Hcltech Hcl Leap — known CVE vulnerabilities

Every CVE whose affected-product data names Hcltech Hcl Leap, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (11)

• CVE-2022-38657 — CVSS 8.2 (high): An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
• CVE-2023-37534 — CVSS 7.1 (high): Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
• CVE-2024-30147 — CVSS 6.5 (medium): Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
• CVE-2024-30113 — CVSS 6.3 (medium): Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
• CVE-2023-45720 — CVSS 5.3 (medium): Insufficient default configuration in HCL Leap allows anonymous access to directory information.
• CVE-2022-44760 — CVSS 4.6 (medium): Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.
• CVE-2022-44759 — CVSS 4.6 (medium): Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.
• CVE-2024-30148 — CVSS 4.1 (medium): Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
• CVE-2024-30114 — CVSS 3.7 (low): Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
• CVE-2023-37516 — CVSS 3.2 (low): Missing "no cache" headers in HCL Leap permits user directory information to be cached.
• CVE-2024-30127 — CVSS 3.2 (low): Missing "no cache" headers in HCL Leap permits sensitive data to be cached.