HCL Software HCL Traveler vulnerabilities
4 vulnerabilities
Known vulnerabilities in HCL Software HCL Traveler, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-27778hcl softwarehcl traveler+1
EPSS score0.38%
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.CVE-2025-0278hcl softwarehcl traveler+1EPSS score0.30%
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.CVE-2025-0279hcl softwarehcl traveler+1EPSS score0.30%
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.CVE-2022-27561hcl softwarehcl traveler+1EPSS score0.45%
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).