CVE-2025-31985— HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
Possible ATT&CK Techniques 1AI
T1505.003 · Web ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HCL | BigFix Service Management (SM) | 23 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-31985
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
Source: NVD (National Vulnerability Database)
Vulnerability Description
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
HCL BigFix Service Management 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL BigFix Service Management是印度HCL公司的一款IT服务管理与资产运营平台。 HCL BigFix Service Management存在安全漏洞，该漏洞源于安全配置错误，缺少或不安全的X-Content-Type-Options标头可能导致浏览器执行MIME类型嗅探，使恶意内容被错误解释和执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL | BigFix Service Management (SM) | 23 | - |
II. Public POCs for CVE-2025-31985
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-31985
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-31985 (1)
IV. Related Vulnerabilities
Same product: BigFix Service Management (SM)
- CVE-2025-31973
HCL BigFix Service Management (SM) is susceptible to a Conf - CVE-2024-30151
HCL BigFix Service Management (SM) is susceptible to Broken - CVE-2025-31960
HCL BigFix Service Management (SM) is vulnerable to informat - CVE-2025-31974
HCL BigFix Service Management (SM) is susceptible to a Root - CVE-2025-31975
HCL BigFix Service Management (SM) is affected by an Informa
Same vendor: HCL
- CVE-2025-31973
HCL BigFix Service Management (SM) is susceptible to a Conf - CVE-2025-62305
HCL AION is affected by a vulnerability where certain operat - CVE-2025-62317
HCL AION is affected by a vulnerability where sensitive info - CVE-2025-62308
HCL AION is affected by a vulnerability where sensitive back - CVE-2025-62309
HCL AION is affected by a vulnerability where auto-complete
Same weakness: CWE-200
- CVE-2026-8405
IBM Guardium Data Protection is affected by Exposure of Sens - CVE-2026-24198
NVIDIA GPU Display Driver for Linux Race Condition 漏洞 - CVE-2026-9352
NousResearch hermes-agent Messaging Gateway local.py _make_r - CVE-2026-9349
calcom cal.diy Generic React API bookings-single-view.getSer - CVE-2026-40166
authentik: Non-admin user can retrieve confidential OAuth cl
V. Comments for CVE-2025-31985
No comments yet