PT-2022-25939 · Tibco Software · Tibco Nimbus

Name of the Vulnerable Software and Affected Versions: TIBCO Nimbus version 10.5.0 Description: The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains a vulnerability that allows a low privileged attacker with network access to execute a Denial of...

TIBCO Software Nimbus 输入验证错误漏洞

TIBCO Software Nimbus is a business application for process documentation from TIBCO Software, USA. A security vulnerability exists in TIBCO Software Nimbus version 10.5.0, which stems from a problem with the Web Client component that allows an unauthenticated attacker with network access...

PT-2022-25937 · Tibco Software · Tibco Nimbus

Name of the Vulnerable Software and Affected Versions: TIBCO Nimbus version 10.5.0 Description: The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable issue that allows an unauthenticated attacker with network access to exploit an open redirect on the affect...

TIBCO Security Advisory: December 6, 2022 -TIBCO Nimbus-CVE-2022-41560

TIBCO Nimbus Denial of Service Vulnerability Original release date: December 6, 2022 Lastrevised: --- CVE-2022-41560 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus version 10.5.0 The following component is affected: Statement Set Upload via the Web Client Description The component list...

TIBCO Security Advisory: December 6, 2022 - TIBCO Nimbus -CVE-2022-41559

TIBCO Nimbus Open Redirect Vulnerability Original release date: December 6, 2022 Lastrevised: --- CVE-2022-41559 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus version 10.5.0 The following component is affected: Web Client Description The component listed above contains an easily...

TIBCO Security Advisory: December 6, 2022 - TIBCO Nimbus -CVE-2022-41559

TIBCO Nimbus Open Redirect Vulnerability Original release date: December 6, 2022 Lastrevised: --- CVE-2022-41559 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus version 10.5.0 The following component is affected: Web Client Description The component listed above contains an easily...

The vulnerability of the Nimbus JOSE + JWT Java library, related to incorrect verification of the cryptographic signature, allows a perpetrator to influence the integrity of the information.

The vulnerability of the Nimbus JOSE + JWT Java library is related to an incorrect verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to influence the integrity of the information...

The vulnerability of the AAD Handler component in the Nimbus JOSE + JWT Java library, due to insufficient data authentication checks, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the AAD Handler component in the Nimbus JOSE + JWT Java library is related to insufficient verification of data authenticity. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information by uploading...

CVE-2022-24967

Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...

CVE-2022-24967

Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...

Cross site scripting

Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...

Black Rainbow NIMBUS 跨站脚本漏洞

Black Rainbow NIMBUS is a sophisticated operating platform from Black Rainbow, Inc. which is used to manage an organization's data. A cross-site scripting vulnerability exists in Black Rainbow NIMBUS version 3.7.0 that stems from a stored cross-site scripting issue in multiple functions...

CVE-2022-24967

Black Rainbow NIMBUS has a stored XSS vulnerability tracked as CVE-2022-24967 affecting versions before 3.7.0; remediation is upgrade to 3.7.0. No exploitation details are provided in the connected documents.

CVE-2022-24967

Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...

MediaWiki Cross-Site Scripting Vulnerability (CNVD-2022-68884)

MediaWiki is a set of web-based wiki engines from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.37.2 and prior versions, which stems from a cross-site...

Nimbus JOSE+JWT vulnerable to padding oracle attack

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack...

GHSA-JFMQ-4G4M-99RH Nimbus JOSE+JWT vulnerable to padding oracle attack

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack...

Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation...

Nimbus JOSE+JWT missing overflow check

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data AAD and ciphertext so that different plaintext is obtained for the same HMAC...

GHSA-2QP9-WG27-9PCV Nimbus JOSE+JWT missing overflow check

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data AAD and ciphertext so that different plaintext is obtained for the same HMAC...