CVE-2017-1764

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM X-Force ID: 136149.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM	Cognos Business Intelligence	10.2; 10.2.1; 10.2.1.1; 10.2.2

References

http://www.ibm.com/support/docview.wss?uid=swg22014202Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/136149VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22014202Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/136149VDB Entry, Vendor Advisory

Timeline

Published: Apr 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-176409.8Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter.CVE-2017-176419.8Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.CVE-2017-176429.8Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.CVE-2017-176439.8FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.CVE-2017-176459.8Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.CVE-2017-176489.8Entrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender, country, or profileid parameter.CVE-2017-176496.1Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.CVE-2017-17654.3IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the applica CVE-2017-176519.8Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/CVE-2017-176529.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authent CVE-2017-176539.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authent CVE-2017-176549.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authent