CVE-2014-0861

Cross-site scripting XSS vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is no...

CVE-2014-0861

CVE-2014-0861 describes an XSS vulnerability in IBM Cognos BI/BI Server components (IBM Cognos BI Server 8.4.1; 10.1.x; 10.2.x; 10.2.1.x) where an unsafely handled parameter during use of the Back button enables an attacker to inject script/HTML. The issue is tied to insufficient input sanitizati...

CVE-2013-6732

IBM Cognos BI Server is affected by CVE-2013-6732, a reflective cross-site scripting (XSS) vulnerability. An unsanitized input parameter can be exploited by tricking a user into clicking a crafted link to inject arbitrary script/HTML. Affected versions: Cognos BI 8.4.1; 10.1 before IF6; 10.1.1 be...

CVE-2014-0854

CVE-2014-0854 affects IBM Cognos BI/Analytics server components (e.g., Cognos BI 8.4.1, 10.1.x, 10.2.x with specific IF levels) where an XML document containing an external entity declaration, used with an entity reference, enables remote authenticated users to read arbitrary files (XXE). The roo...

CVE-2014-0854

The server in IBM Cognos Business Intelligence BI 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an...

CVE-2013-2988

Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2978...

CVE-2013-0586

Cross-site scripting XSS vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Path traversal

Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2988...

CVE-2013-2978

CVE-2013-2978 affects IBM Cognos Business Intelligence server versions 8.4.1, 10.1, 10.1.1, 10.2 and 10.2.1. It is described as an absolute path traversal vulnerability that allows remote authenticated users to read files by leveraging the Report Author privilege. The provided documents do not in...

CVE-2013-2978

Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2988...

CVE-2013-2988

Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2978...

CVE-2013-0586

Cross-site scripting XSS vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2988

CVE-2013-2988 is an absolute path traversal vulnerability in the IBM Cognos BI server affecting versions 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1, enabling remote authenticated users to read files via the Report Author privilege. The issue is addressed in IBM advisories linked to IBM Sterling Contro...

PT-2013-4073

Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence BI versions 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 Description The issue allows remote authenticated users with the Report Author privilege to read files due to an absolute path traversal vulnerability in the...

CVE-2013-3803

Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Intelligence Service...

CVE-2013-3803

Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Intelligence Service...

CVE-2013-3803

Oracle Hyperion 11.x (11.1.1.3/11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, 11.1.2.2.305 and earlier) is affected by a directory traversal vulnerability in the Hyperion BI+ component. The issue allows remote authenticated users to access sensitive files via crafted resource requests (e.g.,...

CVE-2013-3803: Undefined Security Weakness

Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Intelligence Service...

PT-2013-4642

Name of the Vulnerable Software and Affected Versions Oracle Hyperion versions 11.1.1.3 through 11.1.1.4.107 Oracle Hyperion versions 11.1.2.1 through 11.1.2.1.129 Oracle Hyperion versions 11.1.2.2 through 11.1.2.2.305 Description The issue affects confidentiality and is related to the Intelligen...

CVE-2012-4835

Cross-site scripting XSS vulnerability in IBM Cognos Business Intelligence BI 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...