Ibm Cognos Analytics vulnerabilities
109 known vulnerabilities affecting ibm/cognos_analytics.
Total CVEs
109
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL6HIGH24MEDIUM77LOW2
Vulnerabilities
Page 5 of 6
CVE-2019-4623P4MEDIUMCVSS 5.4v11.0.0v11.1.0+2 more2019-12-30
CVE-2019-4623 [MEDIUM] CWE-79 CVE-2019-4623: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168924.
nvd
CVE-2023-25929P4MEDIUMCVSS 5.4≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.4+3 more2023-07-22
CVE-2023-25929 [MEDIUM] CWE-79 CVE-2023-25929: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows
IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 247861.
nvd
CVE-2024-25041P4MEDIUMCVSS 5.4≥ 11.2.0, ≤ 11.2.3≥ 12.0.0, ≤ 12.0.2+2 more2024-06-28
CVE-2024-25041 [MEDIUM] CWE-79 CVE-2024-25041: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potential
IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Assistant. IBM X-Force ID: 282780.
nvd
CVE-2023-30996P4MEDIUMCVSS 5.3≥ 11.1.1, < 11.1.7≥ 11.2.0, < 11.2.4+5 more2024-02-26
CVE-2023-30996 [MEDIUM] CWE-346 CVE-2023-30996: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to un
IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects of different origins. IBM X-Force ID: 254290.
nvd
CVE-2018-1413P4MEDIUMCVSS 5.4≥ 11.0.0.0, ≤ 11.0.10.0v11.02018-05-07
CVE-2018-1413 [MEDIUM] CWE-79 CVE-2018-1413: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138819.
nvd
CVE-2017-1535P4MEDIUMCVSS 5.4v11.0.0v11.0.1+6 more2017-08-29
CVE-2017-1535 [MEDIUM] CWE-79 CVE-2017-1535: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130677.
nvd
CVE-2017-1485P4MEDIUMCVSS 5.4v11.0.0v11.0.1+6 more2017-08-29
CVE-2017-1485 [MEDIUM] CWE-79 CVE-2017-1485: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128623.
nvd
CVE-2016-3031P4MEDIUMCVSS 5.4v11.0.0v11.0.1+3 more2017-04-05
CVE-2016-3031 [MEDIUM] CWE-79 CVE-2016-3031: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998887.
nvd
CVE-2016-3015P4MEDIUMCVSS 5.4v11.0.0v11.0.1+3 more2017-04-05
CVE-2016-3015 [MEDIUM] CWE-79 CVE-2016-3015: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998887.
nvd
CVE-2021-39009P4MEDIUMCVSS 5.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2021-39009 [MEDIUM] CWE-312 CVE-2021-39009: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which ca
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554.
nvd
CVE-2025-36076P4MEDIUMCVSS 4.3≥ 12.1.0, ≤ 12.1.3 FP1≥ 12.0.4, ≤ 12.0.4 FP22026-09-18
CVE-2025-36076 [MEDIUM] CWE-540 CVE-2025-36076: IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive infor
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.
nvd
CVE-2017-1784P4MEDIUMCVSS 5.5v11.0.0v11.0.1+10 more2018-01-29
CVE-2017-1784 [MEDIUM] CWE-200 CVE-2017-1784: IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive inf
IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local user. IBM X-Force ID: 136858.
nvd
CVE-2016-3032P4MEDIUMCVSS 5.4v11.0.0v11.0.1+5 more2017-05-10
CVE-2016-3032 [MEDIUM] CWE-79 CVE-2016-3032: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114516.
nvd
CVE-2021-39045P4MEDIUMCVSS 5.5≥ 11.1.0, < 11.1.7≥ 11.2.0, < 11.2.3+3 more2022-09-01
CVE-2021-39045 [MEDIUM] CWE-522 CVE-2021-39045: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information d
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IBM X-Force ID: 214345.
nvd
CVE-2024-45082P4MEDIUMCVSS 5.2≥ 11.2.0, ≤ 11.2.4≥ 12.0.0, ≤ 12.0.32024-12-18
CVE-2024-45082 [MEDIUM] CWE-601 CVE-2024-45082: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 could allow a remote attacker
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3
could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would
nvd
CVE-2019-4722P4MEDIUMCVSS 4.3v11.0.0v11.1.0+2 more2021-06-01
CVE-2019-4722 [MEDIUM] CWE-755 CVE-2019-4722: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of certain error conditions. IBM X-Force ID: 172128.
nvd
CVE-2021-38905P4MEDIUMCVSS 4.3v11.1.7v11.2.0+1 more2022-04-22
CVE-2021-38905 [MEDIUM] CVE-2021-38905: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pag
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697.
nvd
CVE-2023-32344P4MEDIUMCVSS 4.3≥ 11.1.1, < 11.1.7≥ 11.2.0, < 11.2.4+5 more2024-02-26
CVE-2023-32344 [MEDIUM] CWE-352 CVE-2023-32344: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is p
IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.
nvd
CVE-2019-4729P4MEDIUMCVSS 4.3≥ 11.0.0.0, < 11.0.13≥ 11.1.0, < 11.1.6+2 more2020-04-27
CVE-2019-4729 [MEDIUM] CWE-209 CVE-2019-4729: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information whe
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 172519.
nvd
CVE-2025-0917P4MEDIUMCVSS 4.8≥ 11.2.0, ≤ 11.2.4≥ 12.0.0, ≤ 12.0.4+10 more2025-06-11
CVE-2025-0917 [MEDIUM] CWE-79 CVE-2025-0917: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.
IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
nvd