Cognos Analytics (Ibm) - vulnerabilities (CVEs)

110 CVEs, 0 in the last 30 days, 110 known versions, newest CVE from 2026-09-18. Vendor: Ibm.

CVEs of Cognos Analytics

CVE-2025-36076 - CVSS 4.3 (medium), 2026-09-18: IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated…
CVE-2025-33147 - CVSS 5.9 (medium), 2026-09-18: IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information…
CVE-2024-56344 - CVSS 5.9 (medium), 2026-09-18: IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the…
CVE-2026-7884 - CVSS 5.4 (medium), 2026-09-14: IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include…
CVE-2026-15995 - CVSS 5.4 (medium), 2026-07-17: IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause…
CVE-2025-3633 - CVSS 8.2 (high), 2026-05-27: IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This…
CVE-2025-36126 - CVSS 7.6 (high), 2026-05-26: IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos…
CVE-2025-33150 - CVSS 5.3 (medium), 2025-11-10: IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages.
CVE-2024-52900 - CVSS 6.4 (medium), 2025-06-28: IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows…
CVE-2025-25032 - CVSS 7.5 (high), 2025-06-11: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of…
CVE-2025-0917 - CVSS 5.5 (medium), 2025-06-11: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This…
CVE-2025-0923 - CVSS 5.3 (medium), 2025-06-11: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in…
CVE-2025-0823 - CVSS 6.5 (medium), 2025-02-28: IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system. An attacker…
CVE-2024-56340 - CVSS 6.5 (medium), 2025-02-28: IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by…
CVE-2024-49352 - CVSS 7.1 (high), 2025-02-05: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection…
CVE-2023-38009 - CVSS 5.9 (medium), 2025-01-26: IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.
CVE-2024-51466 - CVSS 9 (critical), 2024-12-20: IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote…
CVE-2024-40695 - CVSS 8 (high), 2024-12-20: IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validating the content of the…
CVE-2024-45082 - CVSS 6.8 (medium), 2024-12-18: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.…
CVE-2024-41752 - CVSS 6.1 (medium), 2024-12-18: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code,…
CVE-2024-25042 - CVSS 6.1 (medium), 2024-12-18: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is potentially vulnerable to Cross Site Scripting (XSS). A remote attacker could execute…
CVE-2024-40703 - CVSS 5.5 (medium), 2024-09-22: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a…
CVE-2024-25053 - CVSS 5.9 (medium), 2024-06-28: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM…
CVE-2024-25041 - CVSS 5.4 (medium), 2024-06-28: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting (XSS). A remote…
CVE-2024-25047 - CVSS 8.6 (high), 2024-05-02: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided…
CVE-2023-32344 - CVSS 4.3 (medium), 2024-02-26: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an…
CVE-2023-30996 - CVSS 5.3 (medium), 2024-02-26: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects…
CVE-2023-43051 - CVSS 5.4 (medium), 2024-02-26: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2023-38359 - CVSS 6.1 (medium), 2024-02-26: IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2022-34357 - CVSS 6.5 (medium), 2024-02-26: IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting. By making…
CVE-2023-35011 - CVSS 5.4 (medium), 2023-08-16: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send…
CVE-2023-35009 - CVSS 5.3 (medium), 2023-08-16: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in…
CVE-2023-28530 - CVSS 5.4 (medium), 2023-07-22: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote…
CVE-2023-25929 - CVSS 5.4 (medium), 2023-07-22: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2021-39036 - CVSS 6.1 (medium), 2023-05-12: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2022-39160 - CVSS 6.1 (medium), 2022-12-19: IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2022-38708 - CVSS 9.1 (critical), 2022-12-19: IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from…
CVE-2022-43887 - CVSS 5.3 (medium), 2022-12-19: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain…
CVE-2022-43883 - CVSS 7.5 (high), 2022-12-19: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could…
CVE-2022-34339 - CVSS 6.5 (medium), 2022-11-03: "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."
CVE-2022-30614 - CVSS 7.5 (high), 2022-09-01: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A…
CVE-2021-39045 - CVSS 6.2 (medium), 2022-09-01: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields.…
CVE-2021-39009 - CVSS 5.5 (medium), 2022-09-01: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID:…
CVE-2022-36773 - CVSS 8.1 (high), 2022-09-01: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker…
CVE-2021-29823 - CVSS 6.5 (medium), 2022-09-01: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
CVE-2021-20468 - CVSS 6.5 (medium), 2022-09-01: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
CVE-2020-4301 - CVSS 6.5 (medium), 2022-09-01: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
CVE-2021-39047 - CVSS 6.1 (medium), 2022-06-24: IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to…
CVE-2021-38945 - CVSS 9.8 (critical), 2022-06-24: IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force…
