Total
32 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-13365 | 1 Ibm | 1 Planning Analytics Local | 2026-08-17 | N/A | 7.1 HIGH |
| IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | |||||
| CVE-2026-10545 | 1 Ibm | 1 Planning Analytics Local | 2026-08-12 | N/A | 7.5 HIGH |
| IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions. | |||||
| CVE-2026-1267 | 2 Ibm, Microsoft | 2 Planning Analytics Local, Windows | 2026-06-17 | N/A | 6.5 MEDIUM |
| IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls. | |||||
| CVE-2025-36437 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 4.3 MEDIUM |
| IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system. | |||||
| CVE-2025-36357 | 1 Ibm | 2 Planning Analytics Local, Planning Analytics Workspace | 2026-06-17 | N/A | 8.0 HIGH |
| IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system. | |||||
| CVE-2025-36299 | 1 Ibm | 2 Planning Analytics Local, Planning Analytics Workspace | 2026-06-17 | N/A | 4.3 MEDIUM |
| IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system. | |||||
| CVE-2025-36262 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 4.9 MEDIUM |
| IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input. | |||||
| CVE-2025-36132 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 5.4 MEDIUM |
| IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2025-33005 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 6.3 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system. | |||||
| CVE-2025-33004 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 6.5 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction. | |||||
| CVE-2025-2896 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 4.8 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2025-25044 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 5.4 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2025-14806 | 2 Ibm, Microsoft | 2 Planning Analytics Local, Windows | 2026-06-17 | N/A | 5.7 MEDIUM |
| IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources. | |||||
| CVE-2024-35143 | 1 Ibm | 2 Planning Analytics Local, Planning Analytics Workspace | 2026-06-17 | N/A | 6.7 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 292420. | |||||
| CVE-2024-31908 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 6.4 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 289890. | |||||
| CVE-2024-31907 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 5.4 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 289889. | |||||
| CVE-2024-31889 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 5.4 MEDIUM |
| IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 288136. | |||||
| CVE-2023-28520 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | N/A | 6.4 MEDIUM |
| IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 250454. | |||||
| CVE-2021-29739 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. X-Force ID: 198846. | |||||
| CVE-2020-4985 | 1 Ibm | 1 Planning Analytics Local | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642. | |||||