Approved changes feed: RSS · Atom
cpe:2.3:a:hcl_software:dfxserver:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hcl Software (ae8892dc-f7dc-53a3-b2bf-67149bcc5847) |
|---|---|
| Product | Dfxserver (1b743e38-9e79-5c01-a62b-168cfb6fe235) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-35149 |
vulnerable | 2026-07-29 00:43:25.133002 |
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
HIGH (8.2)
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.
Published: 2026-07-16T11:03:06.446Z
Updated: 2026-07-16T12:06:39.721Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35148 |
vulnerable | 2026-07-29 00:43:25.132878 |
HCL DFXServer is affected by a Missing Access Control vulnerability
MEDIUM (6.3)
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.
Published: 2026-07-16T11:02:19.807Z
Updated: 2026-07-16T12:07:24.658Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35147 |
vulnerable | 2026-07-29 00:43:25.132692 |
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
HIGH (8.2)
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.
Published: 2026-07-16T11:04:00.743Z
Updated: 2026-07-16T11:56:23.129Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.