IBM Cognos Analytics

IBM Cognos Analytics 12.1.0 Hidden Pages Info Disclosure
CVE-2025-33150 5.3 - Medium - November 10, 2025

IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages.

Files or Directories Accessible to External Parties

Stored XSS in IBM Cognos Analytics 11.2.0-12.2.4 FP5 Web UI
CVE-2024-52900 5.4 - Medium - June 28, 2025

IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

XSS

IBM Cognos Analytics 11-12: Source Code Exposure via Web Server
CVE-2025-0923 5.3 - Medium - June 11, 2025

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in further attacks against the system.

Inclusion of Sensitive Information in Source Code

IBM Cognos Analytics 11.2-12.0 DoS via Memory Exhaustion (CVE-2025-25032)
CVE-2025-25032 7.5 - High - June 11, 2025

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources.

Allocation of Resources Without Limits or Throttling

IBM Cognos Analytics 12.0.x XSS via Web UI
CVE-2025-0917 4.8 - Medium - June 11, 2025

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

XSS

IBM Cognos Analytics 11.2.0-11.2.4 FP5 LFI via deficon parameter
CVE-2024-56340 6.5 - Medium - February 28, 2025

IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter.

Relative Path Traversal

IBM Cognos Analytics FP5/FP4 Directory Traversal via URL (CVE-2025-0823)
CVE-2025-0823 6.5 - Medium - February 28, 2025

IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Directory traversal

IBM Cognos Analytics XXE Vulnerability 11.2-12.0.4
CVE-2024-49352 7.1 - High - February 05, 2025

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

XXE

IBM Cognos Mobile Client 1.1 iOS MITM Info Disclosure due to Missing Cert Pinning
CVE-2023-38009 5.9 - Medium - January 26, 2025

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.

Improper Certificate Validation

IBM Cognos Analytics Malicious File Upload Vulnerability
CVE-2024-40695 8 - High - December 20, 2024

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.

Unrestricted File Upload

IBM Cognos Analytics EL Injection Vulnerability
CVE-2024-51466 9 - Critical - December 20, 2024

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.

EL Injection

IBM Cognos Analytics Cross Site Scripting (XSS) Vulnerability in Column Headings
CVE-2024-25042 6.1 - Medium - December 18, 2024

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is potentially vulnerable to Cross Site Scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Explorations.

XSS

IBM Cognos Analytics HTML Injection Vulnerability
CVE-2024-41752 6.1 - Medium - December 18, 2024

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

XSS

IBM Cognos Analytics Open Redirect Vulnerability
CVE-2024-45082 5.2 - Medium - December 18, 2024

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted.

Open Redirect

IBM Cognos Analytics Local API Key Leak (before 12.0.3)
CVE-2024-40703 5.5 - Medium - September 22, 2024

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to obtain sensitive information in the form of an API key. An attacker could use this information to launch further attacks against affected applications.

Insufficiently Protected Credentials

IBM Cognos Analytics XSS via Assistant column headings v11.2.0-12.0.2
CVE-2024-25041 5.4 - Medium - June 28, 2024

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Assistant. IBM X-Force ID: 282780.

XSS

IBM Cognos Analytics Improper Cert Validation v11.2.0-12.0.2
CVE-2024-25053 5.9 - Medium - June 28, 2024

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between IBM Planning Analytics server and IBM Cognos Analytics server. IBM X-Force ID: 283364.

Improper Certificate Validation

Injection in IBM Cognos Analytics App Logging 11.2.0-11.2.4/12.0.0-12.0.2
CVE-2024-25047 - May 02, 2024

IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.

Improper Output Neutralization for Logs

IBM Cognos Analytics v11-12: Form Action Hijack (CVE-2023-32344)
CVE-2023-32344 4.3 - Medium - February 26, 2024

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary path. IBM X-Force ID: 255898.

Session Riding

IBM Cognos Analytics XSS in Web UI (before 12.0)
CVE-2023-38359 6.1 - Medium - February 26, 2024

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260744.

XSS

IBM Cognos Analytics Web UI XSS <12.0.1
CVE-2023-43051 5.4 - Medium - February 26, 2024

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 267451.

XSS

IBM Cognos Analytics Mobile Server 12.0.0 DoS via missing rate limiting
CVE-2022-34357 6.5 - Medium - February 26, 2024

IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting. By making unlimited http requests, it is possible for a single user to exhaust server resources over a period of time making service unavailable for other legitimate users. IBM X-Force ID: 230510.

