Hcl Bigfix Mobile
Monthly
Reflected XSS in HCL BigFix Mobile allows authenticated attackers to inject and execute malicious scripts in the browsers of other authenticated users by crafting malicious URLs containing unsanitized payloads. The CVSS Scope:Changed attribute (S:C) indicates the injected script executes outside the vulnerable component's security boundary - enabling session hijacking, credential theft, or unauthorized administrative actions against higher-privileged victims. No public exploit code and no CISA KEV listing exist at time of analysis, though the vendor has self-disclosed via advisory KB0132661.
HCL BigFix Mobile leaks sensitive application internals through verbose error messages and improper exception handling, enabling authenticated network users to harvest stack traces, internal paths, or configuration details that materially assist reconnaissance. Confirmed by HCL under CVSS 4.3 (AV:N/AC:L/PR:L), the flaw requires only a low-privileged account to exploit and produces no integrity or availability impact - purely a confidentiality concern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Reflected XSS in HCL BigFix Mobile allows authenticated attackers to inject and execute malicious scripts in the browsers of other authenticated users by crafting malicious URLs containing unsanitized payloads. The CVSS Scope:Changed attribute (S:C) indicates the injected script executes outside the vulnerable component's security boundary - enabling session hijacking, credential theft, or unauthorized administrative actions against higher-privileged victims. No public exploit code and no CISA KEV listing exist at time of analysis, though the vendor has self-disclosed via advisory KB0132661.
HCL BigFix Mobile leaks sensitive application internals through verbose error messages and improper exception handling, enabling authenticated network users to harvest stack traces, internal paths, or configuration details that materially assist reconnaissance. Confirmed by HCL under CVSS 4.3 (AV:N/AC:L/PR:L), the flaw requires only a low-privileged account to exploit and produces no integrity or availability impact - purely a confidentiality concern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.