TI-2022-18190 CVE-2022-38657 · GHSA-r2v5-26v2-6cc4
An open redirect to malicious sites affects HCL Leap
Priority LOW 37
An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
HCL Software
Records662All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical66CVSS 9.0–10.0
CVSS high157CVSS 7.0–8.9
Exploited now
HCL Software records in CISA KEVNo HCL Software vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records in Hcl Leap · all components
TI-2023-19133 CVE-2023-37534 · GHSA-3xw2-8cp9-9v42
HCL Leap is affected by a Cross-site scripting (XSS) vulnerability
Priority LOW 31
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
TI-2023-24502 CVE-2023-45720 · GHSA-4jwf-g2r8-5pw8
HCL Leap is affected by a disclosure of private personal information vulnerability
Priority LOW 30
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
TI-2024-19899 CVE-2024-30147 · GHSA-hhc9-9q7r-34hx
HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Priority LOW 28
Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
TI-2024-19874 CVE-2024-30113 · GHSA-xj3r-qq7w-cg2x
HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Priority LOW 28
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
TI-2024-19875 CVE-2024-30114 · GHSA-7qm6-898w-x6x4
HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Priority LOW 24
Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
TI-2022-22048 CVE-2022-44759 · GHSA-7928-xx56-23g7
HCL Leap is affected by Cross-site scripting (XSS)
Priority LOW 24
Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.
TI-2022-22049 CVE-2022-44760 · GHSA-mw98-rfjc-q8w9
HCL Leap is affected by an unrestricted upload of file with dangerous type vulnerability
Priority LOW 21
Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.
TI-2024-19900 CVE-2024-30148 · GHSA-3c2j-rv98-w4xf
HCL Leap is affected by improper access control
Priority LOW 19
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
TI-2024-19885 CVE-2024-30127 · GHSA-583r-5m7h-h9qf
HCL Leap is affected by missing "no cache" headers
Priority LOW 15
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
TI-2023-19115 CVE-2023-37516 · GHSA-r77m-qpx3-mpgm
HCL Leap is affected by missing "no cache" headers
Priority LOW 15
Missing "no cache" headers in HCL Leap permits user directory information to be cached.