Filtered by vendor Ibm
Subscriptions
Filtered by product Planning Analytics
Subscriptions
Total
28 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-42017 | 1 Ibm | 1 Planning Analytics | 2023-12-29 | 9.8 Critical |
| IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 265567. | ||||
| CVE-2022-22308 | 1 Ibm | 1 Planning Analytics | 2023-08-08 | 7.8 High |
| IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891. | ||||
| CVE-2019-4716 | 1 Ibm | 1 Planning Analytics | 2023-02-01 | 9.8 Critical |
| IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094. | ||||
| CVE-2019-4134 | 1 Ibm | 1 Planning Analytics | 2022-12-09 | 6.1 Medium |
| IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158281. | ||||
| CVE-2021-39047 | 2 Ibm, Netapp | 3 Cognos Analytics, Planning Analytics, Oncommand Insight | 2022-10-28 | 6.1 Medium |
| IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214349. | ||||
| CVE-2020-4562 | 1 Ibm | 1 Planning Analytics | 2022-06-28 | 5.3 Medium |
| IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestricted target origin via documentation frames. | ||||
| CVE-2022-22339 | 1 Ibm | 1 Planning Analytics | 2022-04-15 | 7.3 High |
| IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736. | ||||
| CVE-2021-38873 | 1 Ibm | 1 Planning Analytics | 2021-11-24 | 7.8 High |
| IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 208396. | ||||
| CVE-2021-20526 | 1 Ibm | 1 Planning Analytics | 2021-10-29 | 5.3 Medium |
| IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 198755. | ||||
| CVE-2021-29852 | 1 Ibm | 1 Planning Analytics | 2021-09-09 | 5.4 Medium |
| IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205528. | ||||
| CVE-2021-29851 | 1 Ibm | 1 Planning Analytics | 2021-09-09 | 4.3 Medium |
| IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 205527. | ||||
| CVE-2021-29853 | 1 Ibm | 1 Planning Analytics | 2021-09-09 | 4.3 Medium |
| IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some methods or functions. IBM X-Force ID: 205529. | ||||
| CVE-2020-4648 | 1 Ibm | 1 Planning Analytics | 2021-07-21 | 6.5 Medium |
| A vulnerability exsists in IBM Planning Analytics 2.0 whereby avatars in Planning Analytics Workspace could be modified by other users without authorization to do so. IBM X-Force ID: 186019. | ||||
| CVE-2020-4871 | 1 Ibm | 1 Planning Analytics | 2021-07-21 | 5.5 Medium |
| IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 190834. | ||||
| CVE-2020-4873 | 1 Ibm | 1 Planning Analytics | 2021-07-21 | 5.3 Medium |
| IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836. | ||||
| CVE-2021-20477 | 1 Ibm | 1 Planning Analytics | 2021-06-30 | 5.4 Medium |
| IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949. | ||||
| CVE-2021-20580 | 1 Ibm | 1 Planning Analytics | 2021-06-30 | 4.3 Medium |
| IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 198241. | ||||
| CVE-2020-4882 | 1 Ibm | 1 Planning Analytics | 2021-03-24 | 6.1 Medium |
| IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data . This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 190852. | ||||
| CVE-2020-4953 | 1 Ibm | 1 Planning Analytics | 2021-02-26 | 4.3 Medium |
| IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive information in HTTP repsonses. IBM X-Force ID: 192029. | ||||
| CVE-2020-4881 | 1 Ibm | 1 Planning Analytics | 2021-01-22 | 7.5 High |
| IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS communication. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 190851. | ||||