IBM Cognos Business Intelligence vulnerabilities

29 CVEs affecting IBM Cognos Business Intelligence, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1934, published 2019-12-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4034, published 2013-11-18. Medium severity, CVSS 4.0. EPSS: 5.6% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated users to read…
CVE-2012-4858, published 2013-03-05. High severity, CVSS 9.3. EPSS: 3.9% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 does not properly validate Java serialized input, which allows remote attackers to…
CVE-2013-3030, published 2013-11-18. Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days. The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers…
CVE-2016-0254, published 2017-06-07. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker…
CVE-2014-0854, published 2014-02-22. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. The server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote authenticated users to read…
CVE-2016-3036, published 2017-04-17. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing packets. A remote attacker could exploit this vulnerability to cause a denial…
CVE-2013-2988, published 2013-08-27. Low severity, CVSS 2.6. EPSS: 1.7% chance of exploitation in the next 30 days. Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the…
CVE-2016-8960, published 2017-03-27. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the higher-privilege user's cookie…
CVE-2013-6732, published 2014-02-22. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4…
CVE-2012-4840, published 2013-03-05. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence (BI) 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and call XPath extension…

Latest

CVE-2018-1934, published 2019-12-20. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the…
CVE-2017-1764, published 2018-04-23. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM X-Force ID: 136149.
CVE-2017-1486, published 2018-04-23. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2016-3038, published 2017-04-17. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2016-3037, published 2017-04-17. Medium severity, CVSS 5.7. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key. An authenticated attacker with user interaction could obtain this sensitive information. IBM…
CVE-2016-9985, published 2017-03-08. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999671.
CVE-2016-0218, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this…