CVE-2025-25032

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
IBM	Cognos Analytics	11.2.0; 11.2.1; 11.2.2; 11.2.3; 11.2.4; 12.0.0; 12.0.1; 12.0.2; 12.0.3; 12.0.4

References

https://www.ibm.com/support/pages/node/7234674Vendor Advisory

Timeline

Published: Jun 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-250349.3A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper vali CVE-2025-250357.3Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected X CVE-2025-250366.8Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions CVE-2025-250379.3An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0 CVE-2025-250389.8An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to p CVE-2025-250398.8A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated us CVE-2025-250403.3A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Seri CVE-2025-250415.5A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as CVE-2025-250424.3A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information.CVE-2025-250445.4IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arb CVE-2025-250454.3IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returne CVE-2025-250463.7IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be e