CVE-2021-27778

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
HCL Software	HCL Traveler	12.0.1.0 and earlier

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044Third Party Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044Third Party Advisory

Timeline

Published: Jun 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277799.1VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with th CVE-2021-277805.3The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-277814.8The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-277827.5HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple inval CVE-2021-277836.5User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-277847.5The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions an CVE-2021-277855.0HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the vic CVE-2021-277869.8Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin he CVE-2021-277886.1HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability. By tricking a user into clicking a crafted URL, a remote unauthenti CVE-2021-277896.5The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensiti CVE-2021-277907.8The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string functio CVE-2021-277915.4The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a a