ByteOS

TIBCO Spotfire Analytics Platform for AWS Marketplace

Product

Versions

Affected

7.14.0
7.14.1
10.0.0
10.0.1
10.1.0
10.2.0

Vendor

Product

TIBCO Spotfire Server

Versions

Affected

7.14.0
10.0.0
10.0.1
10.1.0
10.2.0

Problem Types

Type	CWE ID	Description
text	N/A	The impact of this vulnerability includes the theoretical possibility that an unauthenticated attacker could gain administrative access to the web interface of the affected component.

Type: text

CWE ID: N/A

Description: The impact of this vulnerability includes the theoretical possibility that an unauthenticated attacker could gain administrative access to the web interface of the affected component.

Metrics

Version	Base score	Base severity	Vector
3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Solutions

TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Analytics Platform for AWS Marketplace versions 7.14.0, 7.14.1, 10.0.0, 10.0.1, 10.1.0, and 10.2.0 update to 10.3.0 or higher TIBCO Spotfire Server versions 7.14.0, 10.0.0, 10.0.1, 10.1.0, and 10.2.0 update to 10.2.1 or higher

References

Hyperlink	Resource
http://www.tibco.com/services/support/advisories	x_refsource_MISC
https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205	x_refsource_MISC
http://www.securityfocus.com/bid/108384	vdb-entry x_refsource_BID

Hyperlink: http://www.tibco.com/services/support/advisories

Resource:

x_refsource_MISC

Hyperlink: https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205

Resource:

x_refsource_MISC

Hyperlink: http://www.securityfocus.com/bid/108384

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.tibco.com/services/support/advisories	x_refsource_MISC x_transferred
https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205	x_refsource_MISC x_transferred
http://www.securityfocus.com/bid/108384	vdb-entry x_refsource_BID x_transferred

Hyperlink: http://www.tibco.com/services/support/advisories

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.securityfocus.com/bid/108384

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@tibco.com

Published At:14 May, 2019 | 20:29

Updated At:20 May, 2019 | 16:29

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary	3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:7.14.0:*:*:*:*:*:*:*

>>spotfire_analytics_platform_for_aws>>7.14.0

cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:7.14.1:*:*:*:*:*:*:*

>>spotfire_analytics_platform_for_aws>>7.14.1

cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.0.0:*:*:*:*:*:*:*

>>spotfire_analytics_platform_for_aws>>10.0.0

cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.0.1:*:*:*:*:*:*:*

>>spotfire_analytics_platform_for_aws>>10.0.1

cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.1.0:*:*:*:*:*:*:*

>>spotfire_analytics_platform_for_aws>>10.1.0

cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.2.0:*:*:*:*:*:*:*

>>spotfire_analytics_platform_for_aws>>10.2.0

cpe:2.3:a:tibco:spotfire_server:7.14.0:*:*:*:*:*:*:*

>>spotfire_server>>7.14.0

cpe:2.3:a:tibco:spotfire_server:10.0.0:*:*:*:*:*:*:*

>>spotfire_server>>10.0.0

cpe:2.3:a:tibco:spotfire_server:10.0.1:*:*:*:*:*:*:*

>>spotfire_server>>10.0.1

cpe:2.3:a:tibco:spotfire_server:10.1.0:*:*:*:*:*:*:*

>>spotfire_server>>10.1.0

cpe:2.3:a:tibco:spotfire_server:10.2.0:*:*:*:*:*:*:*

>>spotfire_server>>10.2.0

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/108384	security@tibco.com	N/A
http://www.tibco.com/services/support/advisories	security@tibco.com	Vendor Advisory
https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205	security@tibco.com	Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/108384

Source: security@tibco.com

Resource: N/A

Hyperlink: http://www.tibco.com/services/support/advisories

Source: security@tibco.com

Resource:

Vendor Advisory

Hyperlink: https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205

Source: security@tibco.com

Resource:

Vendor Advisory

Similar CVEs

12394Records found

CVE-2023-26218

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8||HIGH

EPSS-0.52% / 39.96%

7 Day CHG~0.00%

Published-29 Sep, 2023 | 17:07

Updated-23 Sep, 2024 | 16:26

TIBCO Nimbus Reflected Cross-site Scripting (XSS) vulnerabilities

The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.6.0 and below.

