CVE-2025-31960

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-319614.6HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2025-319624.3Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gaiCVE-2025-319633.3Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attaCVE-2025-319644.9Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact sCVE-2025-319658.2Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthCVE-2025-319662.7HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforcedCVE-2025-319696.1HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and bCVE-2025-31977.3Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function eCVE-2025-319706.1HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define stCVE-2025-319715.1AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability.  The issue may allow attackers to launch a server-side request foCVE-2025-319726.5HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which couldCVE-2025-319739.8HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure bas
CVE-2025-31960: Medium severity, CVSS 5.3 | Vulnix