CVE-2017-5528

CVE-2017-5528 affects multiple TIBCO/JasperReports Server components where authorized users may perform XSS and CSRF attacks, potentially leading to partial disclosure of sensitive information. Affected are TIBCO JasperReports Server (versions <=6.1.1, 6.2.0, 6.2.1, 6.3.0), JasperReports Serve...

CVE-2017-5529: Exposure of Sensitive Information to an Unauthorized Actor

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition versions 6.4.0 and below, TIBCO JasperReports...

CVE-2017-5528: Cross-Site Request Forgery (CSRF)

Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting XSS and cross-site request forgery CSRF attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO...

PT-2017-16559

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0 TIBCO JasperReports Server Community Edition versions 6.3.0 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below TIBCO Jaspersoft for AW...

PT-2017-16560

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Library Community Edition versions 6.4.0 and below TIBCO JasperReports Library for ActiveMatrix BPM versions 6.2.0 and below TIBCO JasperReports Professional versions 6.2.1 and below, 6.3.0 TIBCO JasperReports Server versio...

RHEL 6 : jasperreports-server-pro (RHSA-2014:0037)

An updated jasperreports-server-pro package that fixes two security issues, several bugs, and adds various enhancements is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

RHEL 6 : jasperreports-server-pro (RHSA-2014:0389)

An updated jasperreports-server-pro package that fixes one security issue is now available. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fro...

RHEL 6 : Virtualization Manager (RHSA-2012:1537)

An updated jasperreports-server-pro package that fixes one security issue and various bugs is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

Important: Red Hat Security Advisory: jasperreports-server-pro security update

An updated jasperreports-server-pro package that fixes one security issue is now available. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fro...

Moderate: Red Hat Security Advisory: jasperreports-server-pro security, bug fix, and enhancement update

An updated jasperreports-server-pro package that fixes two security issues, several bugs, and adds various enhancements is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Moderate: Red Hat Security Advisory: jasperreports-server-pro security and bug fix update

An updated jasperreports-server-pro package that fixes one security issue and various bugs is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

CVE-2011-1911

JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via a brute-force approach...

Cross site request forgery (csrf)

JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via a brute-force approach...

CVE-2011-1911

CVE-2011-1911 affects JasperReports Server Community Project (JasperServer) versions 3.7.0 and 3.7.1. The root cause is a predictable _flowExecutionKey parameter, enabling CSRF via brute-forcing across requests. Impact described includes the ability for an attacker, tricking an authenticated user...

PT-2011-3471

Name of the Vulnerable Software and Affected Versions JasperReports Server Community Project versions 3.7.0 through 3.7.1 Description The issue allows remote attackers to conduct cross-site request forgery CSRF attacks via a brute-force approach, due to the use of a predictable flowExecutionKey...

CVE-2011-1911: Cross-Site Request Forgery (CSRF)

JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via a brute-force approach...

Opentaps ERP + CRM Detection

The remote host is running Opentaps ERP + CRM. Opentaps is a full-featured ERP + CRM suite which incorporates several open source projects, including: - Apache Geronimo, Tomcat, and OFBiz for the data model and transaction framework - Pentaho and JasperReports for business intelligence - Funambol...

Opentaps ERP + CRM service detection

The remote host is running Opentaps ERP + CRM. opentaps is a full-featured ERP + CRM suite which incorporates several open source projects, including Apache Geronimo, Tomcat, and OFBiz for the data model and transaction framework; Pentaho and JasperReports for business intelligence; Funambol for...