Priority LOW 30
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00167 · Published 2026-08-13 · No fix listed CWE-352
Priority LOW 35
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.00383 · Published 2026-07-30 · No fix listed CWE-601
Priority LOW 29
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0035 · Published 2026-03-17 · No fix listed CWE-200
Priority LOW 25
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.0031 · Published 2026-03-17 · No fix listed CWE-524
Priority LOW 19
IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00214 · Published 2025-12-09 · No fix listed CWE-209
Priority LOW 20
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.0023 · Published 2025-11-17 · No fix listed CWE-540
Priority LOW 38
IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00874 · Published 2025-11-17 · No fix listed CWE-36
Priority LOW 22
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of…
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00301 · Published 2025-09-30 · No fix listed CWE-1286
Priority LOW 24
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00192 · Published 2025-09-30 · No fix listed CWE-79
Priority LOW 38
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00259 · Published 2025-06-01 · No fix listed CWE-613
Priority LOW 29
IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00478 · Published 2025-06-01 · No fix listed CWE-22
Priority LOW 24
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00213 · Published 2025-06-01 · No fix listed CWE-79
Priority LOW 24
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00215 · Published 2025-06-01 · No fix listed CWE-79
Priority MEDIUM 42
IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0043 · Published 2024-08-04 · No fix listed CWE-306
Priority LOW 24
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00249 · Published 2024-05-31 · No fix listed CWE-79
Priority LOW 28
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to stored cross-site scripting.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00249 · Published 2024-05-31 · No fix listed CWE-79
Priority LOW 26
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00249 · Published 2024-05-31 · No fix listed CWE-79
Priority LOW 28
IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.0035 · Published 2023-05-12 · No fix listed CWE-79
Priority LOW 25
IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01093 · Published 2021-08-10 · No fix listed CWE-252
Priority MEDIUM 44
IBM Planning Analytics Local 2.0 connects to a Redis server.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0244 · Published 2021-05-17 · No fix listed CWE-306
Priority MEDIUM 43
IBM Planning Analytics Local 2.0 connects to a MongoDB server.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01936 · Published 2021-05-17 · No fix listed CWE-862
Priority LOW 35
IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00982 · Published 2021-05-14 · No fix listed
Priority LOW 22
IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00816 · Published 2020-11-03 · No fix listed CWE-200
Priority LOW 25
IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00561 · Published 2020-07-29 · No fix listed CWE-79
Priority LOW 27
IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.0123 · Published 2020-07-29 · No fix listed CWE-1021
Load more
THREATIST.IORead the docs