Product-nimbus TIBCO Nimbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-35499

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8||HIGH

EPSS-0.58% / 43.02%

7 Day CHG~0.00%

Published-26 Oct, 2021 | 16:35

Updated-17 Sep, 2024 | 01:27

TIBCO Nimbus Stored Cross-site Scripting (XSS) vulnerabilities

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.4.0 and below.

Product-nimbus TIBCO Nimbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-5432

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8||HIGH

EPSS-0.86% / 53.85%

7 Day CHG~0.00%

Published-13 Jun, 2018 | 13:00

Updated-17 Sep, 2024 | 02:05

TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability

The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains multiple vulnerabilities wherein a malicious user could theoretically perform cross-site scripting (XSS) attacks by way of manipulating artifacts prior to uploading them. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions up to and including 5.10.0, and TIBCO Administrator - Enterprise Edition for z/Linux: versions up to and including 5.9.1.

Product-administrator TIBCO Administrator - Enterprise Edition TIBCO Administrator - Enterprise Edition for z/Linux

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-5431

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-6.3||MEDIUM

EPSS-0.60% / 44.20%

7 Day CHG~0.00%

Published-17 Apr, 2018 | 18:00

Updated-17 Sep, 2024 | 01:56

TIBCO JasperReports Server Cross Site Scripting Vulnerability

The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Product-jaspersoft_reporting_and_analytics jasperreports_server jaspersoft TIBCO Jaspersoft Reporting and Analytics for AWS TIBCO Jaspersoft for AWS with Multi-Tenancy TIBCO JasperReports Server Community Edition TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-18807

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-7.6||HIGH

EPSS-1.18% / 63.56%

7 Day CHG~0.00%

Published-26 Nov, 2018 | 20:00

Updated-16 Sep, 2024 | 19:51

TIBCO Statistica Server Vulnerable to Cross Site Scripting

The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and including 13.4.0.

Product-statistica_server TIBCO Statistica Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-18816

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8||HIGH

EPSS-1.26% / 65.76%

7 Day CHG~0.00%

Published-07 Mar, 2019 | 22:00

Updated-16 Sep, 2024 | 17:58

TIBCO JasperReports Persistent Cross Site Scripting Vulnerability

The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi- Tenancy versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5536

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-6.3||MEDIUM

EPSS-0.68% / 47.46%

7 Day CHG~0.00%

Published-01 May, 2018 | 18:00

Updated-17 Sep, 2024 | 03:38

TIBCO DataSynapse GridServer manager component vulnerable to cross-site scripting attacks

The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS). In addition, an authenticated user could be a victim of a cross-site request forgery (CSRF) attack. Affected releases include TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager: versions up to and including 5.1.3; 6.0.0; 6.0.1; 6.0.2; 6.1.0; 6.1.1; and 6.2.0.

Product-datasynapse_gridserver_manager TIBCO DataSynapse GridServer Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5532

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-5.4||MEDIUM

EPSS-0.69% / 47.89%

7 Day CHG~0.00%

Published-15 Nov, 2017 | 21:00

Updated-13 May, 2026 | 00:24

TIBCO JasperReports persistent cross site scripting

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.

Product-jaspersoft_reporting_and_analytics jasperreports_library jasperreports_server jaspersoft jaspersoft_studio TIBCO Jaspersoft Studio TIBCO Jaspersoft Studio for ActiveMatrix BPM TIBCO Jaspersoft Reporting and Analytics for AWS TIBCO JasperReports Library for ActiveMatrix BPM TIBCO Jaspersoft for AWS with Multi-Tenancy TIBCO JasperReports Library TIBCO JasperReports Server Community Edition TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-17333

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8||HIGH

EPSS-0.68% / 47.52%

7 Day CHG~0.00%

Published-19 Feb, 2020 | 18:20

Updated-17 Sep, 2024 | 03:52

TIBCO EBX Exposes Cross-Site Scripting Vulnerability

The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7.

