PT-2024-12185 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.4.1 through 11.0.0 Description: The issue is related to injection attacks in application logging due to the lack of sanitization of user-provided data. Recommendations: For versions 10.4.1 through 11.0.0,...

PT-2024-12762 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.4.1 through 11.0.0 Description: The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in the back-end databas...

CVE-2020-4874: Use of a Broken or Risky Cryptographic Algorithm

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190837...

CVE-2021-20451: Improper Neutralization of Special Elements used in an SQL Command

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 196643...

CVE-2021-20450: Reliance on Cookies without Validation and Integrity Checking

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...

CVE-2021-20556: Observable Response Discrepancy

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames. IBM X-Force ID: 199181...

IBM Cognos Controller 加密问题漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and creating and managing financial reports. A cryptographic issue vulnerability exists in IBM Cognos...

IBM Cognos Controller 安全漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. A user enumeration vulnerability exists in IBM Cognos...

CVE-2023-40696: Use of a Broken or Risky Cryptographic Algorithm

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 264939...

CVE-2023-23474: Generation of Error Message Containing Sensitive Information

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 245403...

CVE-2023-40695: Insufficient Session Expiration

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938...

IBM Cognos Controller 加密问题漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and creating and managing financial reports. A cryptographic issue vulnerability exists in IBM Cognos...

IBM Cognos Controller 代码问题漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. An access control error vulnerability exists in IBM...

IBM Cognos Controller 安全漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and creating and managing financial reports. A security vulnerability exists in IBM Cognos Controller versio...

PT-2024-11986 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.4.1 through 11.0.0 Description: The issue allows a remote attacker to obtain sensitive information when a stack trace is returned in the browser. Recommendations: For versions 10.4.1 through 11.0.0, update to...

PT-2024-10870 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 10.4.1 through 11.0.0 Description: The issue concerns the lack of a secure attribute on authorization tokens or session cookies. Attackers may obtain cookie values by sending an http link to a user or by plantin...

IBM Cognos Controller 安全漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and creating and managing financial reports. A security vulnerability exists in IBM Cognos Controller versio...

PT-2024-10873

Name of the Vulnerable Software and Affected Versions IBM Cognos Controller versions 10.4.1 through 11.0.0 Description The issue allows a remote user to enumerate usernames due to differentiating error messages on existing usernames. Recommendations For versions 10.4.1 through 11.0.0, update to a...

Security Bulletin: IBM Cognos Controller has addressed multiple vulnerabilities

Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Cognos Controller 10.4.2 FP2 and 10.4.1 IF15 . There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by IBM Cognos Controller. The applicable CVEs have been addressed by upgradin...

Security Bulletin: IBM Cognos Controller is affected but not vulnerable to arbitrary code execution and SQL injection due to Apache Log4j v1 vulnerabilities (CVE-2022-23305, CVE-2022-23302, CVE-2021-4104)

Summary Apache Log4j is used by IBM Cognos Controller as part of its logging infrastructure. This bulletin addresses the exposure to the Apache Log4j vulnerabilities CVE-2022-23305, CVE-2022-23302, CVE-2021-4104. Although IBM Cognos Controller is not vulnerable to the listed CVEs, all instances o...