CVE-2024-40702

IBM Cognos Controller 11.0.0–11.0.1 and IBM Controller 11.1.0 are affected by CVE-2024-40702 due to improper certificate validation, enabling an unauthorized user to obtain valid tokens and access protected resources (CVSS v3.1 base score 8.2). Remediation per the IBM security bulletin: IBM Contr...

CVE-2024-28777

CVE-2024-28777 affects IBM Cognos Controller 11.0.0–11.0.1 FP3 and IBM Controller 11.1.0. It is caused by unrestricted deserialization of types in the application, enabling arbitrary code execution, privilege escalation, or denial of service. IBM’s security bulletin lists related fixes: Cognos Co...

CVE-2024-52902

IBM Cognos Controller 11.0.0–11.0.1 FP3 and IBM Controller 11.1.0 contain hard-coded database passwords in the client application, enabling unauthorized access if exploited. Remediation: upgrade Cognos Controller to 11.0.1 FP4 and Controller to 11.1.0.1 (cloud deploys have corresponding updates)....

CVE-2024-45084

CVE-2024-45084 affects IBM Cognos Controller 11.0.0–11.0.1 FP3 and IBM Controller 11.1.0. An authenticated attacker could perform formula injection due to improper validation of file contents, potentially allowing arbitrary command execution on the system. Connected sources detail the affected pr...

CVE-2023-47160

CVE-2023-47160 affects IBM Cognos Controller (11.0.0–11.0.1 FP3) and IBM Controller (11.1.0). The vulnerability is an XML External Entity Injection (XXE) when processing XML data, potentially exposing sensitive information or enabling resource consumption. IBM’s security bulletin lists remediatio...

CVE-2026-5065

CVE-2026-5065: IBM Controller versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contain hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Affected products: IBM Controller 11.0.1–11.1.2. Severity is high (CVSS v3.1: 8.8, NETWORK attack vector, ...