CVE:CVE-2012-0696
CNNVD:CNNVD-201201-160
IBM Cognos TM1 9.5 FP1 之前版本中的Executive Viewer (EV)中存在多个跨站脚本漏洞。远程攻击者借助特制的请求如(1)aspnet_client或者(2) evserver/createcontrol.js注入任意web脚本或者HTML。
solution:Upgrade ibm cognos_executive_viewer to a higher version than *; Upgrade ibm cognos_tm1 to a higher version than 9.4.1.3,9.4.0,9.4.1,and avoid the version (,9.4.1.3],9.4.0,9.4.1