IBM i2 Analyze vulnerabilities

5 CVEs affecting IBM i2 Analyze, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-29784, published 2021-07-26.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-29766, published 2021-07-26. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
• CVE-2021-20430, published 2021-07-26. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
• CVE-2021-29784, published 2021-07-26. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used…
• CVE-2021-29770, published 2021-07-26. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 202771.
• CVE-2021-29769, published 2021-07-26. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values…