5.4
Medium
CVE-2019-4136 IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting
Description
IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158332.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cognos Controller | 10.4.0 | No fix stated |
| Cognos Controller 10.3 | 10.3.0 → 10.3.1 | No fix stated |
| Cognos Controller 10.2 | 10.2.0 → 10.2.1 | No fix stated |
Other CVEs of Cognos Controller
The 52 CVEs of Cognos Controller →
CVE-2025-36102
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user…
2.7
Low
CVE-2025-33111
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of…
4.3
Medium
CVE-2025-36015
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated…
6.5
Medium
CVE-2025-36326
IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to…
3.7
Low