CVE-2022-30579

The CVE-2022-30579 affects TIBCO Spotfire: Web Player component in Spotfire Analytics Platform for AWS Marketplace and Spotfire Server (both v12.0.0). A low-privilege, network-connected attacker can trigger a blind Server-Side Request Forgery (SSRF) on the affected system. The vulnerability is de...

CVE-2025-3115

CVE-2025-3115 involves TIBCO Spotfire data functions with injection vulnerabilities and insufficient validation of filenames during file uploads, enabling potential arbitrary code execution. Connected sources indicate this is a high-severity issue (CVSS 3.1/4.0, CRITICAL) affecting Spotfire compo...

CVE-2023-26221

The connected PT advisory confirms CVE-2023-26221 affects TIBCO Spotfire Connectors in Spotfire Analyst (12.3.0–12.5.0), Spotfire Server (12.3.0–12.5.0), and Spotfire for AWS Marketplace (12.5.0). It is described as an easily exploitable issue that lets a low-privileged attacker with read/write a...

CVE-2022-41558

The CVE-2022-41558 entry describes a Stored Cross Site Scripting (XSS) vulnerability in the Visualizations component of TIBCO Spotfire products (Analyst, Desktop, Server, and Analytics Platform for AWS Marketplace). A low-privileged, network-connected attacker can trigger XSS with user interactio...

CVE-2021-23275

CVE-2021-23275 concerns a Windows Installation component in TIBCO products (TIBCO Enterprise Runtime for R – Server Edition, Spotfire Server/Analytics Platform for AWS Marketplace, Spotfire Statistics Services, and Spotfire Server components). The vulnerability stems from a lack of access restric...

CVE-2021-28830

The CVE-2021-28830 issue affects TIBCO Spotfire Server and related TIBCO Runtime for R components, where a local, low-privilege attacker with Windows access could abuse a component that searches for run-time artifacts outside the installation hierarchy to execute malicious software with elevated ...

CVE-2020-9416

CVE-2020-9416 affects TIBCO Spotfire client components (Analyst, Analytics Platform for AWS Marketplace, Desktop, Server) across multiple versions: Analyst 10.7.0–10.10.0, Analytics Platform AWS 10.7.0–10.10.1, Desktop 10.7.0–10.10.0, Server 10.7.0–10.10.1. Described as a stored cross-site script...