Ibm Cognos Analytics vulnerabilities

102 known vulnerabilities affecting ibm/cognos_analytics.

Total CVEs
102
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL6HIGH22MEDIUM72LOW2

Vulnerabilities

Page 2 of 6
CVE-2023-30996MEDIUMCVSS 5.3≥ 11.1.1, < 11.1.7≥ 11.2.0, < 11.2.4+5 more2024-02-26
CVE-2023-30996 [MEDIUM] CWE-346 CVE-2023-30996: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to un IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects of different origins. IBM X-Force ID: 254290.
cvelistv5nvd
CVE-2023-32344MEDIUMCVSS 4.3≥ 11.1.1, < 11.1.7≥ 11.2.0, < 11.2.4+5 more2024-02-26
CVE-2023-32344 [MEDIUM] CWE-352 CVE-2023-32344: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is p IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.
cvelistv5nvd
CVE-2023-35009MEDIUMCVSS 5.3≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.4+3 more2023-08-16
CVE-2023-35009 [MEDIUM] CWE-209 CVE-2023-35009: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system infor IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-Force ID: 257703.
cvelistv5nvd
CVE-2023-35011MEDIUMCVSS 5.4≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.4+3 more2023-08-16
CVE-2023-35011 [MEDIUM] CWE-918 CVE-2023-35011: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 257705.
cvelistv5nvd
CVE-2023-28530MEDIUMCVSS 5.4≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.4+3 more2023-07-22
CVE-2023-28530 [MEDIUM] CWE-79 CVE-2023-28530: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the
cvelistv5nvd
CVE-2023-25929MEDIUMCVSS 5.4≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.4+3 more2023-07-22
CVE-2023-25929 [MEDIUM] CWE-79 CVE-2023-25929: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 247861.
cvelistv5nvd
CVE-2021-39036MEDIUMCVSS 6.1v11.1v11.2+1 more2023-05-12
CVE-2021-39036 [MEDIUM] CWE-79 CVE-2021-39036: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213966.
cvelistv5nvd
CVE-2022-38708CRITICALCVSS 9.1≥ 11.1.0, ≤ 11.1.7≥ 11.2.0, ≤ 11.2.3+2 more2022-12-19
CVE-2022-38708 [CRITICAL] CWE-918 CVE-2022-38708: IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.
cvelistv5nvd
CVE-2022-43883HIGHCVSS 7.5≥ 11.1.0, ≤ 11.1.7≥ 11.2.0, ≤ 11.2.3+2 more2022-12-19
CVE-2022-43883 [HIGH] CWE-116 CVE-2022-43883: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by co IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 240266.
cvelistv5nvd
CVE-2022-39160MEDIUMCVSS 6.1≥ 11.1.0, < 11.1.7≥ 11.2.0, ≤ 11.2.3+2 more2022-12-19
CVE-2022-39160 [MEDIUM] CWE-79 CVE-2022-39160: IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnera IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 235064.
cvelistv5nvd
CVE-2022-43887MEDIUMCVSS 5.3≥ 11.1.0, < 11.1.7≥ 11.2.0, ≤ 11.2.3+2 more2022-12-19
CVE-2022-43887 [MEDIUM] CWE-532 CVE-2022-43887: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposu IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.
cvelistv5nvd
CVE-2022-34339MEDIUMCVSS 6.5≥ 11.1.0, < 11.1.7v11.1.7+2 more2022-11-03
CVE-2022-34339 [MEDIUM] CWE-312 CVE-2022-34339: "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can b "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."
nvd
CVE-2022-30614HIGHCVSS 7.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2022-30614 [HIGH] CVE-2022-30614: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flood IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591.
cvelistv5nvd
CVE-2022-36773HIGHCVSS 8.1≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2022-36773 [HIGH] CWE-611 CVE-2022-36773: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (X IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571.
cvelistv5nvd
CVE-2021-29823MEDIUMCVSS 6.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2021-29823 [MEDIUM] CWE-352 CVE-2021-29823: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which co IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204465.
cvelistv5nvd
CVE-2021-39045MEDIUMCVSS 5.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2021-39045 [MEDIUM] CWE-522 CVE-2021-39045: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information d IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IBM X-Force ID: 214345.
cvelistv5nvd
CVE-2021-20468MEDIUMCVSS 6.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2021-20468 [MEDIUM] CWE-352 CVE-2021-20468: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which co IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 196825.
cvelistv5nvd
CVE-2020-4301MEDIUMCVSS 6.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2020-4301 [MEDIUM] CWE-352 CVE-2020-4301: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which co IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 176609.
cvelistv5nvd
CVE-2021-39009MEDIUMCVSS 5.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2021-39009 [MEDIUM] CWE-312 CVE-2021-39009: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which ca IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554.
cvelistv5nvd
CVE-2021-38945CRITICALCVSS 9.8≥ 11.1.0, < 11.1.7v11.1.7+2 more2022-06-24
CVE-2021-38945 [CRITICAL] CWE-434 CVE-2021-38945: IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary fi IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238.
cvelistv5nvd
← Previous2 / 6Next →