Product-ebx TIBCO EBX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-3180

Matching Score-6

Assigner-CERT/CC

Matching Score-6

Assigner-CERT/CC

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 44.47%

7 Day CHG~0.00%

Published-24 Jul, 2018 | 15:00

Updated-05 Aug, 2024 | 14:16

Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting

Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The products and versions that are affected include the following: TIBCO Silver Fabric Enabler for Spotfire Web Player 2.1.2 and earlier TIBCO Spotfire Analyst 7.5.0 TIBCO Spotfire Analyst 7.6.0 TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Analytics Platform for AWS Marketplace 7.0.2 and earlier TIBCO Spotfire Automation Services 6.5.3 and earlier TIBCO Spotfire Automation Services 7.0.0, and 7.0.1 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 6.5.3 and earlier TIBCO Spotfire Deployment Kit 7.0.0, and 7.0.1 TIBCO Spotfire Deployment Kit 7.5.0 TIBCO Spotfire Deployment Kit 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 6.5.2 and earlier TIBCO Spotfire Desktop 7.0.0, and 7.0.1 TIBCO Spotfire Desktop 7.5.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.0.1 and earlier TIBCO Spotfire Desktop Language Packs 7.5.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 TIBCO Spotfire Professional 6.5.3 and earlier TIBCO Spotfire Professional 7.0.0 and 7.0.1 TIBCO Spotfire Web Player 6.5.3 and earlier TIBCO Spotfire Web Player 7.0.0 and 7.0.1

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-17331

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-7.3||HIGH

EPSS-0.61% / 44.52%

7 Day CHG~0.00%

Published-12 Nov, 2019 | 19:15

Updated-17 Sep, 2024 | 00:11

TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, version 4.1.0.

Product-ebx_add-ons TIBCO EBX Add-ons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-16789

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.79% / 51.37%

7 Day CHG~0.00%

Published-11 Dec, 2017 | 02:00

Updated-13 May, 2026 | 00:24

Cross-site scripting (XSS) vulnerability in Integration Matters nJAMS 3 before 3.2.0 Hotfix 7, as used in TIBCO BusinessWorks Process Monitor through 3.0.1.3 and other products, allows remote authenticated administrators to inject arbitrary web script or HTML via the users management panel of the web interface.

Vendor-integrationmatters n/a TIBCO (Cloud Software Group, Inc.)

Product-njams businessworks_process_monitor n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-9410

Matching Score-6

Assigner-TIBCO Software Inc.

Product-retail_order_broker jasperreports_library jasperreports_server TIBCO JasperReports Library for ActiveMatrix BPM TIBCO JasperReports Library TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server TIBCO JasperReports Server for AWS Marketplace

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-7.3||HIGH

EPSS-5.06% / 91.22%

7 Day CHG+0.69%

Published-20 May, 2020 | 12:25

Updated-16 Sep, 2024 | 19:24

TIBCO JasperReports Library

The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an attacker to exploit HTML injection to gain full control of a web interface containing the output of the report generator component with the privileges of any user that views the affected report(s). The attacker can theoretically exploit this vulnerability when other users view a maliciously generated report, where those reports use Fusion Charts and a data source with contents controlled by the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions 7.1.1 and below, versions 7.2.0 and 7.2.1, version 7.3.0, version 7.5.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions 7.1.1 and below, TIBCO JasperReports Server: versions 7.1.1 and below, version 7.2.0, version 7.5.0, TIBCO JasperReports Server for AWS Marketplace: versions 7.5.0 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.

Vendor-Oracle Corporation TIBCO (Cloud Software Group, Inc.)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-9416

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8.2||HIGH

EPSS-0.57% / 42.75%

7 Day CHG~0.00%

Published-15 Sep, 2020 | 18:55

Updated-16 Sep, 2024 | 19:20

TIBCO Spotfire Stored Cross Site Scripting Vulnerability

The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.

