 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1476
https://notcve.org/view.php?id=CVE-2018-1476
12 Dec 2018 — IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 140757. IBM BigFix Platform, desde la versión 9.2.0 hasta la 9.2.14 y desde la versión 9.5 hasta la 9.5.9, divulga información sensible a usuarios no autorizados. Esta información puede emplearse para ejecutar más ataques en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/140757 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •