BigFix Inventory up to v10.0.2 does have a session cookie issue

where to buy modafinil online reddit Overview :
HCL BigFix Inventory does not enforce “secure” attribute for SSO related cookies when SSO is enabled. Web browsers might expose cookie via unsecured channel when end user is already logged in the application and enters manually http URL instead of https. The cookie might be used to get access to specific information. It is not sufficient to get access to the HCL BigFix Inventory application.
buy canibus Lyrical law Affected Product(s) :
  • BigFix Inventory v9.x and v10.0.x
Vulnerability Details :
CVE ID : CVE-2020-14248
BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Solution :

Upgrade to version 10.0.3 or later using the following procedure:

  • In the BigFix Console, expand the BigFix Inventory node under Sites node in the tree panel.
  • Click Fixlets and Tasks node. Fixlets and Tasks panel will be displayed on the right.
  • In the Fixlets and Tasks panel locate Upgrade to the latest version of BigFix Inventory 10.x fixlet and run it against the computer that hosts your server.

Note: BigFix Inventory v10 is continuation for v9 as well. Standard application update can be run on top of both v10 and v9.

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2023-4291 : Frauscher Sensortechnik FDS101 For FAdC 1.4.24 Code Injection

CVE-2023-4291 : Frauscher Sensortechnik FDS101 For FAdC 1.4.24 Code Injection

Description Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE)

CVE-2023-2163 : Linux Kernel 5.4 BPF kernel/bpf/verifier.c backtrack_insn calculation

CVE-2023-2163 : Linux Kernel 5.4 BPF kernel/bpf/verifier.c backtrack_insn calculation

Description Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe,

CVE-2023-42454 : SQLpage Up To 0.11.0 Database Connection String sqlpage/sqlpage.json Information Disclosure

CVE-2023-42454 : SQLpage Up To 0.11.0 Database Connection String sqlpage/sqlpage.json Information Disclosure

Description SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly,