CVE-2018-12410: critical vulnerability in TIBCO Spotfire Statistics Services
TIBCO Spotfire Statistics Services remote execution vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
TIBCO Spotfire Statistics Services has a critical flaw that lets attackers run malicious code on the server without logging in. This can give them full control over the system.
Multiple unauthenticated remote code execution vulnerabilities exist in the web server component of TIBCO Spotfire Statistics Services (≤7.11.0). An attacker can exploit these without authentication to execute arbitrary code with the privileges of the web server process, potentially leading to complete system compromise.
In the same product, most dangerous first.