Product-spotfire_analytics_platform spotfire_analyst spotfire_server spotfire_desktop TIBCO Spotfire Analytics Platform for AWS Marketplace TIBCO Spotfire Server TIBCO Spotfire Analyst TIBCO Spotfire Desktop

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-9414

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8.8||HIGH

EPSS-1.69% / 74.11%

7 Day CHG~0.00%

Published-30 Jun, 2020 | 19:40

Updated-17 Sep, 2024 | 01:41

TIBCO Managed File Transfer reflected XSS vulerability

The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.

Product-managed_file_transfer_internet_server managed_file_transfer_command_center TIBCO Managed File Transfer Command Center TIBCO Managed File Transfer Internet Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-9413

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-6.3||MEDIUM

EPSS-1.35% / 67.85%

7 Day CHG~0.00%

Published-30 Jun, 2020 | 19:40

Updated-17 Sep, 2024 | 01:07

TIBCO Managed File Transfer reflected XSS vulerability

The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.

Product-managed_file_transfer_internet_server managed_file_transfer_command_center TIBCO Managed File Transfer Command Center TIBCO Managed File Transfer Internet Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-41565

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8.7||HIGH

EPSS-0.39% / 31.18%

7 Day CHG~0.00%

Published-22 Feb, 2023 | 00:00

Updated-03 Aug, 2024 | 12:49

TIBCO EBX Cross Site Scripting (XSS) Vulnerability

The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.21 and below, versions 6.0.11 and below and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 1.2.0 and below.

Product-product_and_service_catalog_powered_by_tibco_ebx ebx TIBCO Product and Service Catalog powered by TIBCO EBX TIBCO EBX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-41566

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8.7||HIGH

EPSS-0.39% / 31.18%

7 Day CHG~0.00%

Published-22 Feb, 2023 | 00:00

Updated-03 Aug, 2024 | 12:49

TIBCO EBX Add-ons Cross Site Scripting (XSS) Vulnerability

The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 5.6.0 and below.

Product-ebx_add-ons TIBCO EBX Add-ons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-41558

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-9||CRITICAL

EPSS-0.50% / 38.83%

7 Day CHG~0.00%

Published-15 Nov, 2022 | 18:15

Updated-29 Apr, 2025 | 21:15

TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability

The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0.

Product-spotfire_desktop spotfire_analyst spotfire_analytics_platform spotfire_server TIBCO Spotfire Analyst TIBCO Spotfire Desktop TIBCO Spotfire Server TIBCO Spotfire Analytics Platform for AWS Marketplace

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-30577

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-8||HIGH

EPSS-0.69% / 48.08%

7 Day CHG~0.00%

Published-21 Sep, 2022 | 17:55

Updated-22 May, 2025 | 19:15

TIBCO EBX Stored XSS vulnerability

The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 6.0.0 through 6.0.8.

Product-ebx TIBCO EBX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-30575

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-7.3||HIGH

EPSS-0.50% / 38.85%

7 Day CHG~0.00%

Published-16 Aug, 2022 | 17:55

Updated-16 Sep, 2024 | 17:29

TIBCO Statistica Reflected Cross Site Scripting (XSS) Vulnerability

The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Trial contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO Data Science - Workbench: versions 14.0.0 and below, TIBCO Statistica: versions 14.0.0 and below, TIBCO Statistica - Estore Edition: versions 14.0.0 and below, and TIBCO Statistica Trial: versions 14.0.0 and below.

Product-statistica data_science_-_workbench TIBCO Data Science - Workbench TIBCO Statistica Trial TIBCO Statistica TIBCO Statistica - Estore Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-22773

Matching Score-6

Assigner-TIBCO Software Inc.

Matching Score-6

Assigner-TIBCO Software Inc.

CVSS Score-7.7||HIGH

EPSS-0.48% / 37.52%

7 Day CHG~0.00%

Published-17 May, 2022 | 17:30

Updated-16 Sep, 2024 | 20:36

TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below, TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below, TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below, and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.

