CVE-2021-28827

The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, TIBCO Administrator - Enterprise Edition for z/Linux, TIBCO Runtime Agent, TIBCO Runtime Agent, TIBCO Runtime Agent for z/Linux, and TIBCO Runtime Agent for z/Linux contains an easily exploitable vulnerability that allows an unauthenticated attacker to social engineer a legitimate user with network access to execute a Stored XSS attack targeting the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1, TIBCO Runtime Agent: versions 5.10.2 and below, TIBCO Runtime Agent: versions 5.11.0 and 5.11.1, TIBCO Runtime Agent for z/Linux: versions 5.10.2 and below, and TIBCO Runtime Agent for z/Linux: versions 5.11.0 and 5.11.1.

• CWE-79

• http://www.tibco.com/services/support/advisoriesVendor Advisory
• https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-20-2021-tibco-administrator-2021-28827Vendor Advisory
• http://www.tibco.com/services/support/advisoriesVendor Advisory
• https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-20-2021-tibco-administrator-2021-28827Vendor Advisory

Published

Apr 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28821The Windows Installation component of TIBCO Software Inc.'s …7.8
• CVE-2021-28822The Enterprise Message Service Server (tibemsd), Enterprise …7.8
• CVE-2021-28823The Windows Installation component of TIBCO Software Inc.'s …7.8
• CVE-2021-28824The Windows Installation component of TIBCO Software Inc.'s …8.8
• CVE-2021-28825The Windows Installation component of TIBCO Software Inc.'s …7.8
• CVE-2021-28826The Windows Installation component of TIBCO Software Inc.'s …7.8
• CVE-2021-28828The Administration GUI component of TIBCO Software Inc.'s TI…8.8
• CVE-2021-28829The Administration GUI component of TIBCO Software Inc.'s TI…8
• CVE-2021-28830The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R…7.8
• CVE-2021-28831decompress_gunzip.c in BusyBox through 1.32.1 mishandles the…7.5
• CVE-2021-28832VSCodeVim before 1.19.0 allows attackers to execute arbitrar…7.8
• CVE-2021-28833Increments Qiita::Markdown before 0.34.0 allows XSS via a cr…6.1