Interact
Monthly
Path traversal (CWE-22) in Tanium Data Service, with Tanium Interact also listed among the affected components, allows a high-privileged, authenticated attacker reaching the service over the network to manipulate files in a way that compromises integrity (rated High) and, to a lesser degree, availability (Low), with no confidentiality impact. Tanium reports it has addressed the issue in advisory TAN-2026-082, and the CVSS 3.1 base score is 5.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vuln.today priority decision places it in the this_month remediation cadence rather than an emergency one.
Uncontrolled resource consumption in Tanium Interact allows authenticated high-privilege administrators to trigger a denial of service condition through network-accessible endpoints. The vulnerability requires high-level administrative privileges (PR:H) and produces only availability impact with no confidentiality or integrity compromise. CVSS base score of 2.7 reflects the severe privilege barrier and limited impact scope.
Tanium Interact logs sensitive information that authenticated users can access, potentially exposing confidential data through log file inspection. The vulnerability requires valid credentials and does not allow modification or service disruption, limiting its impact to information disclosure.
Tanium addressed an improper access controls vulnerability in Interact. [CVSS 3.1 LOW]
Tanium addressed an improper access controls vulnerability in Interact. [CVSS 3.1 LOW]
The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Path traversal (CWE-22) in Tanium Data Service, with Tanium Interact also listed among the affected components, allows a high-privileged, authenticated attacker reaching the service over the network to manipulate files in a way that compromises integrity (rated High) and, to a lesser degree, availability (Low), with no confidentiality impact. Tanium reports it has addressed the issue in advisory TAN-2026-082, and the CVSS 3.1 base score is 5.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vuln.today priority decision places it in the this_month remediation cadence rather than an emergency one.
Uncontrolled resource consumption in Tanium Interact allows authenticated high-privilege administrators to trigger a denial of service condition through network-accessible endpoints. The vulnerability requires high-level administrative privileges (PR:H) and produces only availability impact with no confidentiality or integrity compromise. CVSS base score of 2.7 reflects the severe privilege barrier and limited impact scope.
Tanium Interact logs sensitive information that authenticated users can access, potentially exposing confidential data through log file inspection. The vulnerability requires valid credentials and does not allow modification or service disruption, limiting its impact to information disclosure.
Tanium addressed an improper access controls vulnerability in Interact. [CVSS 3.1 LOW]
Tanium addressed an improper access controls vulnerability in Interact. [CVSS 3.1 LOW]
The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.