CVSS: 5.4EPSS: 0%CPEs: 32EXPL: 0CVE-2017-3180 – Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting
https://notcve.org/view.php?id=CVE-2017-3180
24 Jul 2018 — Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The products and versions that are affected include the following: TIBCO Silver Fabric Enabler for Spotfi... • https://www.securityfocus.com/bid/95699 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 46EXPL: 0CVE-2015-4554
https://notcve.org/view.php?id=CVE-2015-4554
21 Jul 2015 — Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation Services before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Deployment Kit before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7... • http://www.securitytracker.com/id/1033015 •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2013-2372
https://notcve.org/view.php?id=CVE-2013-2372
15 Mar 2013 — Cross-site scripting (XSS) vulnerability in the Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el Engine de TIBCO Spotfire Web Player v3.3.x anterior a v3.3.3, v4.0.x anterior a v4.0.3, v4.5.x anterior a v4.5.1, y v5.0.x anterior a v5.0.1 que permite a atacantes remotos... • http://www.tibco.com/mk/advisory.jsp • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 7EXPL: 0CVE-2013-2373
https://notcve.org/view.php?id=CVE-2013-2373
15 Mar 2013 — The Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 does not properly implement access control, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors. El Engine en TIBCO Spotfire Web Player v3.3.x anterior a v3.3.3, v4.0.x anterior a v4.0.3, 4.5.x anterior a v4.5.1, y v5.0.x anterior a v5.0.1 no aplica correctamente el control de acceso, lo que permite a atacantes remotos obtener información... • http://www.tibco.com/mk/advisory.jsp • CWE-264: Permissions, Privileges, and Access Controls •