Lucene search

K

Cognos Business Intelligence Security Vulnerabilities

cve
cve

CVE-2018-1934

IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID:...

8.8CVSS

8.7AI Score

0.001EPSS

2019-12-20 05:15 PM
59
cve
cve

CVE-2017-1486

IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

6.1CVSS

6.7AI Score

0.001EPSS

2018-04-23 01:29 PM
26
cve
cve

CVE-2017-1764

IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM X-Force ID:...

7CVSS

7.6AI Score

0.0004EPSS

2018-04-23 01:29 PM
25
cve
cve

CVE-2016-9710

IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a file from the local system, which could allow the attacker to obtain sensitive information. IBM X-Force ID:...

5.3CVSS

6.6AI Score

0.002EPSS

2017-06-07 05:29 PM
20
cve
cve

CVE-2017-1125

IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID:...

3.3CVSS

5.4AI Score

0.0004EPSS

2017-06-07 05:29 PM
28
cve
cve

CVE-2016-0254

IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consume all available CPU resources and cause a denial of...

6.5CVSS

7.5AI Score

0.002EPSS

2017-06-07 05:29 PM
22
cve
cve

CVE-2016-3037

IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key. An authenticated attacker with user interaction could obtain this sensitive information. IBM X-Force ID:...

5.7CVSS

6.2AI Score

0.001EPSS

2017-04-17 09:59 PM
25
cve
cve

CVE-2016-3036

IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing packets. A remote attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID:...

7.5CVSS

7.9AI Score

0.002EPSS

2017-04-17 09:59 PM
18
cve
cve

CVE-2016-3038

IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

5.4CVSS

5.6AI Score

0.0005EPSS

2017-04-17 09:59 PM
25
cve
cve

CVE-2016-8960

IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the higher-privilege user's cookie value from its HTTP request and then reusing it in subsequent requests. IBM Reference #:...

8.8CVSS

8.4AI Score

0.001EPSS

2017-03-27 10:59 PM
22
cve
cve

CVE-2016-9985

IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #:...

5.5CVSS

6.8AI Score

0.0004EPSS

2017-03-08 07:59 PM
18
cve
cve

CVE-2016-0217

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web...

5.4CVSS

6.2AI Score

0.001EPSS

2017-02-01 10:59 PM
23
cve
cve

CVE-2016-0218

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security...

5.4CVSS

7.4AI Score

0.001EPSS

2017-02-01 10:59 PM
20
cve
cve

CVE-2016-0346

Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before IF12, and 10.1.1 before IF19 allows remote authenticated users to inject arbitrary web script or HTML via a crafted...

5.4CVSS

5AI Score

0.001EPSS

2016-07-03 09:59 PM
23
cve
cve

CVE-2016-0221

Cross-site scripting (XSS) vulnerability in IBM Cognos TM1, as used in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before IF12, and 10.1.1 before IF19, allows remote authenticated users to inject arbitrary web script or HTML via a crafted...

5.4CVSS

6AI Score

0.001EPSS

2016-07-03 09:59 PM
19
cve
cve

CVE-2014-6145

Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence 10.1 before IF10, 10.1.1 before IF9, 10.2 before IF11, 10.2.1 before IF8, and 10.2.1.1 before IF7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted...

4.3AI Score

0.001EPSS

2014-12-12 11:59 AM
18
cve
cve

CVE-2014-4810

IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended...

6.9AI Score

0.003EPSS

2014-11-05 11:55 AM
18
cve
cve

CVE-2014-0861

Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is....

7.4AI Score

0.001EPSS

2014-02-22 09:55 PM
20
cve
cve

CVE-2014-0854

The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an.....

8.6AI Score

0.003EPSS

2014-02-22 09:55 PM
15
cve
cve

CVE-2013-6732

Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified...

7.3AI Score

0.001EPSS

2014-02-22 09:55 PM
23
cve
cve

CVE-2013-3030

The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service (temporary gateway outage) via crafted HTTP...

8.9AI Score

0.001EPSS

2013-11-18 03:55 AM
16
cve
cve

CVE-2013-4034

IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related...

8.6AI Score

0.009EPSS

2013-11-18 03:55 AM
23
cve
cve

CVE-2013-2978

Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than...

6AI Score

0.002EPSS

2013-08-27 03:34 AM
17
cve
cve

CVE-2013-2988

Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than...

6AI Score

0.002EPSS

2013-08-27 03:34 AM
17
cve
cve

CVE-2013-0586

Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified...

5.2AI Score

0.001EPSS

2013-08-27 03:34 AM
19
cve
cve

CVE-2012-4858

IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 does not properly validate Java serialized input, which allows remote attackers to execute arbitrary commands via unspecified...

7.7AI Score

0.006EPSS

2013-03-05 05:02 AM
25
cve
cve

CVE-2012-4837

IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified...

6.5AI Score

0.001EPSS

2013-03-05 05:02 AM
27
cve
cve

CVE-2012-4840

IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and call XPath extension functions, via unspecified...

7AI Score

0.002EPSS

2013-03-05 05:02 AM
28
cve
cve

CVE-2012-4835

Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to inject arbitrary web script or HTML via unspecified...

5.7AI Score

0.002EPSS

2013-03-05 05:02 AM
17
cve
cve

CVE-2012-4836

Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is not properly handled during rendering of....

5.1AI Score

0.001EPSS

2013-03-05 05:02 AM
25
cve
cve

CVE-2012-2193

Cross-site scripting (XSS) vulnerability in Query Studio in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows user-assisted remote attackers to inject arbitrary web script or HTML via unspecified...

5.7AI Score

0.002EPSS

2013-03-05 04:56 AM
23
cve
cve

CVE-2012-2177

Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors related to the search...

5.6AI Score

0.002EPSS

2013-03-05 04:56 AM
19
cve
cve

CVE-2012-4847

IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted request containing a zero-valued...

6.2AI Score

0.001EPSS

2012-11-14 12:30 PM
24
cve
cve

CVE-2011-0486

Cross-site scripting (XSS) vulnerability in cognos.cgi in IBM Cognos 8 Business Intelligence (BI) 8.4.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via the pathinfo...

5.7AI Score

0.003EPSS

2011-01-18 06:03 PM
22
cve
cve

CVE-2010-1490

Unspecified vulnerability in IBM Cognos 8 Business Intelligence before 8.4.1 FP1 has unknown impact and attack...

6.5AI Score

0.003EPSS

2010-04-21 02:30 PM
29