CVE-2012-0696

IBM Cognos TM1 <9.5 FP1 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js.

References (7)

[Vendor Advisory] http://secunia.com/advisories/47487

[Vendor Advisory] http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/72198

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/51326

[Third Party Advisory, VDB Entry] http://www.osvdb.org/78216

[Third Party Advisory, VDB Entry] http://www.osvdb.org/78217

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1026491

Scores

EPSS 0.0046

EPSS Percentile 64.0%

Classification

CWE

CWE-79

Status published

Affected Products (5)

ibm/cognos_executive_viewer

ibm/cognos_tm1 < 9.4.1.3

ibm/cognos_tm1

ibm/cognos_tm1

n/a/n/a

Timeline

Published Jan 13, 2012

Tracked Since Feb 18, 2026