Domino Leap (Hcltech) - vulnerabilities (CVEs)

9 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2025-04-30. Vendor: Hcltech.

CVEs of Domino Leap

• CVE-2023-45721 - CVSS 5.3 (medium), 2025-04-30: Insufficient default configuration in HCL Leap allows anonymous access to directory information.
• CVE-2024-30146 - CVSS 4.1 (medium), 2025-04-30: Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.
• CVE-2023-37535 - CVSS 7.1 (high), 2025-04-30: Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
• CVE-2024-30145 - CVSS 6.5 (medium), 2025-04-30: Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.
• CVE-2024-30115 - CVSS 6.3 (medium), 2025-04-30: Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
• CVE-2022-42450 - CVSS 5.4 (medium), 2025-04-30: Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
• CVE-2023-37517 - CVSS 7.5 (high), 2025-04-30: Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
• CVE-2022-42449 - CVSS 5.4 (medium), 2025-04-30: Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
• CVE-2022-27562 - CVSS 5.4 (medium), 2025-04-30: Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.