Product-jasperreports_server TIBCO JasperReports Server for Microsoft Azure TIBCO JasperReports Server - Community Edition TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server TIBCO JasperReports Server for AWS Marketplace TIBCO JasperReports Server - Developer Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-15869

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.68% / 47.49%

7 Day CHG~0.00%

Published-31 Jul, 2020 | 19:49

Updated-04 Aug, 2024 | 13:30

Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).

Vendor-n/a Sonatype, Inc.

Product-nexus_repository_manager_3 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1080

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.11% / 61.63%

7 Day CHG~0.00%

Published-23 Mar, 2010 | 19:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in view.php in Pulse CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter.

Vendor-pulsecms n/a

Product-pulse_cms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1395

Matching Score-4

Assigner-Apple Inc.

Matching Score-4

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-2.93% / 85.31%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving DOM constructor objects, related to a "scope management issue."

Vendor-n/a Microsoft Corporation Apple Inc.

Product-webkit windows_7 mac_os_x windows_vista windows_xp safari mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0817

Matching Score-4

Matching Score-4

CVSS Score-4.3||MEDIUM

EPSS-28.71% / 97.89%

7 Day CHG~0.00%

Published-29 Apr, 2010 | 21:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.

Vendor-n/a Microsoft Corporation

Product-sharepoint_server sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1275

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.06% / 60.23%

7 Day CHG~0.00%

Published-06 Apr, 2010 | 16:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in ShowPost.asp in BBSXP 2008 allows remote attackers to inject arbitrary web script or HTML via the ThreadID parameter.

Vendor-bbsxp n/a

Product-bbsxp n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2002-2343

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.47% / 70.30%

7 Day CHG~0.00%

Published-29 Oct, 2007 | 19:00

Updated-16 Apr, 2026 | 00:27

Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email messages.

Vendor-nocc n/a

Product-nocc n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1742

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.72% / 74.52%

7 Day CHG~0.00%

Published-06 May, 2010 | 18:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in projects.php in Scratcher allows remote attackers to inject arbitrary web script or HTML via the show parameter.

Vendor-satyadeep n/a

Product-scratcher n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1482

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.08% / 60.96%

7 Day CHG~0.00%

Published-12 May, 2010 | 15:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.

Vendor-n/a The CMS Made Simple Foundation

Product-cms_made_simple n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1557

Matching Score-4

Assigner-HP Inc.

Matching Score-4

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.46% / 70.25%

7 Day CHG~0.00%

Published-14 May, 2010 | 20:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in HP Insight Control Server Migration before 6.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-insight_control_server_migration_for_windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1486

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.20% / 64.11%

7 Day CHG~0.00%

Published-22 Apr, 2010 | 14:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in _invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via the (1) billing address or (2) shipping address.

Vendor-cactushop n/a

Product-cactushop n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-15676

Matching Score-4

Assigner-Mozilla Corporation

Matching Score-4

Assigner-Mozilla Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.57% / 72.28%

7 Day CHG~0.00%

Published-01 Oct, 2020 | 18:31

Updated-04 Aug, 2024 | 13:22

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Vendor-Debian GNU/Linux openSUSE Mozilla Corporation

Product-thunderbird debian_linux firefox firefox_esr leap Firefox Firefox ESR Thunderbird

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1164

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-2.23% / 80.52%

7 Day CHG~0.00%

Published-20 Apr, 2010 | 15:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.jsp; the (17) afterURL parameter to screenshot-redirecter.jsp; or the (18) HTTP Referrer header to 500page.jsp, as exploited in the wild in April 2010.

Vendor-n/a Atlassian

Product-jira n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1048

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.45% / 69.96%

7 Day CHG~0.00%

Published-22 Mar, 2010 | 18:17

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in blog/index.php in Uiga Business Portal allows remote attackers to inject arbitrary web script or HTML via the textcomment parameter (aka the Comment Box) in a noentryid action. NOTE: some of these details are obtained from third party information.

