CVE-2025-1494 — UI Misrepresentation / Clickjacking in IBM Cognos Command Center

CWE-1021 — UI Misrepresentation / ClickjackingCWE-20 — Improper Input Validation4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.0%
top 92.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Cognos Command Center
Timeline
PublishedAug 26

Description

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5ibm/cognos_command_center10.2.4.1, 10.2.5+1
▶NVDibm/cognos_command_center10.2.4.1, 10.2.5+1

🔴Vulnerability Details

2
CVEList
IBM Cognos Command Center clickjacking↗2025-08-26
▶
GHSA
GHSA-vq5f-53c7-2g7m: IBM Cognos Command Center 10↗2025-08-26
▶

📋Vendor Advisories

1
Microsoft
The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.↗2016-01-12
▶
CVE-2025-1494 — UI Misrepresentation / Clickjacking | cvebase