Hcltech Domino Leap vulnerabilities

9 CVEs affecting Hcltech Domino Leap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-30146, published 2025-04-30.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-45721, published 2025-04-30. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient default configuration in HCL Leap allows anonymous access to directory information.
• CVE-2022-42449, published 2025-04-30. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
• CVE-2022-27562, published 2025-04-30. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.
• CVE-2024-30145, published 2025-04-30. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.
• CVE-2024-30115, published 2025-04-30. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
• CVE-2023-37535, published 2025-04-30. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
• CVE-2023-37517, published 2025-04-30. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
• CVE-2022-42450, published 2025-04-30. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
• CVE-2024-30146, published 2025-04-30. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.