← Back

Cognos Analytics

cognos_analytics

Vendor: Ibm • 104 CVEs

CVEs (104)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-4301
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Sep 1, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM...Show more
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 176609.Show less
CVE-2021-39047
2Ibm
Netapp
3Cognos Analytics
Oncommand InsightPlanning Analytics
Jun 17, 2026
Jun 24, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the in...Show more
IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214349.Show less
CVE-2021-38945
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Jun 24, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238.
CVE-2021-29768
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Jun 24, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for which they should not have access. IBM X-Force ID: 202682.
CVE-2021-38946
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Apr 22, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...Show more
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.Show less
CVE-2021-38905
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Apr 22, 2022
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697.
CVE-2021-38904
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Apr 22, 2022
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693.
CVE-2021-38903
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Apr 22, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script i...Show more
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691.Show less
CVE-2021-38886
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Apr 22, 2022
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM...Show more
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.Show less
CVE-2021-29824
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Apr 22, 2022
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 20...Show more
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468.Show less
CVE-2021-20464
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Apr 22, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.
CVE-2021-38909
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Dec 3, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209706.Show less
CVE-2021-29867
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Dec 3, 2021
N/A· v4
5.4 MEDIUM· v3
5.5 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212.
CVE-2021-29756
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Dec 3, 2021
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the...Show more
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202167.Show less
CVE-2021-29719
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Dec 3, 2021
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifying an incorrect content type. IBM X-Force ID: 201091
CVE-2021-29716
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Dec 3, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed to view. IBM X-Force ID: 201087.
CVE-2021-20493
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Dec 3, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 197794.Show less
CVE-2021-20470
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Dec 3, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339.
CVE-2021-29745
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Oct 15, 2021
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they should not have access to. IBM X-Force ID: 201695.
CVE-2021-29679
2Ibm
Netapp
2Cognos Analytics
Oncommand Insight
Jun 17, 2026
Oct 15, 2021
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include (SSI) directive. I...Show more
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include (SSI) directive. IBM X-Force ID: 199915.Show less