CVE-2018-1721

IBM Cognos Analytics 11.0 and 11.1 are affected by CVE-2018-1721, an XML External Entity Injection (XXE) when processing XML data. A remote attacker could potentially expose sensitive information or cause the web server to make HTTP requests to arbitrary domains due to the XXE flaw. This vulnerab...

CVE-2019-4645

CVE-2019-4645 affects IBM Cognos Analytics 11.0 and 11.1 with a cross-site scripting (XSS) flaw in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. IBM’s bulletin notes mitigations via updates: Cognos Analytics 11.1.4 and 11...

CVE-2022-34357

CVE-2022-34357 affects IBM Cognos Analytics Mobile Server versions 11.1.7, 11.2.4, and 12.0.0. Root cause: weak or absent rate limiting allows unlimited HTTP requests from a single user, leading to Denial of Service and service unavailability for other users. Remediation provided in connected doc...

CVE-2019-4334

CVE-2019-4334 affects IBM Cognos Analytics 11.0 and 11.1 . The connected documents indicate an information-disclosure vulnerability where an authenticated user could obtain sensitive information, with the NVD listing a CVSS v3.1 base score of 4.3 (Medium). The IBM security bulletin confirms the i...

CVE-2024-40703

Summary of CVE-2024-40703 (IBM Cognos Analytics) : A local attacker could obtain sensitive information in the form of an exposed API key affecting IBM Cognos Analytics products and IBM Cognos Analytics Reports for iOS. Affected are IBM Cognos Analytics versions 11.2.0–11.2.4, 12.0.0–12.0.3, and I...

CVE-2023-32344

CVE-2023-32344 affects IBM Cognos Analytics versions 11.1.7, 11.2.4 FP? and 12.0.0, with a form action hijacking flaw that lets an attacker modify the form action to reference an arbitrary path. Root cause and impact are described across multiple sources (IBM Cognos Analytics documentation and ad...

CVE-2023-43051

IBM Cognos Analytics is affected by CVE-2023-43051 (XSS) in versions 11.1.7, 11.2.4, and 12.0.0, enabling embedding of arbitrary JavaScript in the Web UI and potentially credential disclosure within a trusted session. The issue is addressed by upgrading to: 12.0.2 for 12.0.x, 11.2.4 FP3 for 11.2....

CVE-2025-0823

CVE-2025-0823 affects IBM Cognos Analytics 11.2.0–11.2.4 FP5 and 12.0.0–12.0.4. Root cause is a path traversal vulnerability allowing a remote attacker to view arbitrary files by sending crafted URLs with /../ sequences. Impact is exposure of sensitive files; no exploitation details are provided ...

CVE-2023-38359

CVE-2023-38359 - IBM Cognos Analytics XSS : The vulnerability affects IBM Cognos Analytics versions 11.1.7, 11.2.4, and 12.0.0 where untrusted input in the Web UI can be used to embed arbitrary JavaScript, potentially exposing credentials within a trusted session. Root cause: cross-site scripting...

CVE-2023-30996

CVE-2023-30996 affects IBM Cognos Analytics (versions 11.1.7, 11.2.4, 12.0.0) and describes information leakage due to unverified sources in inter-origin Windows object messages. The vulnerability is an information disclosure issue rather than remote code execution. Remediation is to upgrade to f...

CVE-2021-20464

CVE-2021-20464 affects IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7). A malicious authenticated user could trigger an XML Bomb attack, leading to a denial of service of the affected PowerPlay component. Connected sources confirm impacted product lines and the XM...

CVE-2021-29824

IBM Cognos Analytics is affected by CVE-2021-29824, a privilege-escalation flaw that could allow a lower-privilege user to read the Data Connections page. Public sources in the provided documents identify IBM Cognos Analytics 11.2.x and 11.1.x as affected. The issue is addressed by IBM fixes: 11....

CVE-2021-38886

IBM Cognos Analytics is affected by CVE-2021-38886: cross-site request forgery that could allow a trusted-user action to be executed by an attacker. The vulnerability affects IBM Cognos Analytics 11.2.x and 11.1.x (notably 11.2.x and 11.1.x lines cited in sources). Remediation is available: IBM C...

CVE-2021-38946

IBM Cognos Analytics 11.1.7, 11.2.0 (and 11.1.x affected streams) are affected by CVE-2021-38946, a cross-site scripting vulnerability in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials in a trusted session. Concretely, multiple sources note the vul...

CVE-2019-4183

IBM Cognos Analytics 11.0 and 11.1 are affected by a denial-of-service issue where remote attackers can send specially crafted requests to exhaust CPU and memory. The shared sources identify the affected products as IBM Cognos Analytics 11.0 and 11.1, but do not detail the root cause in this exce...

CVE-2021-38904

IBM Cognos Analytics 11.1.7 and 11.2.0 are affected by CVE-2021-38904, an information-disclosure flaw that could allow a remote attacker to obtain credentials from a user’s browser via incorrect autocomplete settings. The root cause involves browser-autocomplete behavior rather than code executio...

