FKIE_CVE-2012-0696

Vulnerability from fkie_nvd - Published: 2012-01-13 04:14 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js.
References
cve@mitre.orghttp://secunia.com/advisories/47487Vendor Advisory
cve@mitre.orghttp://securitytracker.com/id?1026491
cve@mitre.orghttp://www-01.ibm.com/support/docview.wss?uid=swg1PM26682Vendor Advisory
cve@mitre.orghttp://www.osvdb.org/78216
cve@mitre.orghttp://www.osvdb.org/78217
cve@mitre.orghttp://www.securityfocus.com/bid/51326
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/72198
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/47487Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1026491
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/78216
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/78217
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/51326
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/72198
Impacted products
Vendor Product Version
ibm cognos_executive_viewer *
ibm cognos_tm1 *
ibm cognos_tm1 9.4.0
ibm cognos_tm1 9.4.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cognos_executive_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73BBE818-E7D4-4DE3-A60A-3E16493B762E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_tm1:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "764043E6-F81F-41C3-8862-EBC7FA29AB9D",
              "versionEndIncluding": "9.4.1.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_tm1:9.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "285E738C-B037-4D91-B95D-3165A00D2977",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cognos_tm1:9.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CDFEB23-5AD7-45D8-A7A0-7CB58715FE42",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js."
    },
    {
      "lang": "es",
      "value": "Varias vulnerabilidades de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en el Executive Viewer (EV) de IBM Cognos TM1 antes de la versi\u00f3n v9.5 FP1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de peticiones no especificadas a (1) aspnet_client o (2) evserver/createcontrol.js."
    }
  ],
  "id": "CVE-2012-0696",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-01-13T04:14:39.083",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47487"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1026491"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/78216"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/78217"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/51326"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72198"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47487"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1026491"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/78216"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/78217"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/51326"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72198"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.