HITVAN

Latest CVEs · RSS

• CVE-2026-108337 2026-10-14 · CVSS 7.4
  An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an AP
• CVE-2026-108336 2026-10-14 · CVSS 9.1
  When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface
• CVE-2026-108335 2026-10-14 · CVSS 9.1
  When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no ra
• CVE-2026-2253 2026-05-27 · CVSS 7.7
  Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from
• CVE-2026-2255 2026-05-27 · CVSS 4.3
  Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plai
• CVE-2026-2254 2026-05-27 · CVSS 6.3
  Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoi
• CVE-2025-11159 2026-05-13 · CVSS 9.1
  Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution whe
• CVE-2025-11158 2026-03-09 · CVSS 9.1
  Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports pub
• CVE-2025-9121 2025-12-15 · CVSS 8.8
  Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data
• CVE-2025-9122 2025-12-15 · CVSS 5.3
  Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full se
• CVE-2025-24907 2025-04-16 · CVSS 6.8
  Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '...
• CVE-2025-24911 2025-04-16 · CVSS 4.9
  Overview   XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is
• CVE-2025-24910 2025-04-16 · CVSS 4.9
  Overview   XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is
• CVE-2025-24909 2025-04-16 · CVSS 4.4
  Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page th
• CVE-2025-24908 2025-04-16 · CVSS 6.8
  Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '...
• CVE-2025-0756 2025-04-16 · CVSS 9.1
  Overview   The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an ide
• CVE-2025-0757 2025-04-16 · CVSS 4.4
  Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page tha
• CVE-2025-0758 2025-04-16 · CVSS 6.1
  Overview  The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
• CVE-2024-37363 2025-02-19 · CVSS 6.5
  The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862)  Hitachi Vantara Pentaho B
• CVE-2024-37362 2025-02-19 · CVSS 6.3
  The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (C
• CVE-2024-6697 2025-02-19 · CVSS 6.5
  The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. T
• CVE-2024-6696 2025-02-19 · CVSS 4.9
  The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sys
• CVE-2024-37361 2025-02-19 · CVSS 9.9
  The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)   Hitachi Vantara Pentaho Busi
• CVE-2024-37360 2025-02-19 · CVSS 4.4
  Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')   The software d
• CVE-2024-37359 2025-02-19 · CVSS 8.6
  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the