| CVE-2022-44759 |
Improper sanitization of SVG files in HCL Leap
allows client-side script injection in deployed applications
|
4.6
Medium
|
Apr 24, 2025 |
| CVE-2022-44760 |
Unsafe default file type filter policy in HCL
Leap allows execution of unsafe JavaScript in deployed applications
|
4.6
Medium
|
Apr 24, 2025 |
| CVE-2023-37516 |
Missing "no cache" headers in HCL Leap permits user directory information to be cached
|
3.2
Low
|
Apr 24, 2025 |
| CVE-2024-30127 |
Missing "no cache" headers in HCL Leap permits sensitive data to be cached
|
3.2
Low
|
Apr 24, 2025 |
| CVE-2023-37534 |
Insufficient URI protocol whitelist in HCL Leap
allows script injection through query parameters
|
7.1
High
|
Apr 24, 2025 |
| CVE-2023-45720 |
Insufficient default configuration in HCL Leap
allows anonymous access to directory information
|
5.3
Medium
|
Apr 24, 2025 |
| CVE-2024-30113 |
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the…
|
6.3
Medium
|
Apr 24, 2025 |
| CVE-2024-30114 |
Insufficient sanitization in HCL Leap allows
client-side script injection in the authoring environment
|
3.7
Low
|
Apr 24, 2025 |
| CVE-2024-30147 |
Multiple vectors in HCL Leap allow client-side
script injection in the authoring environment and deployed applications
|
6.5
Medium
|
Apr 24, 2025 |
| CVE-2024-30148 |
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's…
|
4.1
Medium
|
Apr 24, 2025 |