Cross site scripting

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...

CVE-2021-35499

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...

CVE-2021-35499 TIBCO Nimbus Stored Cross-site Scripting (XSS) vulnerabilities

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...

CVE-2021-35499

CVE-2021-35499 affects TIBCO Nimbus, specifically the Web Reporting component in Nimbus 10.4.0 and earlier. The vulnerability is stored Cross-Site Scripting (XSS) that can be exploited by a low-privileged attacker to socially engineer a user with network access; the attack requires user interacti...

Tibco Software TIBCO Nimbus 跨站脚本漏洞

Tibco Software TIBCO Nimbus is a business application for process documentation from Tibco Software, USA. A cross-site scripting vulnerability exists in TIBCO Nimbus, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerabilit...

Apache Storm Command Injection Vulnerability

Apache Storm is a free and open source distributed real-time computing system. A command injection vulnerability exists in Apache Storm's getTopologyHistory service. An attacker can exploit this vulnerability by sending a specially crafted thrift request to the Nimbus server to achieve remote cod...

CVE-2021-38294

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

Command injection

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

CVE-2021-38294

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution

This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In order for the...

PT-2021-5193 · Apache · Apache Storm

Name of the Vulnerable Software and Affected Versions: Apache Storm versions 1.x prior to 1.2.4 Apache Storm versions 2.x prior to 2.2.1 Description: The issue is related to a Command Injection vulnerability in the getTopologyHistory service of Apache Storm. This vulnerability can be exploited by...

TIBCO Security Advisory: October 26, 2021 - TIBCO Nimbus -2021-35499

TIBCO Nimbus Stored Cross-site Scripting XSS vulnerabilities Original release date: October 26, 2021 Last revised: CVE-2021-35499 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus versions 10.4.0 and below The following component is affected: Web Reporting Description The component listed...

TIBCO Security Advisory: October 26, 2021 - TIBCO Nimbus -2021-35499

TIBCO Nimbus Stored Cross-site Scripting XSS vulnerabilities Original release date: October 26, 2021 Last revised: CVE-2021-35499 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus versions 10.4.0 and below The following component is affected: Web Reporting Description The component listed...

Security Bulletin: Multiple vulnerabilites affect IBM Jazz Foundation and IBM Engineering products.

Summary There are multiple vulnerabilities that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS Next, IBM Engineering Workflow Management EWM, IBM...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2015-5237 DESCRIPTION: Google Protocol Buffers could allow a remote attacker to execute arbitrary code on the system, caused by ...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2018-1288 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to bypass security restrictions. By using a manually created fetch request interfering with data replication, an attacker cou...

Security Bulletin: vulnerabilities in Nimbus JOSE+JWT affect IBM Watson Machine Learning Accelerator 1.2.1

Summary Vulnerabilities existing in the Nimbus JOSE+JWT version used by IBM Watson Machine Learning Accelerator 1.2.1. An interim fix that provides instructions on upgrading the Nimbus JOSE+JWT package to version 7.9 which resolves these vulnerabilities, are available on IBM Fix Central...

Important: Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor

Summary There are three vulnerabilities in Nimbus JOSE+JWT 3.1.2 used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3.0. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3 have addressed the applicable CVEs...