Unscored severity · published May 20, 2011
CVE-2011-2020
Cross-site scripting (XSS) vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers to inject arbitrary web script or HTML…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
Iprocess Engine · Tibco
through 11.1.2; 10.3.0; 10.3.1; 10.3.2; 10.3.3; 10.3.4; +10 more · source: NVD
IW
Iprocess Workspace · Tibco
through 11.3; 11.0; 11.1; 11.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2020
osvdb.org
http://osvdb.org/72553
Vendor Advisory
http://secunia.com/advisories/44639
www.securityfocus.com
http://www.securityfocus.com/bid/47921
Vendor Advisory
http://www.tibco.com/multimedia/iprocess_advisory_20110518_tcm8-13710.txt
Vendor Advisory
http://www.tibco.com/services/support/advisories/iprocess-advisory_20110518.jsp
Vendor Advisory
http://www.vupen.com/english/advisories/2011/1272
More from Iprocess Engine
–
CVE-2011-2021
Session fixation vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers to hijack web sessions via unspecified vectors
–
CVE-2008-3338
Multiple buffer overflows in TIBCO Hawk (1) AMI C library (libtibhawkami) and (2) Hawk HMA (tibhawkhma), as used in TIBCO Hawk before 4.8.1; Runtime Agent (TRA) before 5.6.0;…
–
CVE-2008-1703
Multiple buffer overflows in TIBCO Software Rendezvous before 8.1.0, as used in multiple TIBCO products, allow remote attackers to execute arbitrary code via a crafted message
–
CVE-2008-1704
Multiple buffer overflows in TIBCO Software Enterprise Message Service (EMS) before 4.4.3, and iProcess Engine 10.6.0 through 10.6.1, allow remote attackers to execute arbitrary…