CVE-2010-0557

CVE-2010-0557 affects IBM Cognos Express 9.0, where a bundled Tomcat Manager is reachable via hardcoded credentials, allowing attackers to obtain access and cause a denial of service. The root cause is the use of fixed credentials in the Tomcat Manager component, enabling unauthenticated interact...

CVE-2013-5445

IBM Cognos Express contains CVE-2013-5445 where encrypted credentials can be remotely retrieved from the server due to knowledge of a static decryption key. Affected products/versions include Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1. IBM’s bul...

CVE-2013-5443

CVE-2013-5443 is a CSRF vulnerability in IBM Cognos Express that can allow an attacker to hijack the authentication of an authenticated user. Affected versions include Cognos Express 9.0, 9.5, 10.1 (all before their IFIX 2) and 10.2.1 before FP1. The IBM Security Bulletin lists remediation by app...

CVE-2013-5444

CVE-2013-5444 affects IBM Cognos Express 9.0/9.5/10.1 before IFIX 2 and 10.2.1 before FP1. The vulnerability stems from using a static key for encryption, enabling remote attackers to read encrypted credentials via unspecified vectors. IBM’s security bulletin lists remediation by applying fixes i...