CVE-2026-56454

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application leaks sensitive information about its internal file structure through unhandled errors, logs, or debug output, allowing a remote attacker to map the server environment.

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive.

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter HTTP responses to bypass authentication and authorization controls, gaining unauthorized access to user accounts.

HCL DFXAnalytics is missing the HTTP Strict-Transport-Security (HSTS) header, allowing a remote attacker to downgrade the connection to unencrypted HTTP and perform man-in-the-middle (MitM) attacks.

The vulnerability in HCL DFXAnalytics is due to the missing SameSite attribute on session cookies generated during authentication. This could allow a remote attacker to perform Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. A remote attacker can intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access.

HCL DFXAnalytics fails to set the "secure" attribute on session cookies generated during authentication. This vulnerability allows a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.