CVE-2022-44757

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
HCL Software	BigFix Insights for Vulnerability Remediation	<=2.0.2

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108005Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108005Vendor Advisory

Timeline

Published: Oct 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-447585.3BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that CVE-2022-447595.4Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.CVE-2022-44765.4The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them ba CVE-2022-447604.6Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.CVE-2022-44775.4The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outpu CVE-2022-44785.4The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in CVE-2022-447848.8An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Ax CVE-2022-447859.8An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, so CVE-2022-447867.5An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the hre CVE-2022-447876.1An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scripting issue. The id CVE-2022-447886.5An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that is CVE-2022-447898.8A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code E