CVE-2024-23571

MediumCVSS 4.3/10Last modified Oct 2, 2026

Description

HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-525

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2026
Last modified: Oct 2, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-235724.2HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this i CVE-2024-235733.7HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the CVE-2024-235745.3HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or conf CVE-2024-235755.3HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing CVE-2024-235767.1Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of CVE-2024-235774.3HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requeste CVE-2024-235784.2HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this requ CVE-2024-235796.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the d CVE-2024-23589.8A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vu CVE-2024-235806.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access t CVE-2024-235817.8The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.CVE-2024-235836.7An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Window