Hcltech Hcl Leap vulnerabilities

11 CVEs affecting Hcltech Hcl Leap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-30127, published 2025-04-24.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-45720, published 2025-04-24. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient default configuration in HCL Leap allows anonymous access to directory information.
• CVE-2024-30113, published 2025-04-24. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
• CVE-2022-38657, published 2023-02-12. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
• CVE-2022-44760, published 2025-04-24. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.
• CVE-2024-30148, published 2025-04-24. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
• CVE-2024-30147, published 2025-04-24. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.
• CVE-2024-30114, published 2025-04-24. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
• CVE-2023-37534, published 2025-04-24. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.
• CVE-2022-44759, published 2025-04-24. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.
• CVE-2024-30127, published 2025-04-24. Low severity, CVSS 3.2. EPSS: 0.2% chance of exploitation in the next 30 days. Missing "no cache" headers in HCL Leap permits sensitive data to be cached.

Latest

• CVE-2023-37516, published 2025-04-24. Low severity, CVSS 3.2. EPSS: 0.2% chance of exploitation in the next 30 days. Missing "no cache" headers in HCL Leap permits user directory information to be cached.