CVE-2020-4431

IBM Planning Analytics Local 2.0 (Planning Analytics Local, Web UI) is affected by a cross-site scripting vulnerability (CVE-2020-4431) in the IBM Planning Analytics Local 2.0/Workspace Web UI, enabling an attacker to inject arbitrary JavaScript to potentially disclose credentials within a truste...

CVE-2020-4503

CVE-2020-4503 affects IBM Planning Analytics Local 2.0 (Planning Analytics Workspace). Root cause is cross-site scripting in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials in a trusted session. The connected IBM bulletin confirms release 53 fixes f...

CVE-2020-4367

IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179001...

CVE-2020-4360

IBM Planning Analytics Local 2.0 is affected by a cross-site scripting vulnerability in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. The issue affects IBM Planning Analytics Local 2.0 (Planning Analytics Workspace Releas...

CVE-2020-4367

CVE-2020-4367 affects IBM Planning Analytics Local 2.0 (Planning Analytics Local) with a vulnerability in cryptographic algorithms described as weaker than expected, potentially allowing decryption of highly sensitive information. The issue is corroborated by multiple sources in the Connected doc...

CVE-2020-4366

IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178965...

CVE-2020-4360

IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178765...

CVE-2020-4366

IBM Planning Analytics Local 2.0 is affected by a cross-site scripting (XSS) vulnerability in the Web UI, which could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Root cause: XSS in the Web UI of Planning Analytics Local 2.0. Affec...

Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by multiple vulnerabilities . These have been addressed in IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 53. Vulnerability Details CVEID: CVE-2018-16492 DESCRIPTION: Node.js extend...

CVE-2020-4306

IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2020-4306

IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

Cross site scripting

IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2020-4306

IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2020-4306

IBM Planning Analytics Local 2.0.0–2.0.9 is affected by a cross-site scripting (XSS) vulnerability in the Web UI that can permit embedding arbitrary JavaScript, potentially leading to credential disclosure in a trusted session. Affected versions: 2.0.0–2.0.9. Remediation: apply the fix in IBM Pla...

Security Bulletin: IBM Planning Analytics has addressed multiple Security Vulnerabilities

Summary This Security Bulletin addresses security vulnerabilities that have been remediated in IBM Planning Analytics 2.0.9.1. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Planning Analytics. These issues were disclosed as part of the IBM Java SDK...

IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution Exploit (2)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule "IBM TM1 / Planning Analytics Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a vulnerability in...

IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule "IBM TM1 / Planning Analytics Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a vulnerability in...

IBM Cognos TM1 / IBM Planning Analytics Server Configuration Overwrite / Code Execution Exploit

IBM Cognos TM1 Server / Planning Analytics Server TM1 suffers from a configuration overwrite vulnerability that can be leveraged to achieve code execution as SYSTEM via TM1 scripting. Extensive research is included in this advisory as well as the Metasploit module. IBM PA / TM1, dating back to...

IBM Cognos TM1 / IBM Planning Analytics Server Configuration Overwrite / Code Execution

Hi, Here's a fun one I have been working on for some time. tl;dr IBM PA / TM1, dating back to 2014, maybe 2009 is vulnerable to a unauthenticated configuration overwrite; this is abused to "fake authenticate" to it, and finally execute code as root / SYSTEM using TM1 scripting. Advisory below,...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Planning Analytics.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Planning Analytics. These issues were disclosed as part of the IBM Java SDK updates in April 2017 and July 2017. Vulnerability Details CVEID: CVE-2017-3511 DESCRIPTION: An unspecified vulnerability...