CC
Product
Cognos Controller
52
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 16Medium 24Low 6
Watch
Add Cognos Controller to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-25020 | 9.8 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to malicious file upload by allowing unrestricted filetype attachments in the Journal entry page Affected: 11.0.0; 11.0.1 |
| CVE-2024-40691 | 9.8 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface Affected: 11.0.0; 11.0.1 |
| CVE-2024-25019 | 9.8 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments Affected: 11.0.0; 11.0.1 |
| CVE-2023-38724 | 9.8 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2020-4879 | 9.8 | Jan 21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies Affected: 10.4.0; 10.4.1; 10.4.2 |
| CVE-2020-4877 | 9.8 | Jan 21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes Affected: 10.4.0; 10.4.1; 10.4.2 |
| CVE-2024-28777 | 8.8 | Feb 19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization Affected: 11.0.0 before 11.0.1.4 |
| CVE-2024-52902 | 8.8 | Feb 19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for… Affected: 11.0.0 before 11.0.1.4 |
| CVE-2023-40695 | 8.8 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2023-47160 | 8.2 | Feb 19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 11.0.0 before 11.0.1.4 |
| CVE-2024-40702 | 8.2 | Jan 7 | IBM Cognos Controller improper certificate validation Affected: 11.0.0 through 11.0.1 |
| CVE-2020-4876 | 8.2 | Jan 21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 10.4.0; 10.4.1; 10.4.2 |
| CVE-2020-4875 | 8.2 | Jan 21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 10.4.0; 10.4.1; 10.4.2 |
| CVE-2024-45084 | 8.0 | Feb 19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection Affected: 11.0.0 before 11.0.1.4 |
| CVE-2025-36326 | 7.5 | Sep 26 | IBM Controller information disclosure Affected: 11.0.0 through 11.0.1 |
| CVE-2024-41777 | 7.5 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,… Affected: 11.0.0; 11.0.1 |
| CVE-2024-41775 | 7.5 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 11.0.0; 11.0.1 |
| CVE-2023-40696 | 7.5 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2020-4874 | 7.5 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2019-4175 | 7.5 | Sep 17 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 10.4.0; 10.4.1 |
| CVE-2021-20451 | 7.2 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2020-4685 | 7.2 | Nov 11 | A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate… Affected: 10.3.0; 10.3.1; 10.4.0; 10.4.1; 10.4.2 |
| CVE-2025-36015 | 6.5 | Dec 8 | IBM Controller Denial of Service Affected: 11.0.0 through 11.0.1 FP6 |
| CVE-2025-33079 | 6.5 | May 27 | IBM Controller information disclosure Affected: 11.0.0, 11.0.1 |
| CVE-2024-45081 | 6.5 | Feb 19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect authorization checks Affected: 11.0.0 before 11.0.1.4 |
| CVE-2024-28778 | 6.5 | Jan 7 | IBM Cognos Controller information disclosure Affected: 11.0.0 through 11.0.1 |
| CVE-2024-41776 | 6.5 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 11.0.0; 11.0.1 |
| CVE-2019-4173 | 6.5 | Jun 17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka… Affected: 10.2.0; 10.2.1; 10.3.0; 10.3.1; 10.4.0 |
| CVE-2024-28780 | 5.9 | Feb 19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client uses weaker than expected cryptographic algorithms that could allow an attacker to… Affected: 11.0.0 before 11.0.1.4 |
| CVE-2021-29892 | 5.9 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Affected: 11.0.0; 11.0.1 |
| CVE-2024-28776 | 5.4 | Feb 19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting Affected: 11.0.0 before 11.0.1.4 |
| CVE-2019-4136 | 5.4 | Jun 17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting Affected: 10.2.0; 10.2.1; 10.3.0; 10.3.1; 10.4.0 |
| CVE-2024-25035 | 5.3 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 exposes server details that could allow an attacker to obtain information of the application environment to conduct further attacks Affected: 11.0.0; 11.0.1 |
| CVE-2022-22364 | 5.3 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2023-28952 | 5.3 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2023-23474 | 5.3 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2021-20556 | 5.3 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2019-4412 | 5.3 | Nov 9 | IBM Cognos Controller stores sensitive information in URL parameters Affected: 10.3.0; 10.3.1; 10.4.0; 10.4.1 |
| CVE-2019-4176 | 5.3 | Jun 17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an error related to insecure HTTP Methods Affected: 10.2.0; 10.2.1; 10.3.0; 10.3.1; 10.4.0 |
| CVE-2022-39163 | 4.7 | Mar 26 | IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead… Affected: 11.0.0 through 11.0.1 |
| CVE-2025-33111 | 4.3 | Dec 8 | IBM Controller Information Disclosure Affected: 11.0.0 through 11.0.1 FP6 |
| CVE-2022-22363 | 4.3 | Jan 7 | IBM Cognos Controller information disclosure Affected: 11.0.0 through 11.0.1 |
| CVE-2024-25037 | 4.3 | Jan 7 | IBM Cognos Controller information disclosure Affected: 11.0.0 through 11.0.1 |
| CVE-2024-45676 | 4.3 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user to upload insecure files, due to insufficient file type distinction Affected: 11.0.0; 11.0.1 |
| CVE-2021-20450 | 4.3 | May 3 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies Affected: 10.4.1; 10.4.2; 11.0.0 |
| CVE-2019-4411 | 4.3 | Nov 9 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names Affected: 10.3.0; 10.3.1; 10.4.0; 10.4.1 |
| CVE-2021-20455 | 3.7 | Jan 7 | IBM Cognos Controller information disclosure Affected: 11.0.0 through 11.0.1 |
| CVE-2019-4171 | 3.7 | Sep 17 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies Affected: 10.3.0; 10.3.1; 10.4.0; 10.4.1 |
| CVE-2024-25036 | 3.3 | Dec 3 | IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user with local access to bypass security allowing users to circumvent restrictions imposed on input… Affected: 11.0.0; 11.0.1 |
| CVE-2019-4177 | 3.3 | Jun 17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system Affected: 10.2.0; 10.2.1; 10.3.0; 10.3.1; 10.4.0 |