Bigfix Webui (Hcltech) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2023-07-18. Vendor: Hcltech.

CVEs of Bigfix Webui

• CVE-2023-28023 - CVSS 6.5 (medium), 2023-07-18: A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access…
• CVE-2023-28021 - CVSS 7.5 (high), 2023-07-18: The BigFix WebUI uses weak cipher suites.
• CVE-2023-28020 - CVSS 6.1 (medium), 2023-07-18:  URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
• CVE-2023-28019 - CVSS 8.8 (high), 2023-07-18: Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
• CVE-2022-38655 - CVSS 6.4 (medium), 2022-12-21: BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES…
• CVE-2021-27764 - CVSS 7.4 (high), 2022-05-06: Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)
• CVE-2020-4104 - CVSS 5.4 (medium), 2020-07-17: HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an…