CVE-2024-23568: Exposure of Sensitive Information to an Unauthorized Actor

HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software could allow an attacker to determine which vulnerabilities are present in the software, particularly if an outdated...

CVE-2024-23567: Guessable CAPTCHA

HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local...

CVE-2024-23566: Guessable CAPTCHA

HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated attacks & account enumeration...

CVE-2024-23565: Improper Control of Interaction Frequency

HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program...

CVE-2024-23564: Inadequate Encryption Strength

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verif...

CVE-2026-21770: Uncontrolled Search Path Element

HCL Traveler for Microsoft Outlook HTMO is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content...

CVE-2024-23572: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function...

PT-2026-60816

Name of the Vulnerable Software and Affected Versions HCL DevOps Loop affected versions not specified Description HCL DevOps Loop contains a Cross-Origin Resource Sharing CORS misconfiguration. CORS is a security mechanism that allows restricted resources on a web page to be requested from anothe...

PT-2026-60818

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions...

PT-2026-60755

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The server is not configured with the X-XSS-Protection header, which is a security feature designed to stop pages from loading when they detect reflected cross-site scripting XSS...

PT-2026-60749

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application passes sensitive data through URL parameters during normal usage via the GET method. This practice can lead to the exposure of sensitive information as it may be...

PT-2026-60713

HCL Traveler for Microsoft Outlook HTMO is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content...

PT-2026-60763

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application implements an HTML5 cross-origin resource sharing CORS policy that allows access from any domain using a wildcard . CORS is a mechanism that allows restricted...

CVE-2024-42214: Incomplete Denylist to Cross-Site Scripting

HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the Web server which allows an attacker to narrow and intensify their efforts...

CVE-2026-56453

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to...

CVE-2026-56455

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service DoS. The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become...

CVE-2026-56456

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...

CVE-2026-35145

HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security HSTS policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted...

CVE-2026-35140

HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session SSL Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive...

CVE-2026-35143

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery CSRF attacks if additional mitigations,...