Planning Analytics vulnerabilities
11 known vulnerabilities in Planning Analytics from IBM. 11 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Planning Analytics: Stack-based Buffer Overflow
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
- 7.5 High severity
Planning Analytics: Improper Limitation of a Pathname to a Restricted Directory
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
- 8.2 High severity
Planning Analytics: Improper Limitation of a Pathname to a Restricted Directory
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.
- 9.8 Critical severity
Planning Analytics: Authentication Bypass Using an Alternate Path or Channel
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
- 7.1 High severity
Planning Analytics: Improper Authorization
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.
- 8.0 High severity
Planning Analytics Local: Unrestricted Upload of File with Dangerous Type
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can b
- 8.8 High severity
Planning Analytics Local: Unrestricted Upload of File with Dangerous Type
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to
- 9.8 Critical severity
Planning Analytics: Unrestricted Upload of File with Dangerous Type
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a maliciou
- 7.3 High severity
Planning Analytics: Server-Side Request Forgery
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 21
- 7.8 High severity
Planning Analytics: Inclusion of Functionality from Untrusted Control Sphere
IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891.
- 9.8 Critical severity
IBM Planning Analytics Remote Code Execution Exploited
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.