CVE-2025-52620

CVE-2025-52620 affects HCL BigFix SaaS Authentication Service. The vulnerability is a Cross-Site Scripting (XSS) flaw arising from inadequate validation of submitted image formats in the image upload feature. Affected component is the image upload handling; root cause is insufficient validation l...

CVE-2025-52620 HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability

HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting XSS vulnerability. The image upload functionality inadequately validated the submitted image format...

CVE-2025-52620 HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability

HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting XSS vulnerability. The image upload functionality inadequately validated the submitted image format...

CVE-2025-52621 HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning

HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning...

CVE-2025-52621

CVE-2025-52621 affects HCL BigFix SaaS Authentication Service. The issue is a cache-poisoning risk caused by the presence of an Origin header in HTTP responses coupled with an unvalidated reflection of that Origin value. Documents confirm the vulnerability but do not provide attack vectors, explo...

CVE-2025-52621 HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning

HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning...

HCL BigFix SaaS Authentication Service 安全漏洞

HCL BigFix SaaS Authentication Service is an endpoint management platform from HCL India. HCL BigFix SaaS Authentication Service suffers from a security vulnerability that stems from SQL queries that can be manipulated, potentially leading to SQL injection attacks...

PT-2025-33513 · Hcl · Hcl Bigfix Saas Authentication Service

Name of the Vulnerable Software and Affected Versions: HCL BigFix SaaS Authentication Service affected versions not specified Description: HCL BigFix SaaS Authentication Service is affected by a SQL injection issue. The issue allows potential attackers to manipulate SQL queries. Recommendations: ...

HCL BigFix SaaS Authentication Service 安全漏洞

HCL BigFix SaaS Authentication Service is an endpoint management platform from HCL India. A security vulnerability exists in HCL BigFix SaaS Authentication Service that stems from the image upload feature not adequately validating the image format, which could lead to cross-site scripting attacks...

HCL BigFix SaaS Authentication Service 安全漏洞

HCL BigFix SaaS Authentication Service is an endpoint management platform from HCL India. A security vulnerability exists in HCL BigFix SaaS Authentication Service that stems from an unvalidated Origin header value, which could lead to cache poisoning...

HCL BigFix SaaS Authentication Service 安全漏洞

HCL BigFix SaaS Authentication Service is an endpoint management platform from HCL India. A security vulnerability exists in HCL BigFix SaaS Authentication Service that originates from an error message disclosing sensitive version information, which could lead to information leakage...

PT-2025-33510 · Hcl · Hcl Bigfix Saas Authentication Service

Name of the Vulnerable Software and Affected Versions: HCL BigFix SaaS Authentication Service affected versions not specified Description: The HCL BigFix SaaS Authentication Service is susceptible to a sensitive information disclosure. Error messages, under specific circumstances, reveal sensitiv...

MAL-2025-39327 Malicious code in winston-exoplanetology-auth0-geomorphology (npm)

The package winston-exoplanetology-auth0-geomorphology was found to contain malicious code...

The vulnerability of the IAM authentication service for the Kubernetes MinIO Operator STS allows a perpetrator to escalate their privileges and expose protected information.

The vulnerability of the IAM authentication service for the Kubernetes MinIO Operator STS is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to increase their privileges and expose sensitive information...

dirty_sock

dirtysock: Linux Privilege Escalation via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and education. F...

Microsoft Local Security Authority Server 访问控制错误漏洞

Microsoft Local Security Authority Server is an LSA authentication service from Microsoft Corporation USA. An access control error vulnerability exists in Microsoft Local Security Authority Server. An attacker could exploit this vulnerability to cause a denial of service on the system. The...

Apache Kafka 安全漏洞

Apache Kafka is an open source distributed streaming platform from the Apache USA Foundation. The platform is capable of fetching real-time data for building applications that react in real-time to changes in data streams. A security vulnerability exists in Apache Kafka that stems from a...

CVE-2023-2737

Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation...

CVE-2023-20108

A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an unauthenticated, remote attacker to cause a temporary service outage for all Cisco Unified CM IM&P users who are attempting to authenticate to the...

CVE-2018-13257

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...