CVE-2024-23565

MediumCVSS 5.3/10Last modified Oct 2, 2026

Description

HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-799

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-235666.5HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various securityCVE-2024-235674.3HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL paraCVE-2024-235685.3HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. DisplaCVE-2024-235694.3HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" headerCVE-2024-23576.5The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is confiCVE-2024-235704.3HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulneraCVE-2024-235714.3HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to whichCVE-2024-235724.2HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this iCVE-2024-235733.7HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects theCVE-2024-235745.3HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confCVE-2024-235755.3HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processingCVE-2024-235767.1Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of