CA
Product
Cognos Analytics
109
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 6High 24Medium 77Low 2
Watch
Add Cognos Analytics to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-38886 | 8.8 | Apr 22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-29756 | 8.8 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized… Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2021-29745 | 8.8 | Oct 15 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they should not have access… Affected: 11.1.7; 11.2.0 |
| CVE-2021-29679 | 8.8 | Oct 15 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a… Affected: 11.1.7; 11.2.0 |
| CVE-2020-4520 | 8.8 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code Affected: 11.0.0; 11.1.0 |
| CVE-2018-1721 | 8.8 | Nov 9 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0; 11.1.0 |
| CVE-2024-25047 | 8.6 | May 2 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.3; 11.2.4; 11.2.4; 11.2.4 |
| CVE-2025-3633 | 8.2 | May 27 | IBM Cognos Analytics is affected by multiple security vulnerabilities Affected: 11.2.0; 12.0; 12.1.0 |
| CVE-2020-4300 | 8.2 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0; 11.1.0 |
| CVE-2020-4388 | 8.2 | Oct 12 | IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug information could also be used… Affected: 11.0.0 before 11.0.13; 11.1.0 through 11.1.7; 11.0.13; 11.0.13; 11.0.13 |
| CVE-2022-36773 | 8.1 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2024-40695 | 8.0 | Dec 20 | IBM Cognos Analytics file upload Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.4 |
| CVE-2020-4302 | 7.8 | Oct 12 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection Affected: 11.0.0 before 11.0.13; 11.1.0 through 11.1.7; 11.0.13; 11.0.13; 11.0.13 |
| CVE-2017-1779 | 7.8 | Jan 29 | IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user Affected: 11.0.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.0.5.0; +2 more |
| CVE-2025-36126 | 7.6 | May 26 | IBM Cognos Analytics is affected by Cross-site scripting. Affected: 11.2.0; 12.0; 12.1.0 |
| CVE-2025-25032 | 7.5 | Jun 11 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a… Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.4; 11.2.4; 11.2.4; 11.2.4 |
| CVE-2022-43883 | 7.5 | Dec 19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data Affected: 11.1.0 through 11.1.7; 11.2.0 through 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2022-30614 | 7.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2021-20470 | 7.5 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2019-4724 | 7.5 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content Backup page Affected: 11.0.0; 11.1.0 |
| CVE-2019-4723 | 7.5 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Server Connection page Affected: 11.0.0; 11.1.0 |
| CVE-2019-4183 | 7.5 | Sep 17 | IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would consume all available… Affected: 11.0.0; 11.1.0 |
| CVE-2024-49352 | 7.1 | Feb 5 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE) attack when… Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.4; 11.2.4; 11.2.4; 11.2.4; 11.2.4; +3 more |
| CVE-2019-4730 | 7.1 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0; 11.1.0 |
Showing 24