| CVE-2024-30147 | 보통6.1 | Multiple vectors in HCL Leap allow client-side
script injection in the authoring environment and deployed applications. | 24/04/2025 |
| CVE-2024-30114 | 보통5.4 | Insufficient sanitization in HCL Leap allows
client-side script injection in the authoring environment. | 24/04/2025 |
| CVE-2024-30113 | 보통5.4 | Insufficient sanitization policy in HCL Leap
allows client-side script injection in the deployed application through the
HTML widget. | 24/04/2025 |
| CVE-2023-45720 | 보통5.3 | Insufficient default configuration in HCL Leap
allows anonymous access to directory information. | 24/04/2025 |
| CVE-2023-37534 | 보통6.1 | Insufficient URI protocol whitelist in HCL Leap
allows script injection through query parameters. | 24/04/2025 |
| CVE-2024-30148 | 보통4.1 | Improper access control of endpoint in HCL Leap
allows certain admin users to import applications from the
server's filesystem. | 24/04/2025 |
| CVE-2024-42178 | 높음7.5 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential information, creating a risk of misuse, manipulation, or unauthorized distribution. | 17/04/2025 |
| CVE-2024-42177 | 보통6.4 | HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept and decrypt encrypted data, steal sensitive information, or inject malicious code into the system. | 17/04/2025 |
| CVE-2024-42193 | 높음8.1 | HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability could potentially lead to unauthorized access. | 15/04/2025 |
| CVE-2024-42200 | 보통5.4 | HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input. | 15/04/2025 |
| CVE-2024-42189 | 보통6.5 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. | 15/04/2025 |
| CVE-2024-42208 | 낮음3.5 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data. | 04/04/2025 |
| CVE-2025-0279 | 보통4.3 | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch target | 03/04/2025 |
| CVE-2025-0278 | 보통4.3 | HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests. | 03/04/2025 |
| CVE-2024-30155 | 보통4.3 | HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF). | 26/03/2025 |
| CVE-2024-42176 | 높음8.0 | HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive information. | 19/03/2025 |
| CVE-2024-30154 | 보통5.7 | HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | 03/03/2025 |
| CVE-2024-30150 | 심각9.1 | HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated users. | 25/02/2025 |
| CVE-2024-23563 | 보통4.4 | HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data. | 12/02/2025 |
| CVE-2024-42207 | 보통6.0 | HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session. | 05/02/2025 |