Vendor-uiga n/a

Product-business_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6506

Matching Score-4

Assigner-Debian GNU/Linux

Matching Score-4

Assigner-Debian GNU/Linux

CVSS Score-4.3||MEDIUM

EPSS-2.08% / 79.03%

7 Day CHG~0.00%

Published-03 Sep, 2015 | 14:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.

Vendor-n/a Best Practical Solutions, LLC

Product-request_tracker n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1195

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.71% / 74.39%

7 Day CHG+0.01%

Published-31 Mar, 2010 | 17:35

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the htmlscrubber component in ikiwiki 2.x before 2.53.5 and 3.x before 3.20100312 allows remote attackers to inject arbitrary web script or HTML via a crafted data:image/svg+xml URI.

Vendor-ikiwiki n/a

Product-ikiwiki n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1104

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.93% / 77.43%

7 Day CHG~0.00%

Published-25 Mar, 2010 | 17:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Vendor-zope n/a

Product-zope n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-15870

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.68% / 47.49%

7 Day CHG~0.00%

Published-31 Jul, 2020 | 19:42

Updated-04 Aug, 2024 | 13:30

Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).

Vendor-n/a Sonatype, Inc.

Product-nexus_repository_manager_3 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1667

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.90% / 77.01%

7 Day CHG~0.00%

Published-06 Jul, 2010 | 17:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mahara

Product-mahara n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1332

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.02% / 59.00%

7 Day CHG~0.00%

Published-09 Apr, 2010 | 17:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in PrettyBook PrettyFormMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-prettybook n/a

Product-prettyformmail n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1274

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.06% / 60.38%

7 Day CHG~0.00%

Published-06 Apr, 2010 | 16:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Emweb Wt before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to "insertions of the URL" that occur during a redirection.

Vendor-webtoolkit n/a

Product-wt n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1105

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.11% / 61.63%

7 Day CHG~0.00%

Published-25 Mar, 2010 | 17:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in cgi/index.php in AdvertisementManager 3.1.0 and 3.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter.

Vendor-advertisementmanager n/a

Product-advertisementmanager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1257

Matching Score-4

Matching Score-4

CVSS Score-4.3||MEDIUM

EPSS-22.16% / 97.36%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

Vendor-n/a Microsoft Corporation

Product-internet_explorer sharepoint_services windows_7 windows_server_2008 windows_vista windows_xp windows_2003_server sharepoint_server office_infopath n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1036

Matching Score-4

Assigner-HP Inc.

Matching Score-4

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-2.87% / 85.00%

7 Day CHG~0.00%

Published-28 Apr, 2010 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in HP System Insight Manager before 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-systems_insight_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-1000143

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-3.56% / 87.84%

7 Day CHG~0.00%

Published-10 Oct, 2016 | 20:00

Updated-06 May, 2026 | 22:30

Reflected XSS in wordpress plugin photoxhibit v2.1.8

Vendor-photoxhibit_project n/a

Product-photoxhibit n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1021

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.06% / 60.38%

7 Day CHG~0.00%

Published-19 Mar, 2010 | 18:35

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the Typo3 Quixplorer (t3quixplorer) extension before 1.7.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-mads_brunn n/a TYPO3 Association

Product-t3quixplorer typo3 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-15769

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.66% / 46.57%

7 Day CHG~0.00%

Published-18 Sep, 2020 | 13:10

Updated-04 Aug, 2024 | 13:22

An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL.

Vendor-n/a Gradle, Inc.

Product-enterprise n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0963

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.06% / 60.37%

7 Day CHG~0.00%

Published-16 Mar, 2010 | 18:26

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in index.php in dl Download Ticket Service before 0.7 allows remote attackers to inject arbitrary web script or HTML via the t parameter, related to an invalid ticket ID. NOTE: some of these details are obtained from third party information.

Vendor-yuri_d\'elia n/a

Product-dl n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1186

Matching Score-4

Assigner-MITRE Corporation