Multiple vulnerabilities in IBM Cognos Controller



| Updated: 2025-02-27
Risk High
Patch available YES
Number of vulnerabilities 32
CVE-ID CVE-2017-3514
CVE-2017-3512
CVE-2017-3511
CVE-2017-3526
CVE-2017-3509
CVE-2017-3544
CVE-2017-3533
CVE-2017-3539
CVE-2017-12899
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
CVE-2017-10125
CVE-2017-10067
CVE-2017-10115
CVE-2017-10078
CVE-2017-10090
CVE-2017-10096
CVE-2017-10101
CVE-2017-10116
CVE-2017-10102
CVE-2017-10087
CVE-2017-10089
CVE-2017-10107
CVE-2017-10110
CVE-2017-1376
CVE-2017-10105
CVE-2017-10053
CVE-2017-10108
CVE-2017-10109
CVE-2017-10243
CWE-ID CWE-20
CWE-200
CWE-264
CWE-126
CWE-125
Exploitation vector Network
Public exploit N/A
Vulnerable software
 IBM Cognos Controller
Client/Desktop applications / Other client software

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 32 vulnerabilities.

1) Remote code execution

EUVDB-ID: #VU6714

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-3514

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to unknown error related to the Java SE AWT component. A remote attacker can trick the victim into visiting a specially crafted webpage and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Remote code execution

EUVDB-ID: #VU6713

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-3512

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to unknown error related to the Java SE AWT component. A remote attacker can trick the victim into visiting a specially crafted webpage and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Remote code execution

EUVDB-ID: #VU6669

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-3511

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to unknown error related to the Java SE, Java SE Embedded, JRockit JCE component. A remote attacker can trick the victim into visiting a specially crafted webpage and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Denial of service

EUVDB-ID: #VU6694

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-3526

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted webpage and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Security restrictions bypass

EUVDB-ID: #VU6668

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-3509

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information on the target system.

The weakness exists due to unknown error. A remote attacker can read and modify arbitrary files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Security restrictions bypass

EUVDB-ID: #VU6672

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-3544

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to modify information on the target system.

The weakness exists due to unknown error related to the Java SE, Java SE Embedded Networking component. A remote attacker can access and modify arbitrary data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security restrictions bypass

EUVDB-ID: #VU6670

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-3533

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to modify information on the target system.

The weakness exists due to unknown error related to the Java SE, Java SE Embedded, JRockit Networking component. A remote attacker can access and modify arbitrary data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Security restrictions bypass

EUVDB-ID: #VU6671

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-3539

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to modify information on the target system.

The weakness exists due to unknown error related to the Java SE, Java SE Embedded Security component. A remote attacker can trick the victim into visiting a specially crafted webpage, access and modify arbitrary data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer over-read

EUVDB-ID: #VU8348

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-12899

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to buffer over-read in the DECnet component. A remote attacker can send a specially crafted request and retrieve arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Denial of service

EUVDB-ID: #VU6663

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9840

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to out-of-bounds pointer arithmetic in inftrees.c. A remote attacker can send a specially crafted document, trick the victim into opening it, and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Denial of service

EUVDB-ID: #VU6664

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9841

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to out-of-bounds pointer arithmetic in inftrees.c. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Denial of service

EUVDB-ID: #VU6665

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9842

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to an undefined left shift of negative number. A remote attacker can send a specially crafted document, trick the victim into opening it, and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Denial of service

EUVDB-ID: #VU6666

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9843

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to big-endian out-of-bounds pointer. A remote attacker can send a specially crafted document, trick the victim into opening it, and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Arbitrary code execution

EUVDB-ID: #VU8080

Risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-10125

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to the system to execute arbitrary code on the target system.

The weakness exists due to unknown error. A remote attacker can execute arbitrary code with elevated privileges and compromise the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Privilege escalation

EUVDB-ID: #VU8096

Risk: Low

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10067

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to gain elevated privileges.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website and gain privileged access to the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Information disclosure

EUVDB-ID: #VU8083

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10115

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to unknown error. A remote attacker can disclose important data on the target system

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Security restrictions bypass

EUVDB-ID: #VU8095

Risk: Low

CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10078

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, bypass security restrictions and disclose and modify important data on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Remote code execution

EUVDB-ID: #VU8092

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10090

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Remote code execution

EUVDB-ID: #VU8091

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10096

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Remote code execution

EUVDB-ID: #VU8090

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10101

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Remote code execution

EUVDB-ID: #VU8082

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10116

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Remote code execution

EUVDB-ID: #VU8089

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10102

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Remote code execution

EUVDB-ID: #VU8094

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10087

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Remote code execution

EUVDB-ID: #VU8093

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10089

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Remote code execution

EUVDB-ID: #VU8087

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10107

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Remote code execution

EUVDB-ID: #VU8084

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10110

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take control over the affected system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Privilege escalation

EUVDB-ID: #VU8079

Risk: Low

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-1376

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the IBM J9 VM class verifier. A remote attacker can supply a specially crafted untrusted code to disable the security manager and escalate his privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Security restrictions bypass

EUVDB-ID: #VU8088

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-10105

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, bypass security restrictions and modify arbitrary data on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Denial of service

EUVDB-ID: #VU8097

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10053

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to unknown error. A remote attacker can cause the application to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Denial of service

EUVDB-ID: #VU8086

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10108

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to unknown error. A remote attacker can cause the application to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Denial of service

EUVDB-ID: #VU8085

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10109

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to unknown error. A remote attacker can cause the application to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Information disclosure

EUVDB-ID: #VU8081

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10243

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition on the target system.

The weakness exists due to unknown error. A remote attacker can disclose arbitrary files or cause the application to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cognos Controller: 10.2.0 - 10.3.0

CPE2.3 External links

https://www-01.ibm.com/support/docview.wss?uid=swg22010679&myns=swgimgmt&mynp=OCSS9S6B&mync=E&cm_sp=swgimgmt-_-OCSS9S6B-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###