Cognos Analytics@11.2.1 Security Vulnerabilities and Issues — Cognos Analytics@11.2.1 CVE List

Lucene search

IbmCognos Analytics11.2.1

32 matches found

CVE•added 2024/09/22 1:15 p.m.•93 views

CVE-2024-40703

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to obtain sensitive information in the form of an API key. An attacker could use this information to launch further attacks aga...

5.5CVSS4.9AI score0.00021EPSS

CVE•added 2022/04/22 5:15 p.m.•85 views

CVE-2021-20464

IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.

6.5CVSS6.7AI score0.00326EPSS

CVE•added 2022/04/22 5:15 p.m.•81 views

CVE-2021-38886

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.

8.8CVSS8.7AI score0.0018EPSS

CVE•added 2022/04/22 5:15 p.m.•80 views

CVE-2021-29824

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468.

4.3CVSS5.3AI score0.00224EPSS

CVE•added 2022/04/22 5:15 p.m.•77 views

CVE-2021-38903

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the sec...

5.4CVSS6.2AI score0.00145EPSS

CVE•added 2022/04/22 5:15 p.m.•76 views

CVE-2021-38946

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 21...

5.4CVSS5.6AI score0.00686EPSS

CVE•added 2022/06/24 4:15 p.m.•73 views

CVE-2021-39047

IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tru...

6.1CVSS5.9AI score0.00315EPSS

CVE•added 2022/04/22 5:15 p.m.•71 views

CVE-2021-38904

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693.

6.5CVSS6.8AI score0.00274EPSS

CVE•added 2022/12/19 9:15 p.m.•69 views

CVE-2022-38708

IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180...

9.1CVSS7.5AI score0.00057EPSS

CVE•added 2022/11/03 8:15 p.m.•66 views

CVE-2022-34339

"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."

6.5CVSS6AI score0.00048EPSS

CVE•added 2022/12/19 9:15 p.m.•66 views

CVE-2022-39160

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 23...

6.1CVSS5.8AI score0.00089EPSS

CVE•added 2022/04/22 5:15 p.m.•64 views

CVE-2021-38905

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697.

4.3CVSS5.2AI score0.00172EPSS

CVE•added 2022/06/24 4:15 p.m.•63 views

CVE-2021-38945

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238.

9.8CVSS9AI score0.00079EPSS

CVE•added 2023/08/16 11:15 p.m.•62 views

CVE-2023-35011

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 257705.

5.4CVSS5.3AI score0.00039EPSS

CVE•added 2022/09/01 7:15 p.m.•61 views

CVE-2021-29823

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204465.

6.5CVSS6.4AI score0.0024EPSS

CVE•added 2022/09/01 7:15 p.m.•59 views

CVE-2021-39009

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554.

5.5CVSS5AI score0.00105EPSS

CVE•added 2024/05/02 9:16 p.m.•59 views

CVE-2024-25047

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.

8.6CVSS6.5AI score0.00055EPSS

CVE•added 2022/06/24 4:15 p.m.•58 views

CVE-2021-29768

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for which they should not have access. IBM X-Force ID: 202682.

6.5CVSS6.1AI score0.00159EPSS

CVE•added 2022/12/19 9:15 p.m.•56 views

CVE-2022-43887

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.

5.3CVSS5AI score0.00066EPSS

CVE•added 2022/12/19 9:15 p.m.•54 views

CVE-2022-43883

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 240266.

7.5CVSS6.8AI score0.00054EPSS

CVE•added 2022/09/01 7:15 p.m.•53 views

CVE-2022-36773

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571.

8.1CVSS7.9AI score0.00041EPSS

CVE•added 2022/09/01 7:15 p.m.•52 views

CVE-2021-20468

6.5CVSS6.4AI score0.00072EPSS

CVE•added 2025/02/05 11:15 a.m.•51 views

CVE-2024-49352

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resou...

7.1CVSS6.8AI score0.00387EPSS

CVE•added 2023/08/16 11:15 p.m.•50 views

CVE-2023-35009

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-Force ID: 257703.

5.3CVSS5.1AI score0.00077EPSS

CVE•added 2022/09/01 7:15 p.m.•49 views

CVE-2021-39045

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IBM X-Force ID: 214345.

6.2CVSS5.2AI score0.00071EPSS

CVE•added 2022/09/01 7:15 p.m.•48 views

CVE-2022-30614

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591.

7.5CVSS7.3AI score0.0011EPSS

CVE•added 2024/06/28 7:15 p.m.•48 views

CVE-2024-25041

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Assistant. IBM X-Force ID: 282780.

5.4CVSS5.5AI score0.00058EPSS

CVE•added 2024/06/28 7:15 p.m.•46 views

CVE-2024-25053

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path betw...

5.9CVSS5.5AI score0.00048EPSS

CVE•added 2022/09/01 7:15 p.m.•44 views

CVE-2020-4301

6.5CVSS6.4AI score0.00072EPSS

CVE•added 2025/06/11 6:15 p.m.•38 views

CVE-2025-25032

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources.

7.5CVSS6.7AI score0.0003EPSS

CVE•added 2025/06/11 6:15 p.m.•37 views

CVE-2025-0923

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in further attacks against the system.

5.3CVSS7.1AI score0.00037EPSS

CVE•added 2025/06/11 6:15 p.m.•36 views

CVE-2025-0917

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...

5.5CVSS6.3AI score0.00029EPSS