CVE-2021-35499

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.4.0 and below.

• CWE-79

• https://www.tibco.com/services/support/advisoriesVendor Advisory
• https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-26-2021-tibco-nimbus-2021-35499Vendor Advisory
• https://www.tibco.com/services/support/advisoriesVendor Advisory
• https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-26-2021-tibco-nimbus-2021-35499Vendor Advisory

Published

Oct 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35493The WebFOCUS Reporting Server and WebFOCUS Client components…5.4
• CVE-2021-35494The Rest API component of TIBCO Software Inc.'s TIBCO Jasper…5.3
• CVE-2021-35495The Scheduler Connection component of TIBCO Software Inc.'s …8.8
• CVE-2021-35496The XMLA Connections component of TIBCO Software Inc.'s TIBC…7.5
• CVE-2021-35497The FTL Server (tibftlserver) and Docker images containing t…7.5
• CVE-2021-35498The TIBCO EBX Web Server component of TIBCO Software Inc.'s …9.8
• CVE-2021-3550A DLL search path vulnerability was reported in Lenovo PCMan…7.8
• CVE-2021-35500The Data Virtualization Server component of TIBCO Software I…5.5
• CVE-2021-35501PandoraFMS <=7.54 allows Stored XSS by placing a payload in …5.4
• CVE-2021-35502app/View/Elements/genericElements/IndexTable/Fields/generic_…9.8
• CVE-2021-35503Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-For…6.1
• CVE-2021-35504Afian FileRun 2021.03.26 allows Remote Code Execution (by ad…7.2