CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2023-37536 – HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3
https://notcve.org/view.php?id=CVE-2023-37536
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. Un desbordamiento de enteros de xerces-c++ 3.2.3 en BigFix Platform permite a atacantes remotos provocar acceso fuera de límites a través de una solicitud HTTP. An integer overflow exists in xerces-c++. This flaw allows an attacker using a specially crafted HTTP request payload to trigger an out-of-bounds read, resulting in a loss of confidentiality, integrity, and availability. • https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAOSSJ72CUJ535VRWTCVQKUYT2LYR3OM https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107791 https://access.redhat.com/security • CWE-190: Integer Overflow or Wraparound CWE-680: Integer Overflow to Buffer Overflow •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14248
https://notcve.org/view.php?id=CVE-2020-14248
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. BigFix Inventory versiones hasta v10.0.2, no establece el indicador de seguridad para la cookie de sesión en una sesión https, lo que puede causar que la cookie se envíe en peticiones http y facilita a unos atacantes remotos capturar esta cookie • https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085735 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14254
https://notcve.org/view.php?id=CVE-2020-14254
TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it. Los conjuntos de cifrado TLS-RSA no están deshabilitados en HCL BigFix Inventory versiones hasta v10.0.2. Si TLS versión 2.0 y los cifrados seguros no están habilitados, un atacante puede registrar el tráfico de forma pasiva y luego descifrarlo • https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085733 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2016-0291
https://notcve.org/view.php?id=CVE-2016-0291
IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302. IBM BigFix Platform 9.0, versiones 9.1 anteriores a la 9.1.8 y versiones 9.2 anteriores a la 9.2.8, permite que usuarios autenticados remotos ejecuten comandos arbitrarios aprovechando el acceso al servidor de informes. IBM X-Force ID: 111302. • http://www-01.ibm.com/support/docview.wss?uid=swg21985748 https://exchange.xforce.ibmcloud.com/vulnerabilities/111302 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-0295
https://notcve.org/view.php?id=CVE-2016-0295
Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111363. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en IBM BigFix Platform 9.0, 9.1, 9.2 y versiones 9.5 anteriores a la 9.5.2 permite que atacantes remotos secuestren la autenticación de usuarios arbitrarios para peticiones que inserten secuencias XSS. IBM X-Force ID: 111363. • http://www-01.ibm.com/support/docview.wss?uid=swg21985830 https://exchange.xforce.ibmcloud.com/vulnerabilities/111363 • CWE-352: Cross-Site Request Forgery (CSRF) •