Planning Analytics Local vulnerabilities
6 known vulnerabilities in Planning Analytics Local from IBM. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Planning Analytics Local: URL Redirection to Untrusted Site
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens
- 8.0 High severity
IBM Planning Analytics Local: Absolute Path Traversal
IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files o
- 8.8 High severity
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which…
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
- 8.0 High severity
Planning Analytics Local: Unrestricted Upload of File with Dangerous Type
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can b
- 8.8 High severity
Planning Analytics Local: Unrestricted Upload of File with Dangerous Type
IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to
- 9.1 Critical severity
Planning Analytics Local: Missing Authentication for Critical Functionality
IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthor