Cognos Transformer
Monthly
Cross-site scripting in IBM Cognos Analytics and IBM Cognos Transformer allows unauthenticated remote attackers to inject arbitrary JavaScript into the web user interface, but successful exploitation requires a victim with an active Cognos session to interact with the malicious content. If triggered, the script executes in the trusted session and could alter UI functionality or expose credentials within that session, although the independent assessment caps confidentiality and integrity impact at Low and notes no availability impact. This CVE is not listed in CISA KEV, no public exploit code has been identified in the supplied data, and EPSS is 0.03% (10th percentile), indicating a relatively low likelihood of exploitation at this time.
Stored cross-site scripting in IBM Cognos Analytics and Cognos Transformer's Administration interface allows an authenticated low-privileged user to inject persistent JavaScript payloads into the Web UI, which then execute in the browser sessions of other users - including higher-privileged administrators - potentially leading to credential theft or session hijacking. Affected are Cognos Analytics versions 11.2.0, 12.0, and 12.1.0, and Cognos Transformer versions 11.2.4, 12.0, and 12.1.0. No public exploit identified at time of analysis, and the EPSS score of 0.03% (8th percentile) combined with SSVC exploitation status of 'none' indicates very low observed exploitation pressure.
Cross-site scripting in IBM Cognos Analytics and IBM Cognos Transformer allows unauthenticated remote attackers to inject arbitrary JavaScript into the web user interface, but successful exploitation requires a victim with an active Cognos session to interact with the malicious content. If triggered, the script executes in the trusted session and could alter UI functionality or expose credentials within that session, although the independent assessment caps confidentiality and integrity impact at Low and notes no availability impact. This CVE is not listed in CISA KEV, no public exploit code has been identified in the supplied data, and EPSS is 0.03% (10th percentile), indicating a relatively low likelihood of exploitation at this time.
Stored cross-site scripting in IBM Cognos Analytics and Cognos Transformer's Administration interface allows an authenticated low-privileged user to inject persistent JavaScript payloads into the Web UI, which then execute in the browser sessions of other users - including higher-privileged administrators - potentially leading to credential theft or session hijacking. Affected are Cognos Analytics versions 11.2.0, 12.0, and 12.1.0, and Cognos Transformer versions 11.2.4, 12.0, and 12.1.0. No public exploit identified at time of analysis, and the EPSS score of 0.03% (8th percentile) combined with SSVC exploitation status of 'none' indicates very low observed exploitation pressure.