Bigfix Compliance
Vendor:
First CVE: Mar 4, 2022 · Active for 4 years
9
Total CVEs
More Total CVEs than 88% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
5.4
Avg CVSS
Higher Avg CVSS than 13% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Bigfix Compliance over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 4, 2022
4 years ago
Most Recent CVE
Jan 28, 2026
181 days ago
CVE Severity & Scoring
Bigfix Compliance9 CVEs
11%
78%
11%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local2 (22.2%)
Network7 (77.8%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (77.8%)
High2 (22.2%)
Unknown0 (0.0%)
User Interaction
None5 (55.6%)
Unknown0 (0.0%)
Required4 (44.4%)
Privileges Required
Low2 (22.2%)
High0 (0.0%)
None7 (77.8%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-27756HIGH "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later dec | Mar 4, 2022 | 7.5 | 24 | NO | NO |
CVE-2023-37525MEDIUM A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configurati | Jan 28, 2026 | 5.3 | 19 | NO | NO |
CVE-2024-30125MEDIUM HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die. | Jul 18, 2024 | 6.2 | 18 | NO | NO |
CVE-2024-42213MEDIUM HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing or retrieved via pre | May 5, 2025 | 5.3 | 17 | NO | NO |
CVE-2024-30140MEDIUM HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the web cache and provide | Nov 7, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-42212MEDIUM HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a us | May 5, 2025 | 5.4 | 16 | NO | NO |
CVE-2024-30141MEDIUM HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement information or expose info | Nov 7, 2024 | 4.7 | 16 | NO | NO |
CVE-2024-30126MEDIUM HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target website in a frame or if | Jul 18, 2024 | 4.7 | 16 | NO | NO |
HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized acce | Nov 7, 2024 | 3.8 | 14 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Bigfix Compliance
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.0.9 | 1 | 5.3 | 0.3% | 0 | 0 |
| 2.0.12 | 2 | 5.3 | 0.3% | 0 | 0 |
| 2.0.11 | 3 | 4.6 | 0.2% | 0 | 0 |