Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMB759C8B69F6CB54EF6037AB2A3007E7D5FFFD317FF2398C5230C17D51C9369CB
HistoryJun 15, 2018 - 11:13 p.m.

Security Bulletin: Multiple security exposures in IBM Cognos BI Server (CVE-2013-6954, CVE-2013-6732, CVE-2013-5802, CVE-2013-5825, CVE-2014-0854, CVE-2014-0861)

2018-06-1523:13:31
www.ibm.com
14

0.133 Low

EPSS

Percentile

95.6%

JSON

Summary

IBM Cognos BI Server is affected by multiple security exposures.

Vulnerability Details

CVE ID: CVE-2013-6954

DESCRIPTION: If an attacker is able to upload a specially-crafted image to the IBM Cognos BI Server and have the application process it, they may be able to cause the application to crash, resulting in a Denial of Service.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/89917&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1.1
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1

REMEDIATION:
The recommended solution is to apply the fix in one of the 10.x versions listed or in version 8.4.1 for your release version as soon as practical.

CVE ID: CVE-2013-6732

DESCRIPTION: An unsanitized input parameter allows an attack to perform a reflective cross-site scripting attack if he can trick a user into clicking a link.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/89394&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1.1
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1

REMEDIATION:
The recommended solution is to apply the fix in one of the 10.x versions listed or in version 8.4.1 for your release version as soon as practical.

CVE ID: CVE-2013-5802

DESCRIPTION: If an attacker is able to upload malformed or extremely large streams of XML data to the IBM Cognos BI Server, they may be able to cause the application to crash, resulting in a Denial of Service…

CVSS:
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/87982&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/P:I/P:A/P)

AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1.1
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1

REMEDIATION:
The recommended solution is to apply the fix in one of the 10.x versions listed or in version 8.4.1 for your release version as soon as practical.

CVE ID: CVE-2013-5825

DESCRIPTION: If an attacker is able to upload malformed XML data to the IBM Cognos BI Server, they may be able to cause the application to crash, resulting in a Denial of Service.

CVSS:
CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/87988&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/N:C/N:I/N:A/P)

AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1.1
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1

REMEDIATION:
The recommended solution is to apply the fix in one of the 10.x versions listed or in version 8.4.1 for your release version as soon as practical.

CVE ID: CVE-2014-0854 **
DESCRIPTION**: A malicious user can specify a unintended DOCTYPE in XML Posted to the server. This can be used to echo back any file from the server that the process running the application has access to.

CVSS:
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/90794&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/L:Au/S:C/P:I/N:A/N)

AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1.1
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1

REMEDIATION:
The recommended solution is to apply the fix in one of the 10.x versions listed or in version 8.4.1 for your release version as soon as practical.

CVE ID: CVE-2014-0861

DESCRIPTION: An insufficiently sanitized parameter allows an attack to craft a URL that when an authenticated user clicks on and then proceeds to use the applications back/return button launches a script in the context of that user.

CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/40682&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV/N:AC/M:Au/N:C/N:I/P:A/N)

AFFECTED PLATFORMS:
IBM Cognos Business Intelligence Server 10.2.1.1
IBM Cognos Business Intelligence Server 10.2.1
IBM Cognos Business Intelligence Server 10.2
IBM Cognos Business Intelligence Server 10.1.1
IBM Cognos Business Intelligence Server 10.1
IBM Cognos Business Intelligence Server 8.4.1

REMEDIATION:
The recommended solution is to apply the fix in one of the 10.x versions listed or in version 8.4.1 for your release version as soon as practical.

