Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

TIBCO JasperReports LibraryTIBCO JasperReports Library

Risk 77
Severity
8.8
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an attacker to exploit HTML injection to gain full control of a web interface containing the output of the report generator component with the privileges of any user that views the affected report(s). The attacker can theoretically exploit this vulnerability when other users view a maliciously generated report, where those reports use Fusion Charts and a data source with contents controlled by the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions 7.1.1 and below, versions 7.2.0 and 7.2.1, version 7.3.0, version 7.5.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions 7.1.1 and below, TIBCO JasperReports Server: versions 7.1.1 and below, version 7.2.0, version 7.5.0, TIBCO JasperReports Server for AWS Marketplace: versions 7.5.0 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.

Remedy

TIBCO has released updated versions of the affected components which address these issues. TIBCO JasperReports Library versions 7.1.1 and below update to version 7.1.3 or higher TIBCO JasperReports Library versions 7.2.0 and 7.2.1 update to version 7.2.2 or higher TIBCO JasperReports Library version 7.3.0 update to version 7.3.1 or higher TIBCO JasperReports Library version 7.5.0 update to version 7.5.1 or higher TIBCO JasperReports Library for ActiveMatrix BPM versions 7.1.1 and below update to version 7.1.3 or higher TIBCO JasperReports Server versions 7.1.1 and below update to version 7.1.3 or higher TIBCO JasperReports Server version 7.2.0 update to version 7.2.1 or higher TIBCO JasperReports Server version 7.5.0 update to version 7.5.1 or higher TIBCO JasperReports Server for AWS Marketplace versions 7.5.0 and below update to version 7.5.1 or higher TIBCO JasperReports Server for ActiveMatrix BPM versions 7.1.1 and below update to version 7.1.3 or higher
First published (updated )
CVE-2020-9410

TIBCO JasperReports ServerTIBCO JasperReports FTP Password exposed

Risk 74
Severity
9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Remedy

TIBCO has released updated versions of the affected components which address these issues. TIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later TIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later TIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later TIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later TIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later TIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later
First published (updated )
CVE-2021-35495

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203