CVE-2021-29768 - CVSS 6.5 (medium), 2022-06-24: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for…
CVE-2021-38886 - CVSS 8.8 (high), 2022-04-22: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
CVE-2021-38905 - CVSS 4.3 (medium), 2022-04-22: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID:…
CVE-2021-29824 - CVSS 4.3 (medium), 2022-04-22: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data…
CVE-2021-38904 - CVSS 6.5 (medium), 2022-04-22: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings.…
CVE-2021-20464 - CVSS 6.5 (medium), 2022-04-22: IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user.…
CVE-2021-38903 - CVSS 5.4 (medium), 2022-04-22: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker…
CVE-2021-38946 - CVSS 5.4 (medium), 2022-04-22: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…
CVE-2021-38909 - CVSS 5.4 (medium), 2021-12-03: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2021-29867 - CVSS 5.4 (medium), 2021-12-03: IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID:…
CVE-2021-29719 - CVSS 5.3 (medium), 2021-12-03: IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifying an incorrect content type. IBM…
CVE-2021-29756 - CVSS 8.8 (high), 2021-12-03: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute…
CVE-2021-29716 - CVSS 6.5 (medium), 2021-12-03: IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed to view. IBM…
CVE-2021-20493 - CVSS 6.1 (medium), 2021-12-03: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2021-20470 - CVSS 7.5 (high), 2021-12-03: IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise…
CVE-2021-29745 - CVSS 8.8 (high), 2021-10-15: IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they…
CVE-2021-29679 - CVSS 8.8 (high), 2021-10-15: IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that…
CVE-2020-4951 - CVSS 4 (medium), 2021-10-15: IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information.
CVE-2021-20461 - CVSS 6.5 (medium), 2021-06-30: IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting. An attacker could…
CVE-2019-4653 - CVSS 5.4 (medium), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2019-4724 - CVSS 7.5 (high), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New…
CVE-2020-4354 - CVSS 5.4 (medium), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2019-4471 - CVSS 6.5 (medium), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive…
CVE-2019-4723 - CVSS 7.5 (high), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data…
CVE-2020-4300 - CVSS 8.2 (high), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit…
CVE-2020-4561 - CVSS 10 (critical), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access…
CVE-2019-4722 - CVSS 4.3 (medium), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of certain error…
CVE-2019-4730 - CVSS 7.1 (high), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit…
CVE-2020-4520 - CVSS 8.8 (high), 2021-06-01: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the…
CVE-2020-4302 - CVSS 7.8 (high), 2020-10-12: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to…
CVE-2020-4388 - CVSS 8.2 (high), 2020-10-12: IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug…
CVE-2020-4377 - CVSS 9.1 (critical), 2020-08-03: IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit…
CVE-2019-4589 - CVSS 4.6 (medium), 2020-08-03: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less…
CVE-2019-4366 - CVSS 5.3 (medium), 2020-08-03: IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gain access to cached browser data. IBM…
CVE-2019-4729 - CVSS 4.3 (medium), 2020-04-27: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2019-4623 - CVSS 5.4 (medium), 2019-12-30: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2019-4343 - CVSS 6.5 (medium), 2019-12-30: IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information. An…
CVE-2019-4555 - CVSS 5.4 (medium), 2019-12-20: IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2019-4231 - CVSS 4.3 (medium), 2019-12-20: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
CVE-2019-4645 - CVSS 6.1 (medium), 2019-11-09: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2019-4334 - CVSS 4.3 (medium), 2019-11-09: IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM…
CVE-2018-1721 - CVSS 8.8 (high), 2019-11-09: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit…
CVE-2019-4183 - CVSS 7.5 (high), 2019-09-17: IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would…
CVE-2019-4342 - CVSS 5.4 (medium), 2019-09-17: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2019-4139 - CVSS 5.4 (medium), 2019-05-29: IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the…
CVE-2019-4178 - CVSS 9.1 (critical), 2019-04-15: IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to write…
CVE-2018-1842 - CVSS 3.6 (low), 2018-11-09: IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token. IBM X-Force ID:…
CVE-2018-1413 - CVSS 5.4 (medium), 2018-05-07: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2016-9711 - CVSS 5.3 (medium), 2018-03-22: IBM Predictive Solutions Foundation (IBM Cognos Analytics 11.0) reveals sensitive information in detailed error messages that could aid an attacker in further…
CVE-2017-1783 - CVSS 4 (medium), 2018-01-29: IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without proper authentication. IBM X-Force ID:…
CVE-2017-1779 - CVSS 7.8 (high), 2018-01-29: IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user. IBM X-Force ID: 136824.