IBM Cognos Command Center vulnerabilities

8 CVEs affecting IBM Cognos Command Center, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-2697, published 2025-08-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4001, published 2013-12-14. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie.
CVE-2013-4000, published 2013-12-14. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in IBM Cognos Command Center before 10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) start…
CVE-2023-50324, published 2024-03-01. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the application environment to conduct further…
CVE-2025-2697, published 2025-08-26. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site,…
CVE-2025-1494, published 2025-08-26. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could…
CVE-2024-31899, published 2024-09-26. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.
CVE-2022-38707, published 2023-05-05. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179.
CVE-2025-1994, published 2025-08-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function.