CVSS: 9.9EPSS: 0%CPEs: 22EXPL: 0CVE-2020-9408 – TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-9408
11 Mar 2020 — The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arb... • http://www.tibco.com/services/support/advisories • CWE-276: Incorrect Default Permissions •
CVSS: 8.1EPSS: 0%CPEs: 18EXPL: 0CVE-2019-17337 – TIBCO Spotfire Server Library Vulnerable to Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-17337
17 Dec 2019 — The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting (XSS) attack. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1... • http://www.tibco.com/services/support/advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.7EPSS: 0%CPEs: 18EXPL: 0CVE-2019-17336 – TIBCO Spotfire Web Player Potentially Exposes Credentials For Shared Data Sources
https://notcve.org/view.php?id=CVE-2019-17336
17 Dec 2019 — The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to information that can lead to obtaining credentials used to access Spotfire data sources. The attacker would need privileges to save a Spotfire file to the library, and only applies in a situation where NTLM credentials, or a credentials profile is in use. Affected releases are TIBCO Software I... • http://www.tibco.com/services/support/advisories •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 0CVE-2019-17335 – TIBCO Spotfire Server Exposes User-Specific Cached Data To Others Users
https://notcve.org/view.php?id=CVE-2019-17335
17 Dec 2019 — The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to. The attacker would need privileges to save a Spotfire file to the library. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6... • http://www.tibco.com/services/support/advisories •
CVSS: 5.3EPSS: 0%CPEs: 9EXPL: 0CVE-2019-11206 – TIBCO Spotfire Server Vulnerabilities With Integrity of Comments and Bookmarks
https://notcve.org/view.php?id=CVE-2019-11206
14 May 2019 — The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.2.0, and TIBCO Spotfire Server: versions up to and including 7.11.2; 7.12.0; 7.13.0; 7.14.0; 10.0.0; 10.0.1; 10.1.0; and 10... • http://www.securityfocus.com/bid/108405 •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2019-11205 – TIBCO Spotfire Server Exposes Multiple Reflected Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-11205
14 May 2019 — The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0. El componente Web Server de TIBCO Software Inc. • http://www.securityfocus.com/bid/108384 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2012-0690
https://notcve.org/view.php?id=CVE-2012-0690
13 Mar 2012 — TIBCO Spotfire Web Application, Web Player Application, Automation Services Application, and Analytics Client Application in Spotfire Analytics Server before 10.1.2; Server before 3.3.3; and Web Player, Automation Services, and Professional before 4.0.2 allow remote attackers to obtain sensitive information via a crafted URL. TIBCO Spotfire Web Application, Web Player Application, Automation Services Application, y Analytics Client Application de Spotfire Analytics Server anteriores a 10.1.2; Server anterio... • http://www.tibco.com/multimedia/spotfire_advisory_20120308_tcm8-15731.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2011-3132
https://notcve.org/view.php?id=CVE-2011-3132
02 Sep 2011 — Cross-site scripting (XSS) vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en TIBCO Spotfire Server v3.0.x antes de v3.0.2, v3.1.x antes de v3.1.2, v3.2.x antes de v3.2.1, y v3.3.x antes de v3.3.1, and Spotfire Analytics Server ant... • http://secunia.com/advisories/45864 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2011-3133
https://notcve.org/view.php?id=CVE-2011-3133
02 Sep 2011 — Session fixation vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1, allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de tipo session fixation en TIBCO Spotfire Server v3.0.x antes de v3.0.2, v3.1.x antes de v3.1.2, v3.2.x antes de v3.2.1, y v3.3.x antes de v3.3.1, and Spotfire Analytics Server antes de v10.1.1, permite a atacantes remotos secuestrar sesio... • http://secunia.com/advisories/45864 •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2011-3134
https://notcve.org/view.php?id=CVE-2011-3134
02 Sep 2011 — Unspecified vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1, allows remote attackers to modify data or obtain sensitive information via a crafted URL. Vulnerabilidad no especificada en TIBICO Spotfire Server v3.0.x antes de v3.0.2, v3.1.x antes de v3.1.2, v3.2.x antes de v3.2.1, y v3.3.x antes de v3.3.1, y Spotfire Analytics Server antes de v10.1.1, permite a atacantes remotos modificar dat... • http://secunia.com/advisories/45864 •