Threat database

IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 transmit sensitive information in clear text. This vulnerability could allow an attacker to intercept sensitive data using man-in-the-middle techniques. The CVSS score is 5.9, indicating a medium severity risk. No known exploits are reported in the wild. The vulnerability does not affect cloud services and no patch information is provided.

CVE-2025-1350 is a vulnerability in IBM Controller versions 11.0.0 and 11.1.0 where detailed technical error messages containing sensitive information are exposed to remote attackers via the browser. This exposure could aid attackers in further compromising the system. The vulnerability has a medium severity with a CVSS score of 5.3.

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.

IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included within the source code.