CVE-2020-9416

The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.

• CWE-79

• http://www.tibco.com/services/support/advisoriesVendor Advisory
• https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfireVendor Advisory
• http://www.tibco.com/services/support/advisoriesVendor Advisory
• https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfireVendor Advisory

Published

Sep 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9410The report generator component of TIBCO Software Inc.'s TIBC…8.8
• CVE-2020-9411The file transfer component of TIBCO Software Inc.'s TIBCO M…9.8
• CVE-2020-9412The file transfer component of TIBCO Software Inc.'s TIBCO M…9.8
• CVE-2020-9413The MFT Browser file transfer client and MFT Browser admin c…9.6
• CVE-2020-9414The MFT admin service component of TIBCO Software Inc.'s TIB…8.8
• CVE-2020-9415The TIBCO Data Virtualization Server component of TIBCO Soft…6.5
• CVE-2020-9417The Transaction Insight reporting component of TIBCO Softwar…8.8
• CVE-2020-9418An untrusted search path vulnerability in the installer of P…7.8
• CVE-2020-9419Multiple stored cross-site scripting (XSS) vulnerabilities i…5.4
• CVE-2020-9420The login password of the web administrative dashboard in Ar…6.5
• CVE-2020-9423LogicalDoc before 8.3.3 could allow an attacker to upload ar…9.8
• CVE-2020-9425An issue was discovered in includes/head.inc.php in rConfig …7.5