Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
76 results · page 1 of 2
Oct 9, 2026Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-93947 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
- Product
- Traveler
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2026The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail AddressCVE-2026-56547 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.5
The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects them back in the generated Apple profile. The Apple profile is not usable without additional information and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values submitted and reflected back in the Apple profile are found in the Domino directory entry for the already authenticated user.
- Product
- Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2026-21770 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jun 26, 2026HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application informaCVE-2025-59868 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.
- Product
- Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jun 26, 2026HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service.CVE-2023-37524 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 7.7
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components.
- Product
- Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jun 26, 2026The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.CVE-2024-23581 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.7
The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.
- Product
- Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Mar 24, 2026HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.CVE-2026-21790 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.3
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.
- Product
- Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Mar 24, 2026HCL Traveler is affected by sensitive information disclosure.CVE-2026-21783 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.
- Product
- Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Mar 18, 2026Traveler: Deserialization of Untrusted DataCVE-2026-25449 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Jan 22, 2026Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24367 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Jan 8, 2026Traveler: Missing AuthorizationCVE-2025-67917 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
- Product
- Traveler
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Backpack Traveler: Authorization Bypass Through User-Controlled KeyCVE-2025-69030 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.
- Product
- Backpack Traveler
- Affected
- up to 2.10.3
- What to do
- Affects up to 2.10.3. Update Backpack Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64373 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Dec 18, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Dec 18, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64371 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Dec 16, 2025Traveler Option Tree: Insertion of Sensitive Information Into Sent DataCVE-2025-49300 · WordPress plugins & themes · reported by PatchstackLow 2.7
Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.
- Product
- Traveler Option Tree
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Traveler Option Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Traveler: Missing AuthorizationCVE-2025-63028 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
- Product
- Traveler
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Travelers' Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS.This issue affects Travelers' Map: from n/a through <= 2.3.2.
- Product
- Travelers' Map
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Travelers' Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.CVE-2024-42192 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.
- Product
- Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Sep 26, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59012 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Sep 26, 2025Traveler: Missing AuthorizationCVE-2025-59011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Jul 16, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52714 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
May 30, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2024-42191 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 30, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2024-42190 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 23, 2025Backpack Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39490 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows PHP Local File Inclusion.This issue affects Backpack Traveler: from n/a through <= 2.10.2.
- Product
- Backpack Traveler
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update Backpack Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, crCVE-2025-0279 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 3, 2025HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messagCVE-2025-0278 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26956 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26898 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025Traveler: Deserialization of Untrusted DataCVE-2025-26873 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26733 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 15, 2025Traveler: Reflected Cross-Site ScriptingCVE-2025-1773 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Traveler
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtravelerwp.comwordfence.com
Mar 15, 2025Traveler: Local File InclusionCVE-2025-1771 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
- Product
- Traveler
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtravelerwp.comwordfence.com
Feb 27, 2025Traveler: Local File InclusionCVE-2024-12811 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
- Product
- Traveler
- Affected
- up to 3.1.9
- What to do
- Affects up to 3.1.9. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtravelerwp.comwordfence.com
Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22700 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.3.
- Product
- Traveler Code
- What to do
- Update Traveler Code to the newest version.
Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22699 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.
- Product
- Traveler Code
- What to do
- Update Traveler Code to the newest version.
Feb 3, 2025Traveler Layout Essential For Elementor: Server-Side Request Forgery (SSRF)CVE-2025-22701 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through < 1.4.
- Product
- Traveler Layout Essential For Elementor
- What to do
- Update Traveler Layout Essential For Elementor to the newest version.
Nov 12, 2024HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability.CVE-2024-30133 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Sep 26, 2024The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application.CVE-2024-30134 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.7
The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application.
- Product
- HCL Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024Travelers' Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29909 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille Verrier Travelers' Map allows Stored XSS.This issue affects Travelers' Map: from n/a through 2.2.0.
- Product
- Travelers' Map
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Travelers' Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37513 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
- Product
- HCL Traveler To Do
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37512 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
- Product
- HCL Traveler Companion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 10, 2023If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.CVE-2023-37511 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
If certain App Transport Security (ATS) settings are set in a certain manner, insecure loading of web content can be achieved.
- Product
- HCL Traveler To Do
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Sep 15, 2022There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).CVE-2022-27561 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 31, 2022HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler adminisCVE-2021-27778 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.9
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 25, 2021"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"CVE-2020-14264 · Other software · Hcltech · reported by psirt@hcl.comLow 3.9
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
- Product
- Traveler Companion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 21, 2021"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"CVE-2020-14263 · Other software · Hcltech · reported by psirt@hcl.comLow 3.9
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
- Product
- Traveler Companion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 16, 2021Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations.CVE-2021-32033 · Other software · Protectimus · reported by MITREMedium 4.6
Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be set independently from the used seed value for generating time-based one-time passwords, without authentication. Thus, an attacker with short-time physical access to a device can set the internal real-time clock (RTC) to the future, generate one-time passwords, and reset the clock to the current time. This allows the generation of valid future time-based one-time passwords without having further access to the hardware token.
- Product
- Slim NFC 70 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 18, 2019HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks.CVE-2019-4409 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entered file name. If the file name is not escaped in the returned error page, it could expose a cross-site scripting (XSS) vulnerability.
- Product
- HCL Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhclpnpsupport.hcltech.comhclpnpsupport.hcltech.com
Aug 10, 2016Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backCVE-2016-6597 · Network & remote access · Sophos · reported by MITREHigh 8.6
Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability.
- Product
- Mobile Control EAS Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.