IBM Cognos Controller
52 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-36102 | 11.0.0 – 11.0.1 FP6 | IBM Controller Validation Bypass | LOW 2.7 | 0.2 % | ||
| CVE-2025-33111 | 11.0.0 – 11.0.1 FP6 | IBM Controller Information Disclosure | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-36015 | 11.0.0 – 11.0.1 FP6 | IBM Controller Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-36326 | 11.0.0 – 11.0.1 | IBM Controller information disclosure | HIGH 7.5 | 0.2 % | ||
| CVE-2025-33079 | 11.0.0, 11.0.1 | IBM Controller information disclosure | MEDIUM 6.5 | 0.3 % | ||
| CVE-2022-39163 | 11.0.0 – 11.0.1 | IBM Cognos Controller HTTP response smuggling | MEDIUM 4.7 | 0.2 % | ||
| CVE-2023-47160 | 11.0.0 – 11.0.1 | IBM Cognos Controller XML external entity injection | HIGH 8.2 | 0.5 % | ||
| CVE-2024-28777 | 11.0.0 – 11.0.1 | IBM Cognos Controller code execution | HIGH 8.8 | 0.6 % | ||
| CVE-2024-28776 | 11.0.0 – 11.0.1 | IBM Cognos Controller cross-site scripting | MEDIUM 5.4 | 0.2 % | ||
| CVE-2024-28780 | 11.0.0 – 11.0.1 | IBM Cognos Controller information disclosure | MEDIUM 5.9 | 0.2 % | ||
| CVE-2024-45081 | 11.0.0 – 11.0.1 | IBM Cognos Controller incorrect authorization | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-45084 | 11.0.0 – 11.0.1 | IBM Cognos Controller CSV injection | HIGH 8.0 | 0.4 % | ||
| CVE-2024-52902 | 11.0.0 – 11.0.1 | IBM Cognos Controller information disclosure | HIGH 8.8 | 0.4 % | ||
| CVE-2022-22363 | 11.0.0 – 11.0.1 | IBM Cognos Controller information disclosure | MEDIUM 4.3 | 0.8 % | ||
| CVE-2021-20455 | 11.0.0 – 11.0.1 | IBM Cognos Controller information disclosure | LOW 3.7 | 0.5 % | ||
| CVE-2024-40702 | 11.0.0 – 11.0.1 | IBM Cognos Controller improper certificate validation | HIGH 8.2 | 0.3 % | ||
| CVE-2024-28778 | 11.0.0 – 11.0.1 | IBM Cognos Controller information disclosure | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-25037 | 11.0.0 – 11.0.1 | IBM Cognos Controller information disclosure | MEDIUM 4.3 | 0.6 % | ||
| CVE-2024-41775 | 11.0.0, 11.0.1 | IBM Cognos Controller information disclosure | HIGH 7.5 | 0.2 % | ||
| CVE-2024-25020 | 11.0.0, 11.0.1 | IBM Cognos Controller file upload | CRITICAL 9.8 | 0.3 % | ||
| CVE-2024-41776 | 11.0.0, 11.0.1 | IBM Cognos Controller cross-site request forgery | MEDIUM 6.5 | 0.2 % | ||
| CVE-2024-41777 | 11.0.0, 11.0.1 | IBM Cognos Controller hard coded credentials | HIGH 7.5 | 0.3 % | ||
| CVE-2024-45676 | 11.0.0, 11.0.1 | IBM Cognos Controller file upload | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-25036 | 11.0.0, 11.0.1 | IBM Cognos Controller authentication bypass | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-25035 | 11.0.0, 11.0.1 | IBM Cognos Controller information disclosure | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-40691 | 11.0.0, 11.0.1 | IBM Cognos Controller file upload | CRITICAL 9.8 | 0.4 % | ||
| CVE-2024-25019 | 11.0.0, 11.0.1 | IBM Cognos Controller file upload | CRITICAL 9.8 | 0.3 % | ||
| CVE-2021-29892 | 11.0.0, 11.0.1 | IBM Cognos Controller information disclosure | MEDIUM 5.9 | 0.3 % | ||
| CVE-2023-40695 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller session fixation | HIGH 8.8 | 0.4 % | ||
| CVE-2021-20451 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller SQL injection | HIGH 7.2 | 0.5 % | ||
| CVE-2022-22364 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller security bypass | MEDIUM 5.3 | 0.5 % | ||
| CVE-2023-28952 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller log injection | MEDIUM 5.3 | 0.4 % | ||
| CVE-2023-38724 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller SQL injection | CRITICAL 9.8 | 0.5 % | ||
| CVE-2023-40696 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller information disclosure | HIGH 7.5 | 0.3 % | ||
| CVE-2021-20556 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller information disclosure | MEDIUM 5.3 | 0.5 % | ||
| CVE-2023-23474 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller information disclosure | MEDIUM 5.3 | 0.4 % | ||
| CVE-2021-20450 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller information disclosure | MEDIUM 4.3 | 0.4 % | ||
| CVE-2020-4874 | 10.4.1, 10.4.2, 11.0.0 | IBM Cognos Controller information disclosure | HIGH 7.5 | 0.3 % | ||
| CVE-2020-4879 | 10.4.0 ; 10.4.1 ; 10.4.2 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validatio | CRITICAL 9.8 | 1.5 % | ||
| CVE-2020-4877 | 10.4.0 ; 10.4.1 ; 10.4.2 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. | CRITICAL 9.8 | 0.9 % | ||
| CVE-2020-4876 | 10.4.0 ; 10.4.1 ; 10.4.2 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A | HIGH 8.2 | 1.7 % | ||
| CVE-2020-4875 | 10.4.0 ; 10.4.1 ; 10.4.2 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A | HIGH 8.2 | 1.7 % | ||
| CVE-2020-4685 | 10.3.1 ; 10.3.0 ; 10.4.0 ; … | A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the a | HIGH 8.0 | 1.4 % | ||
| CVE-2019-4412 | 10.3.1 ; 10.3.0 ; 10.4.0 ; … | IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have a | MEDIUM 5.3 | 1.0 % | ||
| CVE-2019-4411 | 10.3.1 ; 10.3.0 ; 10.4.0 ; … | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to gu | MEDIUM 4.3 | 0.8 % | ||
| CVE-2019-4175 | 10.3.1 ; 10.3.0 ; 10.4.0 ; … | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to | HIGH 7.5 | 1.0 % | ||
| CVE-2019-4171 | 10.3.1 ; 10.3.0 ; 10.4.0 ; … | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This | LOW 3.7 | 0.6 % | ||
| CVE-2019-4177 | 10.2.1 ; 10.2.0 ; 10.3.1 ; … | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on | MEDIUM 4.0 | 0.3 % | ||
| CVE-2019-4176 | 10.2.1 ; 10.2.0 ; 10.3.1 ; … | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an | MEDIUM 5.3 | 1.9 % | ||
| CVE-2019-4174 | 10.2.1 ; 10.2.0 ; 10.3.1 ; … | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on | MEDIUM 4.0 | 0.3 % | ||
| CVE-2019-4173 | 10.2.1 ; 10.2.0 ; 10.3.1 ; … | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a | MEDIUM 6.5 | 1.8 % | ||
| CVE-2019-4136 | 10.2.1 ; 10.2.0 ; 10.3.1 ; … | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to e | MEDIUM 5.4 | 0.7 % |