CVE-2018-5434

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'s TIBCO Runtime Agent: versions up to and including 5.10.0, and TIBCO Runtime Agent for z/Linux: versions up to and including 5.9.1.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
TIBCO Software Inc.	TIBCO Runtime Agent	>= unspecified, <= 5.10.0
TIBCO Software Inc.	TIBCO Runtime Agent for z/Linux	>= unspecified, <= 5.9.1

References

http://www.securityfocus.com/bid/104454Third Party Advisory, VDB Entry
https://www.tibco.com/support/advisories/2018/06/security-advisory-june-12-2018-tibco-runtime-agent-2018-5434Vendor Advisory
http://www.securityfocus.com/bid/104454Third Party Advisory, VDB Entry
https://www.tibco.com/support/advisories/2018/06/security-advisory-june-12-2018-tibco-runtime-agent-2018-5434Vendor Advisory

Timeline

Published: Jun 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-54359.8The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire An CVE-2018-54368.8The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server cont CVE-2018-54378.8The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire An CVE-2018-54386.3Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the sessi CVE-2018-54399.8A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to ex CVE-2018-54409.8A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows (also WinCE) based CO CVE-2018-54417.8An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard device CVE-2018-54429.8A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buffer overflow vulnerab CVE-2018-54435.3A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. WebAccess/SCADA does not properly sanitiz CVE-2018-54455.3A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. An attacker has read access to files wit CVE-2018-54464.9Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.CVE-2018-54479.8An Improper Input Validation issue was discovered in Nari PCS-9611 relay. An improper input validation vulnerability has been identified tha