IBM Controller 安全漏洞

IBM Controller is a Web-based financial consolidation tool from International Business Machines IBM. A security vulnerability exists in IBM Controller versions 11.0.0, 11.0.1, and 11.1.0 that stems from the potential disclosure of sensitive credentials...

Security Bulletin: IBM Controller has addressed a security vulnerability (CVE-2025-33079)

Summary IBM Controller has addressed a security vulnerability that could allow an authenticated user to obtain sensitive credentials. This Security Bulletin relates only to the direct usage of third-party components by IBM Controller and not any nested dependencies within the product. Vulnerabili...

PT-2025-22887 · Ibm · Ibm Controller

Name of the Vulnerable Software and Affected Versions: IBM Controller versions 11.0.0 through 11.1.0 Description: The issue allows an authenticated user to obtain sensitive credentials that may be inadvertently included within the source code. Recommendations: For versions 11.0.0 through 11.1.0,...

Security Bulletin: IBM Controller is affected by vulnerabilities

Summary There are vulnerabilities in IBM® Websphere Application Server Liberty and Open-Source Software OSS components used by IBM Controller. Additionally, due to weak password requirements, IBM Controller is susceptible to compromised user accounts. Please refer to the table in the Related...

Security Bulletin: IBM Controller is affected by vulnerabilities

Summary There are vulnerabilities in IBM® Websphere Application Server Liberty and Open-Source Software OSS components used by IBM Controller. Additionally, IBM Controller is vulnerable to Client-Side Desync CSD CVE-2022-39163. Please refer to the table in the Related Information section for...

CVE-2024-41778

IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2024-41778

IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2024-41778

IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2024-41778

CVE-2024-41778 affects IBM Controller 11.0.0–11.0.1 and 11.1.0, where default weak password requirements may allow attackers to compromise user accounts. Connected sources corroborate weak password handling across the affected versions. The IBM Security Bulletin lists remediation by upgrading to ...

CVE-2024-41778 IBM Controller information disclosure

IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

CVE-2024-41778 IBM Controller information disclosure

IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

PT-2025-9179 · Ibm · Ibm Controller

Name of the Vulnerable Software and Affected Versions: IBM Controller versions 11.0.0 through 11.0.1 IBM Controller version 11.1.0 Description: The issue makes it easier for attackers to compromise user accounts because it does not require strong passwords by default. Recommendations: For IBM...

The vulnerability of software solutions that support the process of closing, consolidating, and generating reports for IBM Cognos Controller and IBM Controller lies in the improper restriction on XML links to external objects. This allows attackers to carry out XXE attacks.

The vulnerability of software solutions that support the process of closing, consolidating, and generating reports for IBM Cognos Controller and IBM Controller is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow attackers to perform XXE...

CVE-2024-45081

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect authorization checks...

CVE-2024-45084

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents...

CVE-2024-28776

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2024-52902

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system...

CVE-2024-28778

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or repositories under the name of the organization...

CVE-2021-20455

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2024-40702

IBM Cognos Controller 11.0.0–11.0.1 and IBM Controller 11.1.0 are affected by CVE-2024-40702 due to improper certificate validation, enabling an unauthorized user to obtain valid tokens and access protected resources (CVSS v3.1 base score 8.2). Remediation per the IBM security bulletin: IBM Contr...