Related

ibm 27
nvd 6
cve 6
prion 6
cvelist 6
f5 4
nessus 44
fedora 9
securityvulns 2
veracode 18
cert 1
openvas 41
mageia 4
ubuntucve 3
redhat 7
oraclelinux 3
centos 3
amazon 2
ubuntu 2
suse 4
aix 1
ibm
ibm
Security Bulletin: Multiple security exposures in IBM Cognos Express (CVE-2013-5802, CVE-2013-5825)
2022-11-10 12:06:25
Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java for WebSphere Application Server Community 3.0.0.4 October 2013 CPU (CVE-2013-5802,CVE-2013-5825)
2018-06-15 06:59:08
Security Bulletin: Multiple Vulnerabilities in current IBM SDK for Java for IBM Rational ClearQuest Web Client (CVE-2013-5802 and CVE-2013-5825)
2018-06-17 04:50:48
nvd
nvd
CVE-2013-6732
2014-02-22 21:55:04
CVE-2013-5825
2013-10-16 17:55:05
CVE-2013-6954
2014-01-12 18:34:55
cve
cve
CVE-2013-6732
2014-02-22 21:55:04
CVE-2013-5825
2013-10-16 17:55:05
CVE-2014-0854
2014-02-22 21:55:09
prion
prion
Cross site scripting
2014-02-22 21:55:00
Null pointer dereference
2014-01-12 18:34:00
Design/Logic Flaw
2013-10-16 17:55:00
cvelist
cvelist
CVE-2013-6732
2014-02-22 21:00:00
CVE-2013-5802
2013-10-16 17:31:00
CVE-2013-5825
2013-10-16 17:31:00
f5
f5
SOL53316849 - Java vulnerability CVE-2013-5802
2016-05-24 00:00:00
K53316849 : Java vulnerability CVE-2013-5802
2016-05-24 00:00:00
K48802597 : Java vulnerabilities CVE-2013-5825 and CVE-2013-5830
2016-06-09 00:00:00
nessus
nessus
Fedora 19 : libpng10-1.0.60-6.fc19 (2014-1754)
2014-02-07 00:00:00
Mandriva Linux Security Advisory : libpng (MDVSA-2014:035)
2014-02-18 00:00:00
Fedora 19 : libpng12-1.2.50-4.fc19 (2014-1766)
2014-02-12 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: libpng10-1.0.60-6.fc19
2014-02-07 03:09:00
[SECURITY] Fedora 20 Update: libpng12-1.2.50-6.fc20
2014-02-11 23:05:23
[SECURITY] Fedora 20 Update: libpng10-1.0.60-6.fc20
2014-02-07 03:09:47
securityvulns
securityvulns
[ MDVSA-2014:035 ] libpng
2014-02-18 00:00:00
libpng DoS
2014-02-18 00:00:00
veracode
veracode
Sandbox Restrictions Bypass
2019-05-02 04:54:23
Denial Of Service (DoS)
2019-05-02 04:54:23
Sandbox Restrictions Bypass
2019-05-02 04:58:35
cert
cert
libpng 1.6.1 through 1.6.7 contain a null-pointer dereference vulnerability
2014-01-09 00:00:00
openvas
openvas
Fedora Update for libpng FEDORA-2014-6717
2014-06-17 00:00:00
Fedora Update for libpng12 FEDORA-2014-1770
2014-02-13 00:00:00
Fedora Update for libpng12 FEDORA-2014-1766
2014-02-13 00:00:00
mageia
mageia
Updated libpng12 package fixes security vulnerability
2014-02-16 17:29:28
Updated libpng and libpng12 packages fix security vulnerability
2014-02-16 17:28:12
Updated java-1.6.0-openjdk package fixes multiple vulnerabilities
2013-11-13 23:05:43
ubuntucve
ubuntucve
CVE-2013-6954
2014-01-12 00:00:00
CVE-2013-5802
2013-10-16 00:00:00
CVE-2013-5825
2013-10-16 00:00:00
redhat
redhat
(RHSA-2013:1509) Important: java-1.5.0-ibm security update
2013-11-07 00:00:00
(RHSA-2013:1505) Important: java-1.6.0-openjdk security update
2013-11-05 00:00:00
(RHSA-2013:1451) Critical: java-1.7.0-openjdk security update
2013-10-22 00:00:00
oraclelinux
oraclelinux
java-1.6.0-openjdk security update
2013-11-05 00:00:00
java-1.7.0-openjdk security update
2013-10-21 00:00:00
java-1.7.0-openjdk security update
2013-10-22 00:00:00
centos
centos
java security update
2013-11-05 20:45:16
java security update
2013-10-23 11:04:05
java security update
2013-10-22 07:41:01
amazon
amazon
Important: java-1.6.0-openjdk
2013-11-05 13:35:00
Critical: java-1.7.0-openjdk
2013-10-23 15:22:00
ubuntu
ubuntu
OpenJDK 6 vulnerabilities
2013-11-21 00:00:00
OpenJDK 7 vulnerabilities
2014-01-23 00:00:00
suse
suse
Security update for OpenJDK 7 (important)
2013-11-13 15:04:17
Security update for IBM Java 5 (important)
2013-11-14 16:04:15
Security update for IBM Java 5 (important)
2013-11-15 00:04:35
aix
aix
Multiple Java vulnerabilities
2013-12-11 10:53:34

0.133 Low

EPSS

Percentile

95.6%

JSON
Related for B759C8B69F6CB54EF6037AB2A3007E7D5FFFD317FF2398C5230C17D51C9369CB
ibm27nvd6cve6prion6cvelist6f54nessus44fedora9securityvulns2veracode18cert1openvas41mageia4ubuntucve3redhat7oraclelinux3centos3amazon2ubuntu2suse4aix1