CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-38903
https://notcve.org/view.php?id=CVE-2021-38903
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691. IBM Cognos Analytics versiones 11.1.7, 11.2.0 y 11.1.7, es vulnerable a un ataque de tipo cross-site scripting, causadas por una comprobación inapropiada de entrada suministrada por el usuario. • https://exchange.xforce.ibmcloud.com/vulnerabilities/209691 https://security.netapp.com/advisory/ntap-20220602-0003 https://www.ibm.com/support/pages/node/6570957 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-38886
https://notcve.org/view.php?id=CVE-2021-38886
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399. IBM Cognos Analytics versiones 11.1.7, 11.2.0 y 11.1.7, es vulnerable a un ataque de tipo cross-site request forgery, lo que podría permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas desde un usuario en el que el sitio web confía. IBM X-Force ID: 209399 • https://exchange.xforce.ibmcloud.com/vulnerabilities/209399 https://security.netapp.com/advisory/ntap-20220602-0003 https://www.ibm.com/support/pages/node/6570957 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29824
https://notcve.org/view.php?id=CVE-2021-29824
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468. IBM Cognos Analytics versiones 11.1.7, 11.2.0 y 11.1.7, es vulnerable a una escalada de privilegios en la que un usuario de nivel inferior podría tener acceso de lectura a la página "Data Connections" a la que no presenta acceso. IBM X-Force ID: 204468 • https://exchange.xforce.ibmcloud.com/vulnerabilities/204468 https://security.netapp.com/advisory/ntap-20220602-0003 https://www.ibm.com/support/pages/node/6570957 •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-20464
https://notcve.org/view.php?id=CVE-2021-20464
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813. IBM Cognos Analytics PowerPlay (IBM Cognos Analytics versiones 11.1.7, 11.2.0 y 11.1.7) podría ser vulnerable a un ataque de Bomba XML por parte de un usuario autenticado malicioso. IBM X-Force ID: 196813 • https://exchange.xforce.ibmcloud.com/vulnerabilities/196813 https://security.netapp.com/advisory/ntap-20220602-0003 https://www.ibm.com/support/pages/node/6570957 • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 5.3EPSS: 0%CPEs: 31EXPL: 0CVE-2022-21496 – OpenJDK: URI parsing inconsistencies (JNDI, 8278972)
https://notcve.org/view.php?id=CVE-2022-21496
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. • https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html https://security.netapp.com/advisory/ntap-20220429-0006 https://security.netapp.com/advisory/ntap-20240621-0006 https://www.debian.org/security/2022/dsa-5128 https://www.debian.org/security/2022/dsa-5131 https://www.oracle.com/security-alerts/cpuapr2022.html https://access.redhat.com/security/cve/CVE-2022-21496 https://bugzilla.redhat.com/show_bug.cgi?id=2075849 • CWE-1173: Improper Use of Validation Framework •