CVE-2018-1934

CVE-2018-1934 affects IBM Cognos Business Intelligence 10.2.2. The vulnerability is a cross-site request forgery that could allow an attacker to perform malicious, unauthorized actions transmitted from a trusted user. IBM X-Force ID: 153179. Affected product/version: IBM Cognos BI 10.2.2. Root ca...

CVE-2012-4858

The CVE-2012-4858 issue affects IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1, where Java serialized input is not properly validated. This allows a remote attacker to execute arbitrary commands via unspecified vectors. The connecte...

CVE-2016-0218

CVE-2016-0218 affects IBM Cognos Business Intelligence/IBM Cognos Analytics (and related TM1 advisories) with a cross-site scripting vulnerability caused by improper validation of user input. A remote attacker can entice a user to click a crafted URL, triggering script execution in the victim’s b...

CVE-2012-4837

IBM Cognos BI is vulnerable to XPath injection (read arbitrary XML) for versions 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1. The issue arises from improper input validation prior to XPath query use and requires remote authenticated access. Remediation: apply Cognos ...

CVE-2012-4840

IBM Cognos BI is vulnerable to XPath injection (CVE-2012-4840). Affected versions: 8.4.1 prior to IF1, 10.1 prior to IF2, 10.1.1 prior to IF2, and 10.2 prior to IF1. Attackers can remotely inject XPath code and call XPath extension functions via unspecified vectors. Mitigation: apply Cognos BI In...

CVE-2016-3037

IBM Cognos TM1 10.1 and 10.2 contain a vulnerability where a service can return the victim’s password when a valid session key is present. An authenticated attacker who can interact with the UI could obtain this sensitive information, impacting confidentiality. Affected releases include TM1 10.1,...

CVE-2016-0346

CVE-2016-0346 is an XSS vulnerability in IBM Cognos Business Intelligence. The flaw arises from improper validation of user-supplied input, enabling a remote authenticated attacker to inject arbitrary web script or HTML via a crafted URL, potentially executing in the victim’s browser and stealing...

CVE-2013-6732

IBM Cognos BI Server is affected by CVE-2013-6732, a reflective cross-site scripting (XSS) vulnerability. An unsanitized input parameter can be exploited by tricking a user into clicking a crafted link to inject arbitrary script/HTML. Affected versions: Cognos BI 8.4.1; 10.1 before IF6; 10.1.1 be...

CVE-2012-2193

CVE-2012-2193 affects IBM Cognos BI versions 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1. The IBM advisory documents a reflected cross-site scripting flaw that requires additional user interaction. Remediation is via Cognos Interim Fixes for Security Exposure; mitiga...

CVE-2014-0861

CVE-2014-0861 describes an XSS vulnerability in IBM Cognos BI/BI Server components (IBM Cognos BI Server 8.4.1; 10.1.x; 10.2.x; 10.2.1.x) where an unsafely handled parameter during use of the Back button enables an attacker to inject script/HTML. The issue is tied to insufficient input sanitizati...

CVE-2013-2978

CVE-2013-2978 affects IBM Cognos Business Intelligence server versions 8.4.1, 10.1, 10.1.1, 10.2 and 10.2.1. It is described as an absolute path traversal vulnerability that allows remote authenticated users to read files by leveraging the Report Author privilege. The provided documents do not in...

CVE-2016-0254

CVE-2016-0254 affects IBM Cognos Business Intelligence 10.1 and 10.2 and is caused by an XML External Entity (XXE) processing vulnerability that could let a remote authenticated attacker exhaust CPU resources and cause a denial of service. Public sources in the initial and linked IBM bulletins co...

CVE-2012-4836

IBM Cognos BI CVE-2012-4836 describes a stored XSS vulnerability in IBM Cognos BI 8.4.1 (before IF1), 10.1 (before IF2), 10.1.1 (before IF2), and 10.2 (before IF1), where remote authenticated users can inject arbitrary web script or HTML via crafted input that is not properly sanitized during ren...

CVE-2017-1486

CVE-2017-1486 affects IBM Cognos Business Intelligence 10.2.x (10.2, 10.2.1, 10.2.1.1, 10.2.2). The issue is a cross-site scripting vulnerability that could allow an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affec...

