CVE-2022-42449

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 30, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-42454.3A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequenCVE-2022-424505.4Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-424514.4Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged usCVE-2022-424525.4HCL Launch is vulnerable to HTML injection.  HTML code is stored and included without being sanitized. This can lead to further attacks suchCVE-2022-424536.5There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the loCVE-2022-424545.3Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.  This requiCVE-2022-424557.8ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiplCVE-2022-424577.2Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserveCVE-2022-424589.8Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticatCVE-2022-424597.2Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.CVE-2022-42467.5A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler.CVE-2022-424605.4Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
CVE-2022-42449: Medium severity, CVSS 5.4 | Vulnix