Hcl Leap
by HCLTech
CVEs (11)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-38657 | Hig | 0.53 | 8.2 | 0.00 | Feb 12, 2023 | An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page. | ||
| CVE-2023-37534 | Hig | 0.46 | 7.1 | 0.00 | Apr 24, 2025 | Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters. | ||
| CVE-2024-30147 | Med | 0.42 | 6.5 | 0.00 | Apr 24, 2025 | Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications. | ||
| CVE-2024-30113 | Med | 0.41 | 6.3 | 0.00 | Apr 24, 2025 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. | ||
| CVE-2023-45720 | Med | 0.34 | 5.3 | 0.00 | Apr 24, 2025 | Insufficient default configuration in HCL Leap allows anonymous access to directory information. | ||
| CVE-2022-44760 | Med | 0.30 | 4.6 | 0.00 | Apr 24, 2025 | Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. | ||
| CVE-2022-44759 | Med | 0.30 | 4.6 | 0.00 | Apr 24, 2025 | Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications. | ||
| CVE-2024-30148 | Med | 0.27 | 4.1 | 0.00 | Apr 24, 2025 | Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem. | ||
| CVE-2024-30114 | Low | 0.24 | 3.7 | 0.00 | Apr 24, 2025 | Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment. | ||
| CVE-2024-30127 | Low | 0.21 | 3.2 | 0.00 | Apr 24, 2025 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. | ||
| CVE-2023-37516 | Low | 0.21 | 3.2 | 0.00 | Apr 24, 2025 | Missing "no cache" headers in HCL Leap permits user directory information to be cached. |
- risk 0.53cvss 8.2epss 0.00
An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
- risk 0.46cvss 7.1epss 0.00
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
- risk 0.42cvss 6.5epss 0.00
Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
- risk 0.41cvss 6.3epss 0.00
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
- risk 0.34cvss 5.3epss 0.00
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
- risk 0.30cvss 4.6epss 0.00
Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.
- risk 0.30cvss 4.6epss 0.00
Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.
- risk 0.27cvss 4.1epss 0.00
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
- risk 0.24cvss 3.7epss 0.00
Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
- risk 0.21cvss 3.2epss 0.00
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
- risk 0.21cvss 3.2epss 0.00
Missing "no cache" headers in HCL Leap permits user directory information to be cached.