DeutschShown in its original language — a full translation is planned for a future version.
HCL Domino Volt und Leap: Mehrere Schwachstellen
view advisory published 2025-05-18
Ein Angreifer kann mehrere Schwachstellen in HCL Domino ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen und vertrauliche Informationen preiszugeben.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-30146US | low2.7 | — | ||
Improper access control of endpoint in HCL Domino Leap
allows certain admin users to import applications from the
server's filesystem. | ||||
| CVE-2024-30145US | medium6.1 | — | ||
Multiple vectors in HCL Domino Volt and Domino Leap allow client-side
script injection in the authoring environment and deployed applications. | ||||
| CVE-2024-30115US | medium5.4 | — | ||
Insufficient sanitization policy in HCL Leap
allows client-side script injection in the deployed application through the
HTML widget. | ||||
| CVE-2023-45721US | — | — | ||
Insufficient default configuration in HCL Leap
allows anonymous access to directory information. | ||||
| CVE-2023-37535US | medium6.1 | — | ||
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap
allow script injection through query parameters. | ||||
| CVE-2023-37517US | high7.5 | — | ||
Missing "no cache" headers in HCL Leap permits sensitive data to be cached. | ||||
| CVE-2022-42450US | medium5.4 | — | ||
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications. | ||||
| CVE-2022-42449US | medium5.4 | — | ||
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications | ||||
| CVE-2022-27562US | medium5.4 | — | ||
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan