6.5
Medium
CVE-2024-30147 Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications
Description
Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| HCL Leap 9.3 | earliest → < 9.3.8 | 9.3.8 |
Other CVEs of HCL Leap
The 10 CVEs of HCL Leap →
CVE-2022-44759
Improper sanitization of SVG files in HCL Leap
allows client-side script injection in deployed applications
4.6
Medium
CVE-2022-44760
Unsafe default file type filter policy in HCL
Leap allows execution of unsafe JavaScript in deployed applications
4.6
Medium
CVE-2023-37516
Missing "no cache" headers in HCL Leap permits user directory information to be cached
3.2
Low
CVE-2024-30127
Missing "no cache" headers in HCL Leap permits sensitive data to be cached
3.2
Low