CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2018-18808 – TIBCO JasperReports Server Privilege Escalation Via Race Condition
https://notcve.org/view.php?id=CVE-2018-18808
07 Mar 2019 — The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4... • http://www.securityfocus.com/bid/107350 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.9EPSS: 94%CPEs: 19EXPL: 3CVE-2018-18809 – TIBCO JasperReports Library Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2018-18809
07 Mar 2019 — The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access conte... • https://packetstorm.news/files/id/154406 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 1%CPEs: 9EXPL: 0CVE-2018-18815 – TIBCO JasperReports Server User Information Disclosure
https://notcve.org/view.php?id=CVE-2018-18815
07 Mar 2019 — The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4... • http://www.securityfocus.com/bid/107346 • CWE-863: Incorrect Authorization •
CVSS: 8.0EPSS: 0%CPEs: 10EXPL: 0CVE-2018-18816 – TIBCO JasperReports Persistent Cross Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-18816
07 Mar 2019 — The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition... • http://www.securityfocus.com/bid/107348 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.7EPSS: 0%CPEs: 6EXPL: 0CVE-2019-8986 – TIBCO JasperReports Server XML Entity Expansion Vulnerability
https://notcve.org/view.php?id=CVE-2019-8986
07 Mar 2019 — The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3. La vulnerabilidad del API d... • http://www.tibco.com/services/support/advisories •