Page 2 of 21 results (0.026 seconds)

CVSS: 8.0EPSS: 0%CPEs: 10EXPL: 0

CVE-2018-18816 – TIBCO JasperReports Persistent Cross Site Scripting Vulnerability

https://notcve.org/view.php?id=CVE-2018-18816

07 Mar 2019 — The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition... • http://www.securityfocus.com/bid/107348 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 10.0EPSS: 1%CPEs: 9EXPL: 0

CVE-2018-18815 – TIBCO JasperReports Server User Information Disclosure

https://notcve.org/view.php?id=CVE-2018-18815

07 Mar 2019 — The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4... • http://www.securityfocus.com/bid/107346 • CWE-863: Incorrect Authorization •

CVSS: 9.9EPSS: 94%CPEs: 19EXPL: 3

CVE-2018-18809 – TIBCO JasperReports Library Directory Traversal Vulnerability

https://notcve.org/view.php?id=CVE-2018-18809

07 Mar 2019 — The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access conte... • https://packetstorm.news/files/id/154406 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0

CVE-2018-18808 – TIBCO JasperReports Server Privilege Escalation Via Race Condition

https://notcve.org/view.php?id=CVE-2018-18808

07 Mar 2019 — The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4... • http://www.securityfocus.com/bid/107350 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •

CVSS: 8.8EPSS: 1%CPEs: 27EXPL: 0

CVE-2018-5429 – TIBCO JasperReports Library Code Sandboxing Problem

https://notcve.org/view.php?id=CVE-2018-5429

17 Apr 2018 — A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, and TIBCO Jaspersoft Stud... • https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5429 •

CVSS: 8.8EPSS: 51%CPEs: 10EXPL: 2

CVE-2018-5430 – TIBCO JasperReports Server Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2018-5430

17 Apr 2018 — The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to... • https://www.exploit-db.com/exploits/44623 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.3EPSS: 0%CPEs: 10EXPL: 0

CVE-2018-5431 – TIBCO JasperReports Server Cross Site Scripting Vulnerability

https://notcve.org/view.php?id=CVE-2018-5431

17 Apr 2018 — The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up t... • https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5431 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0

CVE-2017-5532 – TIBCO JasperReports persistent cross site scripting

https://notcve.org/view.php?id=CVE-2017-5532

15 Nov 2017 — A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) a... • http://www.securityfocus.com/bid/101873 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0

CVE-2017-5533 – TIBCO JasperReports Server credentials disclosure

https://notcve.org/view.php?id=CVE-2017-5533

15 Nov 2017 — A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Affected releases are TIBCO JasperReports Server 6.4.0, TIBCO JasperReports Server Community Edition 6.... • http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html •

CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0

CVE-2017-5529 – TIBCO JasperReports Library Information Disclosure

https://notcve.org/view.php?id=CVE-2017-5529

29 Jun 2017 — JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO Jaspe... • http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •