CVE-2024-23574

MediumCVSS 5.3/10Last modified Oct 2, 2026

Description

HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system. Use renumeration is when a malicious actor can use brute-force techniques to either guess or confirm valid users in a system

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

Vendor	Product	Versions
HCLSoftware	Aftermarket EPC	version 1.0.0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294

Timeline

Published: Jul 17, 2026
Last modified: Oct 2, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-235755.3HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing CVE-2024-235767.1Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of CVE-2024-235774.3HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requeste CVE-2024-235784.2HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this requ CVE-2024-235796.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the d CVE-2024-23589.8A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vu CVE-2024-235806.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access t CVE-2024-235817.8The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.CVE-2024-235836.7An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Window CVE-2024-235846.6The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry.CVE-2024-235867.5HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker cou CVE-2024-235886.5HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vu