CVE-2019-4174

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158879.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
IBM	Cognos Controller	10.2.1; 10.2.0; 10.3.1; 10.3.0; 10.4.0

References

http://www.ibm.com/support/docview.wss?uid=ibm10886913Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/158879VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10886913Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/158879VDB Entry, Vendor Advisory

Timeline

Published: Jun 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-41757.5IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to CVE-2019-41765.3IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an CVE-2019-41773.3IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on CVE-2019-41789.1IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL CVE-2019-41837.5IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted req CVE-2019-41845.4IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav CVE-2019-41858.3IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. IBM X-CVE-2019-41866.1IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during cachi CVE-2019-41937.5IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if CVE-2019-41944.3IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete autho CVE-2019-42016.1IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirec CVE-2019-420210.0IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can ru