Vulnerabilites related to ibm - cognos_executive_viewer
CVE-2012-0696 (GCVE-0-2012-0696)
Vulnerability from cvelistv5
Published
2012-01-13 02:00
Modified
2024-08-06 18:30
Severity ?
CWE
  • n/a
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js.
References
http://www.osvdb.org/78217vdb-entry, x_refsource_OSVDB
http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682vendor-advisory, x_refsource_AIXAPAR
http://securitytracker.com/id?1026491vdb-entry, x_refsource_SECTRACK
https://exchange.xforce.ibmcloud.com/vulnerabilities/72198vdb-entry, x_refsource_XF
http://www.osvdb.org/78216vdb-entry, x_refsource_OSVDB
http://secunia.com/advisories/47487third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/51326vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:30:53.999Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "78217",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/78217"
          },
          {
            "name": "PM26682",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682"
          },
          {
            "name": "1026491",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1026491"
          },
          {
            "name": "cevtm1-aspnetclient-createcontrol-xss(72198)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72198"
          },
          {
            "name": "78216",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/78216"
          },
          {
            "name": "47487",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/47487"
          },
          {
            "name": "51326",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/51326"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-01-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "78217",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/78217"
        },
        {
          "name": "PM26682",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682"
        },
        {
          "name": "1026491",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1026491"
        },
        {
          "name": "cevtm1-aspnetclient-createcontrol-xss(72198)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72198"
        },
        {
          "name": "78216",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/78216"
        },
        {
          "name": "47487",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/47487"
        },
        {
          "name": "51326",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/51326"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-0696",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "78217",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/78217"
            },
            {
              "name": "PM26682",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682"
            },
            {
              "name": "1026491",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1026491"
            },
            {
              "name": "cevtm1-aspnetclient-createcontrol-xss(72198)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72198"
            },
            {
              "name": "78216",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/78216"
            },
            {
              "name": "47487",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/47487"
            },
            {
              "name": "51326",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/51326"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-0696",
    "datePublished": "2012-01-13T02:00:00",
    "dateReserved": "2012-01-12T00:00:00",
    "dateUpdated": "2024-08-06T18:30:53.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2012-01-13 04:14
Modified
2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js.
References
cve@mitre.orghttp://secunia.com/advisories/47487Vendor Advisory
cve@mitre.orghttp://securitytracker.com/id?1026491
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg1PM26682Vendor Advisory
cve@mitre.orghttp://www.osvdb.org/78216
cve@mitre.orghttp://www.osvdb.org/78217
cve@mitre.orghttp://www.securityfocus.com/bid/51326
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/72198
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/47487Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1026491
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/78216
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/78217
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/51326
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/72198
Impacted products
Vendor Product Version
ibm cognos_executive_viewer *
ibm cognos_tm1 *
ibm cognos_tm1 9.4.0
ibm cognos_tm1 9.4.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cognos_executive_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73BBE818-E7D4-4DE3-A60A-3E16493B762E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_tm1:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "764043E6-F81F-41C3-8862-EBC7FA29AB9D",
              "versionEndIncluding": "9.4.1.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_tm1:9.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "285E738C-B037-4D91-B95D-3165A00D2977",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_tm1:9.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CDFEB23-5AD7-45D8-A7A0-7CB58715FE42",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js."
    },
    {
      "lang": "es",
      "value": "Varias vulnerabilidades de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en el Executive Viewer (EV) de IBM Cognos TM1 antes de la versi\u00f3n v9.5 FP1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de peticiones no especificadas a (1) aspnet_client o (2) evserver/createcontrol.js."
    }
  ],
  "id": "CVE-2012-0696",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-01-13T04:14:39.083",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47487"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1026491"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/78216"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/78217"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/51326"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72198"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47487"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1026491"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/78216"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/78217"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/51326"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72198"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}