CVE-2012-4847

CVE-2012-4847 affects IBM Cognos BI 8.4 and 8.4.1. A remote authenticated user can cause high CPU usage via a crafted request containing a zero-valued byte, yielding a partial denial of service. According to IBM, exploitation requires authentication and it does not apply to Cognos BI 10.1 and lat...

CVE-2016-0221

CVE-2016-0221 is an IBM Cognos TM1 cross-site scripting (XSS) vulnerability. A remote authenticated user can inject arbitrary web script or HTML via a crafted URL in affected IBM Cognos BI/TM1 deployments. Affected versions include IBM Cognos TM1 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 bef...

CVE-2013-0586

CVE-2013-0586 describes a cross-site scripting (XSS) vulnerability in the IBM Cognos Business Intelligence server affecting IBM Cognos BI versions 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified vect...

CVE-2013-2988

CVE-2013-2988 is an absolute path traversal vulnerability in the IBM Cognos BI server affecting versions 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1, enabling remote authenticated users to read files via the Report Author privilege. The issue is addressed in IBM advisories linked to IBM Sterling Contro...

CVE-2013-4034

IBM Cognos BI is vulnerable to an XML External Entity (XXE) issue (CVE-2013-4034). Affected: IBM Cognos BI 8.4.1 before IF3; 10.1.0 before IF4; 10.1.1 before IF4; 10.2.0 before IF4; 10.2.1 before IF2; 10.2.1.1 before IF1. Description: remote authenticated users can read arbitrary files via an XML...

CVE-2013-3030

The CVE-2013-3030 entry affects IBM Cognos Business Intelligence (BI) and Cognos Analytics platforms. Affected is the servlet gateway in IBM Cognos BI 10.2.1 and earlier (including 8.4.1 before IF3, 10.1.x before various IFs, and 10.2.1.x before IF1/IF2/IF4 as listed). The vulnerability allows re...

CVE-2017-1764

CVE-2017-1764 affects IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, where under specialized circumstances a local attacker could access plaintext credentials. This entry is linked to IBM Cognos-related advisories and IBM X-Force references. The NVD metrics indicate a local ...

CVE-2016-3038

Summary: CVE-2016-3038 affects IBM Cognos TM1 10.1, 10.2 (and 10.2.2) with a cross-site scripting (XSS) flaw in the Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. What is affected: IBM Cognos TM1 10.1, 10.2, and 10....

CVE-2016-3036

CVE-2016-3036 affects IBM Cognos TM1 10.1 and 10.2 (including 10.2.2) and is caused by a stack-based buffer overflow when parsing packets, leading to a remote denial of service. The issue is network-exposed and could be triggered by crafted packets, with CVSS v3.0 vector indicating high impact to...

CVE-2012-2177

IBM Cognos BI (8.4.1 before IF1; 10.1 before IF2; 10.1.1 before IF2; 10.2 before IF1) is affected by a reflected cross-site scripting (XSS) vulnerability that can be triggered when an attacker entices a user to interact with search-related UI elements, executing arbitrary script in the victim’s b...

CVE-2016-8960

The CVE-2016-8960 issue affects IBM Cognos products and describes a privilege-escalation flaw where a user with lower capabilities can adopt a higher-privilege set by intercepting and reusing a higher-privilege cookie in HTTP requests. Connected IBM bulletins specify affected ranges: Cognos Analy...

CVE-2014-6145

CVE-2014-6145 is an XSS flaw in IBM Cognos Business Intelligence server. The vulnerability arises from improper validation of user-supplied input, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Affected versions include IBM Cognos BI 10.1 (before IF1...

CVE-2014-0854

CVE-2014-0854 affects IBM Cognos BI/Analytics server components (e.g., Cognos BI 8.4.1, 10.1.x, 10.2.x with specific IF levels) where an XML document containing an external entity declaration, used with an entity reference, enables remote authenticated users to read arbitrary files (XXE). The roo...

CVE-2016-9985

CVE-2016-9985 is documented in IBM security bulletins as affecting IBM Cognos Analytics, with the issue that sensitive information can be written to and read from log files by a local user. The connected IBM bulletin lists affected versions of Cognos Analytics: 11.0.0.0 through 11.0.5.0, and prov...

CVE-2012-4835

IBM Cognos BI is affected by CVE-2012-4835: a reflected cross-site scripting vulnerability in IBM Cognos BI versions 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 that allows remote attackers to inject arbitrary script via unspecified vectors. The vulnerability is disc...