TIBCO Software vulnerabilities
We track 21 vulnerabilities in TIBCO Software products across 29 products. 20 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on May 21, 2025.
Latest TIBCO Software vulnerabilities
- 7.0 High severity
TIBCO ActiveMatrix BusinessWorks: Improper Neutralization of Special Elements used in an SQL Command
The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack. This could lead to unauthorised access to the database and exposure of sensitive information
- 7.0 High severity
TIBCO BPM Enterprise: Improper Neutralization of Input During Web Page Generation
Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application.
- 9.2 Critical severity
TIBCO Hawk: Improper Restriction of XML External Entity Reference
XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence
- 9.2 Critical severity
TIBCO Hawk: Improper Neutralization of Input During Web Page Generation
XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence
- 8.8 High severity
TIBCO FTL - Enterprise Edition: Improper Privilege Management
The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Softwar
- 8.8 High severity
TIBCO Hawk: Use of Hard-coded Credentials
The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoretically allows an attacker
- 9.0 Critical severity
TIBCO Nimbus: Improper Neutralization of Input During Web Page Generation
The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts tar
- 8.8 High severity
TIBCO EBX Add-ons: Improper Neutralization of Special Elements used in an SQL Command
The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the
- 7.2 High severity
TIBCO EBX Add-ons: Improper Limitation of a Pathname to a Restricted Directory
The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4
- 9.8 Critical severity
TIBCO Spotfire Statistics Services: Unrestricted Upload of File with Dangerous Type
The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected
- 8.4 High severity
TIBCO JasperReports Server: Improper Neutralization of Input During Web Page Generation
The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO J
- 9.3 Critical severity
TIBCO Nimbus: URL Redirection to Untrusted Site
The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to exploit an open redirect on the affected system. A successful attack using this vulnerabi
- 9.0 Critical severity
TIBCO EBX Add-ons: Improper Neutralization of Input During Web Page Generation
The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack
- 9.0 Critical severity
TIBCO EBX: Improper Neutralization of Input During Web Page Generation
The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using th
- 8.4 High severity
TIBCO Spotfire Analytics Platform for AWS…: Server-Side Request Forgery
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Si
- 8.8 High severity
TIBCO BusinessConnect Trading Community…: Cross-Site Request Forgery
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute Cross-Site Request Forgery (CSRF) on the af
- 9.1 Critical severity
TIBCO Managed File Transfer Command Center: Improper Restriction of XML External Entity Reference
The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, and TIBCO Managed File Transfer Internet Server conta
- 8.8 High severity
TIBCO JasperReports Library: Improper Limitation of a Pathname to a Restricted Directory
The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO
- 9.0 Critical severity
TIBCO EBX: Improper Neutralization of Input During Web Page Generation
The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a lo
- 6.5 Medium severity
TIBCO JasperReports Library Directory Traversal Exploited
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, T
- 8.8 High severity
TIBCO JasperReports Server Information Disclosure Exploited
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics f