Bigfix Mobile (Hcltech) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 7 known versions, newest CVE from 2025-10-16. Vendor: Hcltech.
CVEs of Bigfix Mobile
- CVE-2025-0277 - CVSS 6.5 (medium), 2025-10-16: HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into…
- CVE-2025-0276 - CVSS 6.5 (medium), 2025-10-16: HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker…
- CVE-2025-0275 - CVSS 5.3 (medium), 2025-10-16: HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially…
- CVE-2025-0274 - CVSS 5.3 (medium), 2025-10-16: HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint…
- CVE-2023-28012 - CVSS 8.8 (high), 2023-07-27: HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.
- CVE-2023-28014 - CVSS 6.6 (medium), 2023-07-27: HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.
- CVE-2021-27782 - CVSS 7.5 (high), 2023-01-20: HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
- CVE-2021-27780 - CVSS 5.3 (medium), 2022-05-27: The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
- CVE-2021-27781 - CVSS 6.6 (medium), 2022-05-27: The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
- CVE-2021-27783 - CVSS 6.8 (medium), 2022-05-25: User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
