Bigfix Compliance (Hcltech) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 8 known versions, newest CVE from 2026-01-28. Vendor: Hcltech.
CVEs of Bigfix Compliance
- CVE-2023-37525 - CVSS 5.3 (medium), 2026-01-28: A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class…
- CVE-2024-42212 - CVSS 5.4 (medium), 2025-05-05: HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious…
- CVE-2024-42213 - CVSS 5.3 (medium), 2025-05-05: HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing…
- CVE-2024-30140 - CVSS 5.4 (medium), 2024-11-07: HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the…
- CVE-2024-30142 - CVSS 3.8 (low), 2024-11-07: HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting…
- CVE-2024-30141 - CVSS 4.7 (medium), 2024-11-07: HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement…
- CVE-2024-30126 - CVSS 4.7 (medium), 2024-07-18: HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target…
- CVE-2024-30125 - CVSS 6.2 (medium), 2024-07-18: HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.
- CVE-2024-23551 - CVSS 6.5 (medium), 2024-05-07: Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as…
- CVE-2021-27756 - CVSS 7.5 (high), 2022-03-04: "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record…
