CA
Product
Cognos Analytics
109
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 6High 24Medium 77Low 2
Watch
Add Cognos Analytics to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0823 | 6.5 | Feb 28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.4; 11.2.4; 11.2.4; 11.2.4; 11.2.4; +4 more |
| CVE-2024-56340 | 6.5 | Feb 28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal… Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.4; 11.2.4; 11.2.4; 11.2.4; 11.2.4; +4 more |
| CVE-2022-34357 | 6.5 | Feb 26 | IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting Affected: 11.1.1 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +9 more |
| CVE-2022-34339 | 6.5 | Nov 3 | "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2021-29823 | 6.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2021-20468 | 6.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2020-4301 | 6.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2021-29768 | 6.5 | Jun 24 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for which they should not… Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2021-38904 | 6.5 | Apr 22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-20464 | 6.5 | Apr 22 | IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-29716 | 6.5 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed to view Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2021-20461 | 6.5 | Jun 30 | IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting Affected: 11.0.0 before 11.0.13; 11.1.0 before 11.1.7; 11.0.13; 11.0.13; 11.0.13; 11.0.13; +3 more |
| CVE-2019-4471 | 6.5 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS… Affected: 11.0.0; 11.1.0 |
| CVE-2019-4343 | 6.5 | Dec 30 | IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information Affected: 11.0.0; 11.1.0 |
| CVE-2024-25042 | 6.1 | Dec 18 | IBM Cognos Analytics cross-site scripting Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.3 |
| CVE-2024-41752 | 6.1 | Dec 18 | IBM Cognos Analytics HTML injection Affected: 11.2.0 through 11.2.4; 12.0.0 through 12.0.3 |
| CVE-2023-38359 | 6.1 | Feb 26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting Affected: 11.1.1 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +9 more |
| CVE-2021-39036 | 6.1 | May 12 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting Affected: 11.1; 11.2 |
| CVE-2022-39160 | 6.1 | Dec 19 | IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting Affected: 11.1.0 before 11.1.7; 11.2.0 through 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2021-39047 | 6.1 | Jun 24 | IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +2 more |
| CVE-2021-20493 | 6.1 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2019-4645 | 6.1 | Nov 9 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting Affected: 11.0.0; 11.1.0 |
| CVE-2017-1428 | 6.1 | Aug 29 | IBM Cognos Analytics 11.0 could allow a remote attacker to hijack the clicking action of the victim Affected: 11.0.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.0.5; +1 more |
| CVE-2017-1427 | 6.1 | Aug 29 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting Affected: 11.0.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.0.5; +1 more |
| CVE-2025-33147 | 5.9 | Sep 18 | IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities Affected: 12.1.0 through 12.1.3 FP1; 12.0.4 through 12.0.4 FP2 |
| CVE-2024-56344 | 5.9 | Sep 18 | IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities Affected: 12.0.4 through 12.0.4 FP2; 12.1.0 through 12.1.3 FP1 |
| CVE-2023-38009 | 5.9 | Jan 26 | IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning Affected: 1.1 |
| CVE-2024-25053 | 5.9 | Jun 28 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data… Affected: 11.2.0; 11.2.1; 11.2.2; 11.2.3; 11.2.4; 12.0.0; +2 more |
| CVE-2024-40703 | 5.5 | Sep 22 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to… Affected: 11.2.0 through 11.2.3; 12.0.0 before 12.0.3; 11.2.4; 12.0.3; 12.0.3 |
| CVE-2021-39045 | 5.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2021-39009 | 5.5 | Sep 1 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.3; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +1 more |
| CVE-2017-1784 | 5.5 | Jan 29 | IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local user Affected: 11.0.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.0.5.0; +2 more |
| CVE-2026-7884 | 5.4 | Sep 14 | IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities Affected: 12.1.0 through 12.1.3 FP1; 12.0.4 through 12.0.4 FP2 |
| CVE-2024-52900 | 5.4 | Jun 28 | IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting Affected: 11.2.0 before 11.2.4; 12.0.0 before 12.0.4; 11.2.4; 11.2.4; 11.2.4; 11.2.4; +8 more |
| CVE-2024-25041 | 5.4 | Jun 28 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting (XSS) Affected: 11.2.0 through 11.2.3; 12.0.0 through 12.0.2; 11.2.4 |
| CVE-2023-43051 | 5.4 | Feb 26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting Affected: 11.1.1 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +9 more |
| CVE-2023-35011 | 5.4 | Aug 16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF) Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +8 more |
| CVE-2023-28530 | 5.4 | Jul 22 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +5 more |
| CVE-2023-25929 | 5.4 | Jul 22 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting Affected: 11.1.0 before 11.1.7; 11.2.0 before 11.2.4; 11.1.7; 11.1.7; 11.1.7; 11.1.7; +5 more |
| CVE-2021-38946 | 5.4 | Apr 22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-38903 | 5.4 | Apr 22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input Affected: 11.1.7; 11.2.0; 11.2.1 |
| CVE-2021-38909 | 5.4 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2021-29867 | 5.4 | Dec 3 | IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to Affected: 11.1.0 before 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.1.7; 11.2.0 |
| CVE-2020-4354 | 5.4 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting Affected: 11.0.0; 11.1.0 |
| CVE-2019-4653 | 5.4 | Jun 1 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting Affected: 11.0.0; 11.1.0 |
| CVE-2019-4623 | 5.4 | Dec 30 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting Affected: 11.0.0; 11.1.0 |
| CVE-2019-4555 | 5.4 | Dec 20 | IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting Affected: 11.0.0 through 11.0.12; 11.1.0 before 11.1.4; 11.0.13; 11.0.13; 11.0.13 |
| CVE-2019-4342 | 5.4 | Sep 17 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting Affected: 11.0.0; 11.1.0 |
| CVE-2019-4139 | 5.4 | May 29 | IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting Affected: 11.0.0; 11.1.0; 11.1.1 |
| CVE-2018-1413 | 5.4 | May 7 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting Affected: 11.0.0.0 through 11.0.10.0 |