There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).

HCL VersionVault Express exposes administrator credentials.

Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.

HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.

HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.

HCL Launch may store certain data for recurring activities in a plain text format.