Cognos Business Intelligence vulnerabilities | LiveThreat CVE Feed

Product

Cognos Business Intelligence

by IBM · last CVE Dec 20, 2019

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities31 In the news0 Timeline

Severity mix

Critical 0High 4Medium 9Low 1

Severity

All severities31 Critical0 High4 Medium9 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Cognos Business Intelligence to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2018-1934	8.8	0%	Dec 20	IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a… Affected: 10.2.2
CVE-2016-8960	8.8	2%	Mar 27	IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the… Affected: 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2016-3036	7.5	2%	Apr 17	IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing packets Affected: 10.1; 10.2; 10.2.2
CVE-2017-1764	7.0	0%	Apr 23	IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user Affected: 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2016-0254	6.5	2%	Jun 7	IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data Affected: 10.1.1; 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2017-1486	6.1	1%	Apr 23	IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting Affected: 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2016-3037	5.7	1%	Apr 17	IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key Affected: 10.1; 10.2; 10.2.2
CVE-2016-9985	5.5	0%	Mar 8	IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user Affected: 10.1.1; 10.2
CVE-2016-3038	5.4	1%	Apr 17	IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting Affected: 10.1; 10.2; 10.2.2
CVE-2016-0218	5.4	1%	Feb 1	IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input Affected: 10.1.1; 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2016-0346	5.4	1%	Jul 3	Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before IF12, and 10.1.1 before IF19… Affected: 10.1.1; 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2016-0221	5.4	1%	Jul 3	Cross-site scripting (XSS) vulnerability in IBM Cognos TM1, as used in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before… Affected: 10.1.1; 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2016-9710	5.3	2%	Jun 7	IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files Affected: 10.1.1; 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2017-1125	3.3	0%	Jun 7	IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file Affected: 10.1.1; 10.2; 10.2.1; 10.2.1.1; 10.2.2
CVE-2014-6145	–	1%	Dec 12	Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence 10.1 before IF10, 10.1.1 before IF9, 10.2 before IF11, 10.2.1 before IF8, and 10.2.1.1… Affected: 10.1; 10.1.1; 10.2; 10.2.1; 10.2.1.1
CVE-2014-0861	–	1%	Feb 22	Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1; 10.2.1.1
CVE-2013-6732	–	1%	Feb 22	Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1; 10.2.1.1
CVE-2014-0854	–	2%	Feb 22	The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1; 10.2.1.1
CVE-2013-3030	–	2%	Nov 16	The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1; 10.2.1.1
CVE-2013-4034	–	6%	Nov 16	IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1; 10.2.1.1
CVE-2013-2988	–	2%	Aug 27	Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1
CVE-2013-2978	–	1%	Aug 27	Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1
CVE-2013-0586	–	1%	Aug 27	Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject… Affected: 8.4.1; 10.1; 10.1.1; 10.2; 10.2.1
CVE-2012-4835	–	1%	Mar 2	Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers… Affected: 8.4.1; 10.1; 10.1.1; 10.2
CVE-2012-2193	–	1%	Mar 2	Cross-site scripting (XSS) vulnerability in Query Studio in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows… Affected: 8.4.1; 10.1; 10.1.1; 10.2
CVE-2012-2177	–	1%	Mar 2	Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows user-assisted… Affected: 8.4.1; 10.1; 10.1.1; 10.2
CVE-2012-4858	–	4%	Mar 2	IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 does not properly validate Java serialized input, which allows… Affected: 8.4.1; 10.1; 10.1.1; 10.2
CVE-2012-4840	–	1%	Mar 2	IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and… Affected: 8.4.1; 10.1; 10.1.1; 10.2
CVE-2012-4837	–	1%	Mar 2	IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to conduct XPath injection… Affected: 8.4.1; 10.1; 10.1.1; 10.2
CVE-2012-4836	–	1%	Mar 2	Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote… Affected: 8.4.1; 10.1; 10.1.1; 10.2
CVE-2012-4847	–	1%	Nov 14	IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted request containing a zero-valued… Affected: 8.4; 8.4.1