CVE-2021-39047

CVE-2021-39047 affects IBM Planning Analytics 2.0 and IBM Cognos Analytics (11.1.x–11.2.x). The issue is a cross-site scripting (XSS) vulnerability in the Web UI that could let an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Remediat...

CVE-2021-38903

CVE-2021-38903 concerns IBM Cognos Analytics (versions 11.2.x and 11.1.x). The vulnerability is a cross-site scripting flaw caused by improper validation of user-supplied input in the web interface, enabling a remote attacker to inject script into a user’s browser session and potentially steal co...

CVE-2019-4555

IBM Cognos Analytics (versions 11.0 and 11.1) is affected by a cross‑site scripting (XSS) vulnerability in the Web UI. The issue stems from insufficient validation of client‑side data in the web application, enabling an attacker to inject arbitrary JavaScript that could alter UI behavior and pote...

CVE-2022-34339

CVE-2022-34339 affects IBM Cognos Analytics 11.2.x and 11.1.x, where credentials are stored in plain text readable by an authenticated user. Root cause: cleartext credential storage. Impact: information disclosure (confidentiality High). Remediation: upgrade to IBM Cognos Analytics 11.2.3 or 11.1...

CVE-2024-51466

IBM Cognos Analytics (11.2.0–11.2.4 FP4 and 12.0.0–12.0.4) is vulnerable to an Expression Language (EL) Injection that can allow a remote attacker to disclose data, exhaust memory, or crash the server when processing crafted EL statements. Affected products/versions are explicitly listed in the v...

CVE-2019-4342

CVE-2019-4342 affects IBM Cognos Analytics 11.0 and 11.1. The vulnerability is a cross-site scripting flaw in the Web UI that could let an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Exploitation status is not provided in the docume...

CVE-2021-39009

Summary: CVE-2021-39009 affects IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1, where user credentials are stored in plain text and readable by a local privileged user. The IBM bulletin confirms remediation: upgrade to IBM Cognos Analytics 11.2.3 or apply FP5 for 11.1.x to address this issue. Th...

CVE-2022-38708

CVE-2022-38708 – IBM Cognos Analytics SSRF vulnerability in IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1. The issue allows an attacker to construct URLs from user-controlled data, enabling server-side requests to internal networks or the local file system. Impact and exploit details a...

CVE-2024-40695

CVE-2024-40695 affects IBM Cognos Analytics 11.2.0–11.2.4 FP4 and 12.0.0–12.0.4, where a Malicious File Upload flaw arises from not validating uploaded file contents via the web interface. This allows an attacker to upload executable files that could be processed by the product and used for furth...

CVE-2021-20468

CVE-2021-20468 affects IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 and is a cross-site request forgery (CSRF) vulnerability. The issue could allow an attacker to perform malicious, unauthorized actions transmitted from a trusted user’s session. IBM X-Force ID: 196825. According to IBM’s secur...

CVE-2022-39160

CVE-2022-39160 affects IBM Cognos Analytics 11.2.1, 11.2.0 and 11.1.7, exposing a cross-site scripting (XSS) vulnerability in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. The issue is acknowledged in IBM’s bulletin and p...

CVE-2024-25047

IBM Cognos Analytics is affected by CVE-2024-25047: injection attacks in application logging due to unsanitized user-supplied data. Affected versions are 11.2.0–11.2.4 and 12.0.0–12.0.2. Root cause is improper sanitization in logging code, enabling potential follow-on attacks. IBM recommends upgr...

CVE-2023-25929

IBM Cognos Analytics 11.1 and 11.2 are affected by a stored cross-site scripting vulnerability (CVE-2023-25929) due to improper validation of SVG Files in Custom Visualizations, allowing arbitrary JavaScript in the Web UI and potential credential disclosure in a trusted session. Mitigation: upgra...

CVE-2021-38945

Summary of CVE-2021-38945 (IBM Cognos Analytics) Affects IBM Cognos Analytics versions 11.2.1, 11.2.0 and 11.1.7 (shipped with IBM Sterling Control Center) where a remote attacker could upload arbitrary files due to improper content validation on uploads. This is the root cause: lack of proper va...

CVE-2025-0923

IBM Cognos Analytics (versions 11.2.0–11.2.4, 12.0.0–12.0.4) is affected by CVE-2025-0923, which involves storing source code on the web server that could aid attackers. The CVSS v3.1 base score is 5.3 (Confidentiality impact: Low; Integrity/Availability: None). IBM’s bulletin lists remediation t...

CVE-2021-38905

CVE-2021-38905 affects IBM Cognos Analytics 11.1.7, 11.2.0 (and related 11.1.x) where an authenticated user could view report pages they should not access due to a access-control vulnerability. Remediate by upgrading to IBM Cognos Analytics 11.2.2 or applying the 11.1.7 FP9/IF9 fixes; IBM notes r...