Allocation of Resources Without Limits or Throttling

IBM Cognos Analytics InfoLeak via Unverified Sources (pre12.0.0)
CVE-2023-30996 5.3 - Medium - February 26, 2024

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects of different origins. IBM X-Force ID: 254290.

Origin Validation Error

IBM Cognos Analytics 11.1.7-11.2.1 SSRF Vulnerability
CVE-2023-35011 5.4 - Medium - August 16, 2023

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 257705.

SSRF

IBM Cognos Analytics 11.1-11.2 Remote Info Disclosure
CVE-2023-35009 5.3 - Medium - August 16, 2023

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-Force ID: 257703.

Generation of Error Message Containing Sensitive Information

IBM Cognos Analytics 11.x XSS Vulnerability allows arbitrary JS in UI
CVE-2023-25929 5.4 - Medium - July 22, 2023

IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 247861.

XSS

IBM Cognos Analytics 11.1/11.2 XSS via SVG in Custom Vis
CVE-2023-28530 5.4 - Medium - July 22, 2023

IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 251214.

XSS

IBM Cognos Analytics 11.x XSS allows arbitrary JS injection (CVE-2021-39036)
CVE-2021-39036 6.1 - Medium - May 12, 2023

IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213966.

SSRF vulnerability in IBM Cognos Analytics 11.x (11.1.7-11.2.1)
CVE-2022-38708 9.1 - Critical - December 19, 2022

IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.

SSRF

IBM Cognos Analytics 11.x XSS Enables Arbitrary JS Injection
CVE-2022-39160 6.1 - Medium - December 19, 2022

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 235064.

XSS

IBM Cognos Analytics 11.1.7-11.2.1 Log Injection via URL Construction
CVE-2022-43883 7.5 - High - December 19, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 240266.

Output Sanitization

IBM Cognos Analytics 11.1.7-11.2.1 Log API Key Leak
CVE-2022-43887 5.3 - Medium - December 19, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.

Insertion of Sensitive Information into Log File

Clear-Text Password Storage Vulnerability in IBM Cognos Analytics 11.2.1
CVE-2022-34339 6.5 - Medium - November 03, 2022

"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."

Cleartext Storage of Sensitive Information

IBM Cognos Analytics 11.1.7-11.2.1 CSRF Vulnerability
CVE-2021-29823 6.5 - Medium - September 01, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204465.

Session Riding

IBM Cognos Analytics XXE in XML (11.1.7-11.2.1)
CVE-2022-36773 8.1 - High - September 01, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571.

XXE

IBM Cognos Analytics 11.1.7-11.2.1 DOS via Email Flooding Causing CPU Exhaustion
CVE-2022-30614 7.5 - High - September 01, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591.

IBM Cognos Analytics 11.2.1 Autocomplete Field Disclosure
CVE-2021-39045 5.5 - Medium - September 01, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IBM X-Force ID: 214345.

Insufficiently Protected Credentials

IBM Cognos Analytics 11.1.7/11.2.0/11.2.1 plain creds stored local privileged read
CVE-2021-39009 5.5 - Medium - September 01, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554.

Cleartext Storage of Sensitive Information

IBM Cognos Analytics 11.1.7-11.2.1 CSRF Exploit Enables Unauthorized Actions
CVE-2021-20468 - September 01, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 196825.

IBM Cognos Analytics 11.1.7-11.2.1 CSRF allows unauthorized action exec
CVE-2020-4301 6.5 - Medium - September 01, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 176609.

Session Riding

IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting
CVE-2021-39047 6.1 - Medium - June 24, 2022

IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214349.

XSS

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could
CVE-2021-29768 6.5 - Medium - June 24, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for which they should not have access. IBM X-Force ID: 202682.

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could
CVE-2021-38945 9.8 - Critical - June 24, 2022

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238.

Unrestricted File Upload

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to
CVE-2021-29824 4.3 - Medium - April 22, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468.

IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7
CVE-2021-20464 - April 22, 2022

IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user
CVE-2021-38886 8.8 - High - April 22, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.

Session Riding

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input
CVE-2021-38903 5.4 - Medium - April 22, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691.

XSS

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could
CVE-2021-38904 6.5 - Medium - April 22, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693.

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to
CVE-2021-38905 4.3 - Medium - April 22, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697.

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting
CVE-2021-38946 5.4 - Medium - April 22, 2022

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.

XSS