Skip to content
OpenAdvisories
Medium WID-SEC-2025-1095 9 CVEs

HCL Domino Volt und Leap: Mehrere Schwachstellen

Published May 18, 2025 · Updated May 18, 2025 · de-DE

Vendor: HCL Software Product: Domino Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in HCL Domino ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen und vertrauliche Informationen preiszugeben.

Product

Domino bietet Unternehmens-E-Mail, sowie Kollaborations-Funktionen und eine Anwendungs-Plattform.

Vulnerabilities 9

  • High 7.1
    CVE-2023-37535

    HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability

    Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.

    HCL Software HCL Domino Leap
  • Medium 6.5
    CVE-2024-30145

    HCL Domino Volt and Domino Leap are affected by a cross-site scripting (XSS) vulnerability

    Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.

    HCL Software HCL Domino Leap
  • Medium 6.3
    CVE-2024-30115

    HCL Domino Volt and Domino Leap are affected by a cross-site scripting (XSS) vulnerability

    Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.

    HCL Software HCL Domino Leap
  • Medium 5.3
    CVE-2023-45721

    HCL Domino Volt and Domino Leap are affected by a disclosure of private personal information vulnerability

    Insufficient default configuration in HCL Leap allows anonymous access to directory information.

    HCL Software HCL Domino Leap
  • Medium 4.6
    CVE-2022-27562

    HCL Domino Volt is affected by an unrestricted upload of a dangerous file type

    Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.

    HCL Software HCL Domino Volt
  • Medium 4.6
    CVE-2022-42449

    HCL Domino Volt is affected by an unrestricted upload of a dangerous file type

    Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications

    HCL Software HCL Domino Volt
  • Medium 4.6
    CVE-2022-42450

    HCL Domino Volt is affected by Cross-site scripting (XSS)

    Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.

    HCL Software HCL Domino Volt
  • Medium 4.1
    CVE-2024-30146

    HCL Domino Leap is affected by improper access control

    Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.

    HCL Software HCL Domino Leap
  • Low 3.2
    CVE-2023-37517

    HCL Domino Volt and Domino Leap are affected by missing "no cache" headers

    Missing "no cache" headers in HCL Leap permits sensitive data to be cached.

    HCL Software HCL Domino Leap

Revision history

  1. #1

    Initiale Fassung

References