CVE-2026-15995

Summary of CVE-2026-15995 : IBM Cognos Analytics 12.1.3 GA (build up to 12.1.3-2606251736) contains a race condition in the Agentic AI assistant’s concurrent request handling. Under certain concurrent usage, two authenticated users submitting the same action can cause incorrect report summaries o...

CVE-2021-29768

CVE-2021-29768 affects IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1, allowing a low-privilege user to obtain sensitive information from the details of the Cloud Storage page due to faulty access controls. Remediation per connected IBM/NCSC sources: upgrade to Cognos Analytics 11.2.2 or apply 1...

CVE-2018-1413

CVE-2018-1413 affects IBM Cognos Analytics 11.0, with cross-site scripting via the Web UI that could lead to credentials disclosure in a trusted session. IBM IBM Cognos Bulletins/NTAP references confirm the vulnerability and list 11.0.11.0 as the fixed release. Remediation: upgrade to IBM Cognos ...

CVE-2019-4139

CVE-2019-4139 affects IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1. The issue is a cross-site scripting (XSS) vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The NVD description confir...

CVE-2021-29823

IBM Cognos Analytics (versions 11.1.0–11.1.7 FP4 and 11.2.0–11.2.2) is affected by CSRF (CVE-2021-29823). The root cause is cross-site requests that could perform malicious, unauthorised actions on behalf of trusted users. Remediation: upgrade to 11.2.3 or apply the documented fixes (11.1.7 FP5)....

CVE-2019-4231

CVE-2019-4231 affects IBM Cognos Analytics 11.0 and 11.1. The issue is a Cross-Site Request Forgery (CSRF) that could enable an attacker to perform malicious, unauthorized actions on behalf of a trusted user. The description provided indicates the vulnerability arises from a web application that ...

CVE-2021-29679

IBM Cognos Analytics 11.1.7 and 11.2.0 are affected by a remote code execution vulnerability caused by improper neutralization of user input that could be interpreted as server-side include (SSI) directives when an authenticated user provides input. The issue enables code execution with high impa...

CVE-2021-38909

CVE-2021-38909 affects IBM Cognos Analytics 11.1.7 and 11.2.0, with a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Connected sources confirm affected versions (11.1.x and ...

CVE-2022-43883

IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are affected by a Log Injection vulnerability caused by constructing URLs from user-controlled data. This could allow an attacker to issue arbitrary requests to internal network resources or the local file system. The issue is documented ac...

CVE-2023-35011

IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are affected by SSRF (CVE-2023-35011). The vulnerability allows an authenticated attacker to cause the system to issue unauthorized outbound requests, enabling network enumeration or related impacts. Remediation per IBM Security Bulletin: u...

CVE-2018-1842

The CVE-2018-1842 issue affects IBM Cognos Analytics 11 Configuration tool. The root cause is a bypass of OIDC namespace signature verification on the id_token under certain conditions. This leads to a potential security impact where token validation may be weakened, allowing an attacker to explo...

CVE-2019-4653

CVE-2019-4653 affects IBM Cognos Analytics 11.0 and 11.1. A cross-site scripting (XSS) vulnerability in the Web UI could allow embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The entry is supported by the NVD description and related referenc...

CVE-2025-0917

IBM Cognos Analytics is affected by a stored cross-site scripting (XSS) vulnerability in the Web UI. A privileged user can embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Affected versions are 11.2.0–11.2.4 IF3 and 12.0.0–12.0.4. Remediation/advi...

CVE-2020-4301

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 are affected by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2020-4301). The IBM bulletin confirms CSRF as the underlying issue and notes that fixes have been applied in later releases: 11.2.3 for the 11.2 line and FP5 for 11.1.7. Affected...

CVE-2021-39045

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 are affected by CVE-2021-39045 due to the autocomplete feature on password input fields, which could allow a local attacker to obtain information. The issue is rooted in how password fields handle autocomplete, enabling potential exposure of credent...

CVE-2022-30614

Affected software: IBM Cognos Analytics 11.1.7, 11.2.0, 11.2.1. Vulnerability: Denial of Service via email flooding by sending a specially-crafted request, causing server CPU exhaustion. Root cause / component: DoS condition triggered through email handling (as described in the CVE entry and IBM ...

CVE-2022-36773

The CVE-2022-36773 entry concerns IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 that are vulnerable to an XML External Entity (XXE) injection when processing XML data. The root cause is an XXE flaw in XML data handling, which could allow a remote attacker to read sensitive information ...

CVE-2021-29867

The CVE-2021-29867 vulnerability affects IBM Cognos Analytics 11.1.7 and 11.2.0, where an authenticated user could view or edit a Jupyter notebook they should not access. Root cause details aren’t explicitly stated in the provided documents, but the NVD entry lists a CVSS v3.1 base score of 5.4 (...