CVE-2019-4171

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 158876.

• CWE-311

• https://exchange.xforce.ibmcloud.com/vulnerabilities/158876VDB Entry, Vendor Advisory
• https://www.ibm.com/support/pages/security-bulletin-security-vulnerabilties-exist-ibm-cognos-controllerPatch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/158876VDB Entry, Vendor Advisory
• https://www.ibm.com/support/pages/security-bulletin-security-vulnerabilties-exist-ibm-cognos-controllerPatch, Vendor Advisory

Published

Sep 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-4162IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.…7.5
• CVE-2019-4163IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authent…4.3
• CVE-2019-4165IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow a remote a…7.5
• CVE-2019-4166IBM StoredIQ 7.6 could allow a remote attacker to conduct ph…6.1
• CVE-2019-4167IBM StoredIQ 7.6.0 is vulnerable to cross-site request forge…6.5
• CVE-2019-4169IBM Open Power Firmware OP910 and OP920 could allow access t…9.1
• CVE-2019-4173IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10…6.5
• CVE-2019-4174IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10…3.3
• CVE-2019-4175IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 use…7.5
• CVE-2019-4176IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10…5.3
• CVE-2019-4177IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10…3.3
• CVE-2019-4178IBM Cognos Analytics 11 could allow a remote attacker to tra…6.4