Unscored severity · published Mar 2, 2013
CVE-2012-2177
Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows user-assisted…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors related to the search feature.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cognos Business Intelligence · Ibm
8.4.1; 10.1; 10.1.1; 10.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2177
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21626697
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg24034373
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/75400
More from Cognos Business Intelligence
8.8
CVE-2018-1934
IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a…
8.8
CVE-2016-8960
IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the…
7.5
CVE-2016-3036
IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing packets
7.0
CVE-2017-1764
IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user
6.5
CVE-2016-0254
IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data