CVE-2014-0861

EUVD-2014-0891
Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter that is not properly handled during use of the Back button.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
Affected Products (NVD)
VendorProductVersion
ibmcognos_business_intelligence
8.4.1
ibmcognos_business_intelligence
10.1
ibmcognos_business_intelligence
10.1.1
ibmcognos_business_intelligence
10.2
ibmcognos_business_intelligence
10.2.1
ibmcognos_business_intelligence
10.2.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www-01.ibm.com/support/docview.wss?uid=swg21662856
http://www-01.ibm.com/support/docview.wss?uid=swg21662856