Every CVE whose affected-product data names Hcltech Domino Leap, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (9)
CVE-2023-37535 — CVSS 7.1 (high): Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
CVE-2024-30145 — CVSS 6.5 (medium): Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed…
CVE-2024-30115 — CVSS 6.3 (medium): Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
CVE-2022-27562 — CVSS 4.6 (medium): Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed…
CVE-2022-42449 — CVSS 4.6 (medium): Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed…
CVE-2022-42450 — CVSS 4.6 (medium): Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
CVE-2024-30146 — CVSS 4.1 (medium): Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.