HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.
The product stores sensitive information without properly limiting read or write access by unauthorized actors.