CVE-2012-0696

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-01-13 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js.

Affected products

IBM Cognos Executive Viewer: all versions
IBM Cognos TM1: through 9.4.1.3; 9.4.0, 9.4.1

References

http://secunia.com/advisories/47487
http://securitytracker.com/id?1026491
http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682
http://www.osvdb.org/78216
http://www.osvdb.org/78217
http://www.securityfocus.com/bid/51326
https://exchange.xforce.ibmcloud.com/vulnerabilities/72198
http://secunia.com/advisories/47487
http://securitytracker.com/id?1026491
http://www-01.ibm.com/support/docview.wss?uid=swg1PM26682
http://www.osvdb.org/78216
http://www.osvdb.org/78217

Get alerted when CVE-2012-0696 or the next vulnerability affects your stack