CVE-2021-39040

IBM Planning Analytics Workspace 2.0 is affected by CVE-2021-39040, a file upload vulnerability caused by not validating file types/sizes in the web interface. This can allow uploading malicious executables, with potential code execution on victim systems. Evidence in multiple sources confirms th...

CVE-2022-22392

CVE-2022-22392 affects IBM Planning Analytics Local 2.0; vulnerable via arbitrary file upload that can lead to code execution when executed by a victim. Root cause relates to unvalidated file upload handling. Exploitation details are not provided in the connected documents. Remediation guidance r...

CVE-2024-35143

CVE-2024-35143 concerns IBM Planning Analytics Local (2.0, 2.1) that connects to a MongoDB server which is exposed to remote access with no password authentication. The root cause is unauthenticated MongoDB connections enabled by the product’s configuration, allowing a remote attacker to gain una...

CVE-2022-22314

CVE-2022-22314 affects IBM Planning Analytics Local 2.0. The IBM bulletin ties the issue to cached web data that can be read by another user on the same system, describing it as a local access impact. The connected IBM Security Bulletin notes it is part of multiple vulnerabilities in Planning Ana...

CVE-2025-36357

IBM Planning Analytics Local (Workspace) versions 2.1.0–2.1.14 are affected by a directory traversal vulnerability that allows a remote authenticated user to view, read, or write arbitrary files by sending crafted URLs containing absolute path sequences. The issue is caused by improper handling o...

CVE-2025-36299

CVE-2025-36299 affects IBM Planning Analytics Local 2.1.0–2.1.14. The advisory states that these versions store sensitive information in source code, which could be leveraged in subsequent attacks against the system. The Fix/Remediation recommends upgrading to IBM Planning Analytics Local 2.1.15 ...