CVE-2025-31985

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31974

HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only

HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2024-30151

HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability

HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sensitive data or unauthorized system modifications

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31960

HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module

HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31957

HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.

HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31959

HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images.

HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. .

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31975

HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified.

HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31976

HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials

HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. .

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31978

HCL BigFix Service Management (SM) does not adequately sanitize or safely render

HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31984

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-52613

HCL BigFix Service Management (SM) is affected by use of a vulnerable component

HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31983

HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header

HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31982

HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directl

HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31958

HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling

HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31981

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access.  An attacker with access to the network traffic can sniff packets from the connection and uncover the data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31977

A cryptographic weakness has been identified in the HCL BigFix Service Management (SM)

HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.  An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31972

HCL BigFix Service Management (SM) is affected by a Sensitive Information Exposure vulnerability

HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management