Ibm Cognos Analytics vulnerabilities

CVE-2021-29824 [MEDIUM] CVE-2021-29824: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468.

CVE-2016-0398 [MEDIUM] CWE-20 CVE-2016-0398: IBM Cognos Analytics (CA) 11.0 before 11.0.2 allows remote attackers to conduct content-spoofing att IBM Cognos Analytics (CA) 11.0 before 11.0.2 allows remote attackers to conduct content-spoofing attacks via a crafted URL.

CVE-2019-4334 [MEDIUM] CVE-2019-4334: IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-Force ID: 161271.

CVE-2019-4231 [MEDIUM] CWE-352 CVE-2019-4231: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.

CVE-2019-4589 [MEDIUM] CWE-269 CVE-2019-4589: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less privileged user. IBM X-Force ID: 167449.

CVE-2026-15995 [MEDIUM] CWE-362 CVE-2026-15995: IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an at IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple authenticated users submit report-related tasks simultaneously.

CVE-2017-1783 [MEDIUM] CWE-287 CVE-2017-1783: IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytic IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without proper authentication. IBM X-Force ID: 136857.

CVE-2018-1842 [LOW] CWE-347 CVE-2018-1842: IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token. IBM X-Force ID: 150902.

CVE-2020-4951 [LOW] CWE-200 CVE-2020-4951: IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a loca IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information.