CVE-2020-4561

CVE-2020-4561 affects IBM Cognos Analytics 11.0 and 11.1, specifically the DQM API, which allows submitting of all control requests in unauthenticated sessions. This can let a remote attacker with access to a valid CA endpoint read and write files on the Cognos Analytics system. The issue is docu...

CVE-2020-4300

IBM Cognos Analytics is affected by CVE-2020-4300 due to an XML External Entity (XXE) processing flaw in 11.0 and 11.1. A remote attacker could exploit XML data to disclose sensitive information or exhaust memory. The vulnerability is within the product’s XML handling, and affected versions are I...

CVE-2017-1783

IBM Cognos Analytics 11.0.x is affected by CVE-2017-1783: a local user could modify parameters via the Cognos Analytics menus without authentication. The advisory (IBM D6B9…) assigns CVSS v3.0 vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N with base score 4.0. Affected versions are 11.0.0.0 ...

CVE-2020-4520

IBM Cognos Analytics (11.0 and 11.1) is affected by CVE-2020-4520, a code-injection vulnerability that could allow a remote attacker to inject HTML and have it execute when viewed by an authenticated user. The root cause is an injection issue in Cognos Analytics, enabling cross-site code executio...

CVE-2020-4951

CVE-2020-4951 affects IBM Cognos Analytics 11.1.7 and 11.2.0, where locally cached browser data could allow a local attacker to obtain sensitive information. The issue is an information-disclosure vulnerability; no exploit details are provided in the documents. Remediation recommended: upgrade to...

CVE-2021-29745

IBM Cognos Analytics 11.1.7 and 11.2.0 are affected by CVE-2021-29745, a privilege-escalation vulnerability that could let a lower-privilege user access the restricted New Job page. The CVSSv3.1 base score is 8.8 (HIGH) with network attack vector, low complexity, and privileges required: LOW; imp...

CVE-2019-4723

CVE-2019-4723 affects IBM Cognos Analytics 11.0 and 11.1, where a remote attacker could obtain credentials from a user's browser due to incorrect autocomplete settings in the New Data Server Connection page. Root cause/impact are described in IBM/IBM X-Force references; cloud versions are address...

CVE-2021-20493

CVE-2021-20493 affects IBM Cognos Analytics 11.1.7 and 11.2.0. A cross-site scripting vulnerability in the Web UI could allow embedding arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Mitigation provided by vendors: upgrade to IBM Cognos Analytics 11.2...

CVE-2019-4722

Summary of CVE-2019-4722 (IBM Cognos Analytics): IBM Cognos Analytics 11.0 and 11.1 contain an information-disclosure vulnerability that allows a remote attacker to obtain sensitive information via a stack trace, caused by mishandling certain error conditions. Public sources in the connected data...

CVE-2021-29719

CVE-2021-29719 affects IBM Cognos Analytics 11.1.7 and 11.2.0, stemming from a web response that specifies an incorrect content type. This could enable client‑side exploits. IBM’s advisories note official fixes in IBM Cognos Analytics 11.2.1 and 11.1.7 Fix Pack 4 (FP4); upgrade to 11.2.1 or apply...

CVE-2021-20470

CVE-2021-20470 affects IBM Cognos Analytics 11.1.x and 11.2.0, where defaults do not require strong passwords, enabling easier account compromise. The IBM X-Force entry notes weak-default-password exposure; IBM later issued fixes in Cognos Analytics 11.2.1 and 11.1.7 FP4. Affected products/versio...

CVE-2021-29756

CVE-2021-29756 affects IBM Cognos Analytics 11.1.7 and 11.2.0. Description: a cross-site request forgery (CSRF) in the My Inbox page could allow an attacker to perform malicious, unauthorized actions on behalf of a trusted user. Root cause is a CSRF vulnerability in the affected web UI flow. Impa...

CVE-2019-4471

CVE-2019-4471 affects IBM Cognos Analytics 11.0 and 11.1, where a sensitive cookie in HTTPS sessions may be missing the Secure flag, enabling an information disclosure by a remote attacker. The root cause is the failure to set the secure flag on a cookie containing sensitive data. Impact per sour...