CVSS: 9.4EPSS: 0%CPEs: 11EXPL: 0CVE-2025-3114 – Spotfire Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-3114
09 Apr 2025 — Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls. Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without ad... • https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-693: Protection Mechanism Failure •
CVSS: 9.0EPSS: 0%CPEs: 29EXPL: 0CVE-2022-41558 – TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability
https://notcve.org/view.php?id=CVE-2022-41558
15 Nov 2022 — The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful at... • https://www.tibco.com/services/support/advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •