CVE-2024-23577

MediumCVSS 4.3/10Last modified Oct 2, 2026

Description

HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2026
Last modified: Oct 2, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-235784.2HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this requ CVE-2024-235796.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the d CVE-2024-23589.8A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vu CVE-2024-235806.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access t CVE-2024-235817.8The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.CVE-2024-235836.7An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Window CVE-2024-235846.6The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry.CVE-2024-235867.5HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker cou CVE-2024-235886.5HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vu CVE-2024-235896.8Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks effi CVE-2024-23599.8A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code.CVE-2024-235909.1Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade