CVE-2024-30115

CVE-2024-30115 affects HCL Leap (and related Domino Leap) with an insufficient sanitization policy that allows client-side script injection through the HTML widget. Concrete details across sources indicate an XSS risk, but the available documents do not specify affected versions or a confirmed ex...

CVE-2023-37517

The CVE-2023-37517 entry concerns HCL Leap (and Domino Leap per CVE context) with a missing no-cache header, allowing sensitive data to be cached. Root cause stated is absence of cache-control/no-cache headers, leading to potential exposure of confidential data. Connected sources confirm affected...

CVE-2023-45721

CVE-2023-45721 concerns HCL Leap (and related references note HCL Domino Leap) with insufficient default configuration that permits anonymous access to directory information. Connected sources corroborate the issue in HCL Leap, describe it as a disclosure of private information due to misconfigur...

CVE-2024-30146

The CVE-2024-30146 entry concerns HCL Domino Leap. Affected component: the endpoint handling import of applications. Root cause: improper access control allowing certain admin users to import applications from the server’s filesystem. Impact as described: potential unauthorized filesystem access ...

CVE-2024-30145

CVE-2024-30145 affects HCL Domino Volt and Domino Leap with multiple vectors enabling client-side script injection (XSS) in the authoring environment and deployed applications. Connected sources confirm XSS via web interfaces; no concrete exploit details or patch/version information are provided ...

CVE-2022-42449

CVE-2022-42449 affects HCL Domino Volt. The root cause is an unsafe default file-type filtering policy that allows uploading .html files, enabling execution of unsafe JavaScript in deployed applications. Documents consistently describe the issue but do not provide a confirmed patch version or rem...

CVE-2022-27562

CVE-2022-27562 is reported across multiple sources as a vulnerability in HCL Domino Volt caused by an unsafe default file-type filtering policy. This policy allows uploading of .html files and the execution of unsafe JavaScript in deployed applications, without publicly documented a fix in the co...

CVE-2022-42450

CVE-2022-42450 concerns HCL Domino Volt. The issue is improper sanitization of SVG files in deployed Domino Volt applications, enabling client-side script injection (XSS) via SVG content. Documents specify CVSS base scores (NVD: 5.4/ MEDIUM; with UI:R, S:C, etc.; user interaction required) but do...

CVE-2023-37535

CVE-2023-37535 affects HCL Domino Volt and Domino Leap. The root cause is an insufficient URI protocol whitelist that enables script injection via query parameters. Documented impact includes potential cross-site scripting through parameter handling; exploitation status is not detailed in the pro...