TIBCO Software Inc. Vulnerabilities and Affected Products
Vulnerabilities associated with TIBCO Jaspersoft for AWS with Multi-Tenancy.
Products
Clear product- TIBCO JasperReports Server22 vulnerabilities
- TIBCO Spotfire Analytics Platform for AWS Marketplace22 vulnerabilities
- TIBCO JasperReports Server for ActiveMatrix BPM19 vulnerabilities
- TIBCO Spotfire Server17 vulnerabilities
- TIBCO JasperReports Server Community Edition11 vulnerabilities
- TIBCO Jaspersoft for AWS with Multi-Tenancy11 vulnerabilities
- TIBCO Jaspersoft Reporting and Analytics for AWS11 vulnerabilities
- TIBCO JasperReports Server for AWS Marketplace10 vulnerabilities
- TIBCO EBX Add-ons9 vulnerabilities
- TIBCO FTL - Enterprise Edition9 vulnerabilities
- TIBCO EBX8 vulnerabilities
- TIBCO FTL - Community Edition8 vulnerabilities
- TIBCO FTL - Developer Edition8 vulnerabilities
- TIBCO JasperReports Server for Microsoft Azure8 vulnerabilities
- TIBCO JasperReports Server - Developer Edition7 vulnerabilities
- TIBCO ActiveMatrix BPM6 vulnerabilities
- TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric6 vulnerabilities
- TIBCO JasperReports Library for ActiveMatrix BPM6 vulnerabilities
- TIBCO JasperReports Server - Community Edition6 vulnerabilities
- TIBCO Silver Fabric Enabler for ActiveMatrix BPM6 vulnerabilities
- TIBCO Spotfire Analyst6 vulnerabilities
- TIBCO Spotfire Desktop6 vulnerabilities
- TIBCO Administrator - Enterprise Edition5 vulnerabilities
- TIBCO Administrator - Enterprise Edition for z/Linux5 vulnerabilities
- TIBCO eFTL - Community Edition5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2018-18808HIGH | TIBCO JasperReports Server Privilege Escalation Via Race ConditionThe domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and includin… CWE-362Mar 7, 2019 | CVSS8.8v3.0 | EPSS1.7% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-18809MEDIUM | TIBCO JasperReports Library Directory Traversal VulnerabilityThe default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to … | CVSS6.5v3.1 | EPSS79.1% | PoCs0 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2018-18815CRITICAL | TIBCO JasperReports Server User Information DisclosureThe REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports… CWE-863Mar 7, 2019 | CVSS10.0v3.0 | EPSS3.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-18816HIGH | TIBCO JasperReports Persistent Cross Site Scripting VulnerabilityThe repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Commu… CWE-79Mar 7, 2019 | CVSS8.0v3.0 | EPSS1.23% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-5429HIGH | TIBCO JasperReports Library Code Sandboxing ProblemA vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, and TIBCO Jas… Apr 17, 2018 | CVSS8.8v3.0 | EPSS1.55% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-5430HIGH | TIBCO JasperReports Server Information Disclosure VulnerabilityThe Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: ve… | CVSS8.8v3.1 | EPSS48.8% | PoCs1 | SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-5431MEDIUM | TIBCO JasperReports Server Cross Site Scripting VulnerabilityThe domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: v… CWE-79Apr 17, 2018 | CVSS6.3v3.0 | EPSS0.602% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-5533CRITICAL | TIBCO JasperReports Server credentials disclosureA vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Affected releases are TIBCO JasperReports Server 6.4.0, TIBCO JasperReports Server Communit… Nov 15, 2017 | CVSS9.3v3.0 | EPSS1.98% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-5532MEDIUM | TIBCO JasperReports persistent cross site scriptingA vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scrip… CWE-79Nov 15, 2017 | CVSS5.4v3.0 | EPSS0.687% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-5528HIGH | TIBCO JasperReports Server cross-site vulnerabilitiesMultiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6… CWE-352Jun 29, 2017 | CVSS8.8v3.1 | EPSS0.565% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-5529MEDIUM | TIBCO JasperReports Library Information DisclosureJasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0),… CWE-200Jun 29, 2017 | CVSS4.1v3.0 | EPSS1.33% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |