CVE-2025-59868

MediumCVSS 5.5/10Last modified Sep 29, 2026

Description

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
HCLSoftwareTraveler for Microsoft Outlook<3.0.15

References

Timeline

Published
Jun 27, 2026
Last modified
Sep 29, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-59878.1A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this eCVE-2025-598709.8HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , CVE-2025-598729.8HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possibCVE-2025-598735.9An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokCVE-2025-598748.1HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web aCVE-2025-59885.3A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to eCVE-2025-598868.8Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access tCVE-2025-598878.6Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attackerCVE-2025-598886.7Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with CVE-2025-598898.6Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the CVE-2025-598907.3Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead intCVE-2025-598918.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat