CA
Product
Cognos Analytics
109
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 6High 24Medium 77Low 2
Watch
Add Cognos Analytics to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-4561 | 10.0 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions Affected: 11.0.0; 11.1.0 |
| CVE-2021-38945 | 9.8 | Jun 24 | IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2022-38708 | 9.1 | Dec 19 | IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data Affected: 11.1.0 through 11.1.7; 11.2.0 through 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2020-4377 | 9.1 | Aug 3 | IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0; 11.1.0 |
| CVE-2019-4178 | 9.1 | Apr 15 | IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system Affected: 11.0.0.0 through 11.0.13.0 |
| CVE-2024-51466 | 9.0 | Dec 20 | IBM Cognos Analytics expression language injection Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.4 |
| CVE-2021-38886 | 8.8 | Apr 22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-29756 | 8.8 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized… Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2021-29745 | 8.8 | Oct 15 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they should not have access… Affected: 11.1.7; 11.2.0 |
| CVE-2021-29679 | 8.8 | Oct 15 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a… Affected: 11.1.7; 11.2.0 |
| CVE-2020-4520 | 8.8 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code Affected: 11.0.0; 11.1.0 |
| CVE-2018-1721 | 8.8 | Nov 9 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0; 11.1.0 |
| CVE-2024-25047 | 8.6 | May 2 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.3; 11.2.4; 11.2.4; 11.2.4 |
| CVE-2025-3633 | 8.2 | May 27 | IBM Cognos Analytics is affected by multiple security vulnerabilities Affected: 11.2.0; 12.0; 12.1.0 |
| CVE-2020-4300 | 8.2 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0; 11.1.0 |
| CVE-2020-4388 | 8.2 | Oct 12 | IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug information could also be used… Affected: 11.0.0 before 11.0.13; 11.1.0 through 11.1.7; 11.0.13; 11.0.13; 11.0.13 |
| CVE-2022-36773 | 8.1 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2024-40695 | 8.0 | Dec 20 | IBM Cognos Analytics file upload Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.4 |
| CVE-2020-4302 | 7.8 | Oct 12 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection Affected: 11.0.0 before 11.0.13; 11.1.0 through 11.1.7; 11.0.13; 11.0.13; 11.0.13 |
| CVE-2017-1779 | 7.8 | Jan 29 | IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user Affected: 11.0.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.0.5.0; +2 more |
| CVE-2025-36126 | 7.6 | May 26 | IBM Cognos Analytics is affected by Cross-site scripting. Affected: 11.2.0; 12.0; 12.1.0 |
| CVE-2025-25032 | 7.5 | Jun 11 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a… Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.4; 11.2.4; 11.2.4; 11.2.4 |
| CVE-2022-43883 | 7.5 | Dec 19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data Affected: 11.1.0 through 11.1.7; 11.2.0 through 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2022-30614 | 7.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2021-20470 | 7.5 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2019-4724 | 7.5 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content Backup page Affected: 11.0.0; 11.1.0 |
| CVE-2019-4723 | 7.5 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Server Connection page Affected: 11.0.0; 11.1.0 |
| CVE-2019-4183 | 7.5 | Sep 17 | IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would consume all available… Affected: 11.0.0; 11.1.0 |
| CVE-2024-49352 | 7.1 | Feb 5 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE) attack when… Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.4; 11.2.4; 11.2.4; 11.2.4; 11.2.4; +3 more |
| CVE-2019-4730 | 7.1 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0; 11.1.0 |
| CVE-2025-0823 | 6.5 | Feb 28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.4; 11.2.4; 11.2.4; 11.2.4; 11.2.4; +4 more |
| CVE-2024-56340 | 6.5 | Feb 28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal… Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.4; 11.2.4; 11.2.4; 11.2.4; 11.2.4; +4 more |
| CVE-2022-34357 | 6.5 | Feb 26 | IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting Affected: 11.1.1 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +9 more |
| CVE-2022-34339 | 6.5 | Nov 3 | "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2021-29823 | 6.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2021-20468 | 6.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2020-4301 | 6.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2021-29768 | 6.5 | Jun 24 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for which they should not… Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2021-38904 | 6.5 | Apr 22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-20464 | 6.5 | Apr 22 | IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-29716 | 6.5 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed to view Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2021-20461 | 6.5 | Jun 30 | IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting Affected: 11.0.0 before 11.0.13; 11.1.0 before 11.1.7; 11.0.13; 11.0.13; 11.0.13; 11.0.13; +3 more |
| CVE-2019-4471 | 6.5 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS… Affected: 11.0.0; 11.1.0 |
| CVE-2019-4343 | 6.5 | Dec 30 | IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information Affected: 11.0.0; 11.1.0 |
| CVE-2024-25042 | 6.1 | Dec 18 | IBM Cognos Analytics cross-site scripting Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.3 |
| CVE-2024-41752 | 6.1 | Dec 18 | IBM Cognos Analytics HTML injection Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.3 |
| CVE-2023-38359 | 6.1 | Feb 26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting Affected: 11.1.1 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +9 more |
| CVE-2021-39036 | 6.1 | May 12 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting Affected: 11.1; 11.2 |
| CVE-2022-39160 | 6.1 | Dec 19 | IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting Affected: 11.1.0 before 11.1.7; 11.2.0 through 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2021-39047 | 6.1 | Jun 24 | IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |