Page 5 of 28 results (0.012 seconds)

CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0

CVE-2020-4527

https://notcve.org/view.php?id=CVE-2020-4527

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie in TLS mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 182631. IBM Planning Analytics versión 2.0, podría permitir a un atacante remoto obtener información confidencial, causado por el fallo al ajustar el flag Secure para la cookie de sesión en modo TLS. Al interceptar su transmisión dentro de una sesión HTTP, un atacante podría explotar esta vulnerabilidad para capturar la cookie y obtener información confidencial. • https://exchange.xforce.ibmcloud.com/vulnerabilities/182631 https://www.ibm.com/support/pages/node/6249981 • CWE-384: Session Fixation •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2020-4361

https://notcve.org/view.php?id=CVE-2020-4361

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766. IBM Planning Analytics versión 2.0, podría permitir a un atacante remoto obtener información confidencial al divulgar direcciones IP privadas en respuestas HTTP. IBM X-Force ID: 178766 • https://exchange.xforce.ibmcloud.com/vulnerabilities/178766 https://www.ibm.com/support/pages/node/6249981 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-4613

https://notcve.org/view.php?id=CVE-2019-4613

IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 168524. IBM Planning Analytics versión 2.0, es vulnerable a un ataque de tipo cross-site request forgery, lo que podría permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas desde un usuario en el que el sitio web confía. ID de IBM X-Force: 168524. • https://exchange.xforce.ibmcloud.com/vulnerabilities/168524 https://www.ibm.com/support/pages/node/1172860 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 10.0EPSS: 18%CPEs: 1EXPL: 3

CVE-2019-4716 – IBM Planning Analytics Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2019-4716

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094. IBM Planning Analytics versiones 2.0.0 hasta 2.0.8, es vulnerable a una sobrescritura de configuración que permite a un usuario no autenticado iniciar sesión como "admin" y luego ejecutar código como root o SYSTEM por medio de scripts TM1. ID de IBM X-Force: 172094. IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. • https://www.exploit-db.com/exploits/48273 http://packetstormsecurity.com/files/156953/IBM-Cognos-TM1-IBM-Planning-Analytics-Server-Configuration-Overwrite-Code-Execution.html http://seclists.org/fulldisclosure/2020/Mar/44 https://exchange.xforce.ibmcloud.com/vulnerabilities/172094 https://www.ibm.com/support/pages/node/1127781 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-4612

https://notcve.org/view.php?id=CVE-2019-4612

IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523. IBM Planning Analytics versión 2.0, es vulnerable a una carga de archivos maliciosos en el portal My Account. Los atacantes pueden hacer uso de esta debilidad y cargar archivos ejecutables maliciosos hacia el sistema y pueden ser enviados a la víctima para realizar nuevos ataques. • https://exchange.xforce.ibmcloud.com/vulnerabilities/168523 https://www.ibm.com/support/pages/node/1118565 • CWE-434: Unrestricted Upload of File with Dangerous Type •